Edit tour

Windows Analysis Report
https://firstforcheck-com.fmailroute.net/d8I7pBRrJuxaIwZfRUDtnEmNxnN2RsmY3GcY6bXFDKL_7-PX1jfOWrL4ddomY3LulkDX92pSDxPXqJKzqE7jBkJLMl25z5bKcyonDf4ngPeJyhdSvL4vV_emiziuVfLJ4mpJR5U0JfPs3FnyI3xd6Ynk1_KaVseIQifh-VriH6wajgm_0w8vx7zdlIfyMIoXkaUzMMUn

Overview

General Information

Sample URL:	https://firstforcheck-com.fmailroute.net/d8I7pBRrJuxaIwZfRUDtnEmNxnN2RsmY3GcY6bXFDKL_7-PX1jfOWrL4ddomY3LulkDX92pSDxPXqJKzqE7jBkJLMl25z5bKcyonDf4ngPeJyhdSvL4vV_emiziuVfLJ4mpJR5U0JfPs3FnyI3xd6Ynk1_KaVse
Analysis ID:	1541812
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4460 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3424 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2536 --field-trial-handle=2508,i,6210796828418128876,436418289677533164,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4424 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://firstforcheck-com.fmailroute.net/d8I7pBRrJuxaIwZfRUDtnEmNxnN2RsmY3GcY6bXFDKL_7-PX1jfOWrL4ddomY3LulkDX92pSDxPXqJKzqE7jBkJLMl25z5bKcyonDf4ngPeJyhdSvL4vV_emiziuVfLJ4mpJR5U0JfPs3FnyI3xd6Ynk1_KaVseIQifh-VriH6wajgm_0w8vx7zdlIfyMIoXkaUzMMUn" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://firstforcheck-com.fmailroute.net/d8I7pBRrJuxaIwZfRUDtnEmNxnN2RsmY3GcY6bXFDKL_7-PX1jfOWrL4ddomY3LulkDX92pSDxPXqJKzqE7jBkJLMl25z5bKcyonDf4ngPeJyhdSvL4vV_emiziuVfLJ4mpJR5U0JfPs3FnyI3xd6Ynk1_KaVseIQifh-VriH6wajgm_0w8vx7zdlIfyMIoXkaUzMMUn

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49732 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /d8I7pBRrJuxaIwZfRUDtnEmNxnN2RsmY3GcY6bXFDKL_7-PX1jfOWrL4ddomY3LulkDX92pSDxPXqJKzqE7jBkJLMl25z5bKcyonDf4ngPeJyhdSvL4vV_emiziuVfLJ4mpJR5U0JfPs3FnyI3xd6Ynk1_KaVseIQifh-VriH6wajgm_0w8vx7zdlIfyMIoXkaUzMMUn HTTP/1.1Host: firstforcheck-com.fmailroute.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: firstforcheck-com.fmailroute.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://firstforcheck-com.fmailroute.net/d8I7pBRrJuxaIwZfRUDtnEmNxnN2RsmY3GcY6bXFDKL_7-PX1jfOWrL4ddomY3LulkDX92pSDxPXqJKzqE7jBkJLMl25z5bKcyonDf4ngPeJyhdSvL4vV_emiziuVfLJ4mpJR5U0JfPs3FnyI3xd6Ynk1_KaVseIQifh-VriH6wajgm_0w8vx7zdlIfyMIoXkaUzMMUnAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: firstforcheck-com.fmailroute.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: global traffic	DNS traffic detected: DNS query: firstforcheck-com.fmailroute.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49732 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@16/11@6/4

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2536 --field-trial-handle=2508,i,6210796828418128876,436418289677533164,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://firstforcheck-com.fmailroute.net/d8I7pBRrJuxaIwZfRUDtnEmNxnN2RsmY3GcY6bXFDKL_7-PX1jfOWrL4ddomY3LulkDX92pSDxPXqJKzqE7jBkJLMl25z5bKcyonDf4ngPeJyhdSvL4vV_emiziuVfLJ4mpJR5U0JfPs3FnyI3xd6Ynk1_KaVseIQifh-VriH6wajgm_0w8vx7zdlIfyMIoXkaUzMMUn"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2536 --field-trial-handle=2508,i,6210796828418128876,436418289677533164,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://firstforcheck-com.fmailroute.net/d8I7pBRrJuxaIwZfRUDtnEmNxnN2RsmY3GcY6bXFDKL_7-PX1jfOWrL4ddomY3LulkDX92pSDxPXqJKzqE7jBkJLMl25z5bKcyonDf4ngPeJyhdSvL4vV_emiziuVfLJ4mpJR5U0JfPs3FnyI3xd6Ynk1_KaVseIQifh-VriH6wajgm_0w8vx7zdlIfyMIoXkaUzMMUn	0%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
firstforcheck-com.fmailroute.net	18.237.22.124	true	false	unknown
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
www.google.com	142.250.185.228	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://firstforcheck-com.fmailroute.net/favicon.ico	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.228	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
18.237.22.124	firstforcheck-com.fmailroute.net	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541812
Start date and time:	2024-10-25 07:19:32 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://firstforcheck-com.fmailroute.net/d8I7pBRrJuxaIwZfRUDtnEmNxnN2RsmY3GcY6bXFDKL_7-PX1jfOWrL4ddomY3LulkDX92pSDxPXqJKzqE7jBkJLMl25z5bKcyonDf4ngPeJyhdSvL4vV_emiziuVfLJ4mpJR5U0JfPs3FnyI3xd6Ynk1_KaVseIQifh-VriH6wajgm_0w8vx7zdlIfyMIoXkaUzMMUn
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@16/11@6/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.35, 108.177.15.84, 142.250.186.142, 34.104.35.123, 172.202.163.200, 199.232.214.172, 192.229.221.95, 52.165.164.15, 20.3.187.198, 172.217.23.99
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, clientservices.googleapis.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, update.googleapis.com, azureedge-t-prod.trafficmanager.net, clients.l.google.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 04:20:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.977447497630123
Encrypted:	false
SSDEEP:	48:81CdKXcTqXAFOWHOidAKZdA19ehwiZUklqehny+3:81sbOTUy
MD5:	ABA3757916EA5B6BD125AFF474EA0992
SHA1:	EAD7BD3B3C611B0469B2C10451CFF0B71D6FADDD
SHA-256:	9B1D6531FCB2E71921238254016066DD1E175687CF1469B7A91DBC33AE91C4BD
SHA-512:	D6BDDDAE88521D73A06469324B93A6E08C308F31916B0B2917225F81DE3764C8938AC0F691E1B943D1A398F6832DCFA2F389DAAE8EA46D9DD54D5372006DC1C7
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......=..&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IYY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VYY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VYY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VYY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VYY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............4.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 04:20:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9923285402788733
Encrypted:	false
SSDEEP:	48:8MdKXcTqXAFOWHOidAKZdA1weh/iZUkAQkqehEy+2:8WbOh9QZy
MD5:	AD252FCDEFEB7298E86A6F79885409BA
SHA1:	B8C8319A7245D99CAEBA6E2C9B248F53B8B729DB
SHA-256:	8D663512F929C2BC9ADE08CCCAA89A2533EE34351BAB5B6A39D4AB9FD7221C6D
SHA-512:	A13153B2997A3F23CB0C7499ACDE269FEDD3D20E8A11BB94F32601A21CBD702419631BE6269CCA7EF4038B38BC183BACEDB60687A0412B24C200AD547D5A43BB
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......2..&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IYY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VYY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VYY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VYY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VYY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............4.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.005429495576504
Encrypted:	false
SSDEEP:	48:8xudKXcTqXAFsHOidAKZdA14tseh7sFiZUkmgqeh7smy+BX:8xIbHn4y
MD5:	FCC915552E9D9DA993A2688029BE40FC
SHA1:	DDD00F15C29FCA4C86A18A7FAF62A43AA61FF1B1
SHA-256:	69E2A36A62CF613CD0FA2A9F97C560FF41FA9FEAF0A1BC7F50F793F57D0AB8E7
SHA-512:	54E1C4C68E9FC04803C38B6D2EDBDFB22E4EF6E7D7F9543FFADC150511B3AC6525595C7B8BDA4444D7E03FB5343DE5899E69BB6C59216B1886E402B79F5F9352
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IYY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VYY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VYY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VYY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............4.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 04:20:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9907807060184353
Encrypted:	false
SSDEEP:	48:88dKXcTqXAFOWHOidAKZdA1vehDiZUkwqehgy+R:8GbOCuy
MD5:	27F949BFE3A724BDE7EF732DEB8D3C4A
SHA1:	C2161A343B723E749B73B90D257C7652E61B9E1D
SHA-256:	66E79EA30C4C80BC632BB4D921728F2EA2180F0C6BCE1530DDBCB175F4CB3AB1
SHA-512:	093E244287DFA1EAF8FF79614708BA99A8D5EB7D6484021AA32FC39B8862A6AC254C99242373B15034486744DC02710D1D6CF4BDF26B251C3CB8978A17DB9B76
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....MU,..&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IYY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VYY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VYY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VYY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VYY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............4.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 04:20:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.978340351238406
Encrypted:	false
SSDEEP:	48:8MdKXcTqXAFOWHOidAKZdA1hehBiZUk1W1qeh6y+C:8WbOy9ay
MD5:	86D819256CEDB25F695D4F5DEF739FA5
SHA1:	02D29E6625F65CEB5B0E676F38D1B380C2485114
SHA-256:	824FAE08B7CDDFBDC3799DC1E62DDA7FD11814D5F1F37D10188E26F24A769CD8
SHA-512:	7BD6A277E4C5714DC4A027FE4B519CD9857B1A1286AEA08AF7C93163E2695365C221119A8B8FDE3FBBF691E71E74EFE29B7DCD40042A5DF3AAB90A0865C9F541
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....>\8..&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IYY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VYY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VYY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VYY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VYY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............4.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 04:20:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9890140521278736
Encrypted:	false
SSDEEP:	48:8tdKXcTqXAFOWHOidAKZdA1duT+ehOuTbbiZUk5OjqehOuTb4y+yT+:8tbOsT/TbxWOvTb4y7T
MD5:	6CDF0575649094876B03AD203F87B800
SHA1:	29BF45893946B003BA3C792F053BE293A620F26E
SHA-256:	6D0D2516B64656F23F78176B4E3DA0FE05F95B9C8E36E91A69CACDC3A944DF31
SHA-512:	431D482915CA605F1BAC154007436DCF84734AEB468275A3680E92256077195ABD1E1D8CBB15CA9D3B9127F9C7F0FEE32C0D524FA9EC843AC053B1C9C4D7E880
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....n.!..&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IYY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VYY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VYY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VYY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VYY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............4.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 59

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	downloaded
Size (bytes):	1150
Entropy (8bit):	5.05766879304851
Encrypted:	false
SSDEEP:	12:X8rYwT3Z+XeAOkXvg+ULMsZtFFF2Xh2zMBdZ3Gy/ZhB7dKuUPnxh4Or:X8Mw8O4Xvg+UQsvFFWhfdZ3Gy/ZfdD
MD5:	864FCE5A44B12F4D61BE5E45BB6BE601
SHA1:	A9351D3E5E05171D5486DC28E37C54AD231A2B95
SHA-256:	1822604DF5E92A7992DAB0359F8787B392874E39E526F6D857FB736355B2D986
SHA-512:	E3DC48190EF67F9EC604CEE6992EB9F514775EFA8D9388B8429D22FAE58A19A45108740F63B3325F0146F0E872FCC5AC135761F738A30FB03A77F555087209CB
Malicious:	false
Reputation:	low
URL:	https://firstforcheck-com.fmailroute.net/favicon.ico
Preview:	............ .h.......(....... ..... .............................UO.:4..,%..+$..+$..+$..+$..+$..+$..+$..+$..,%..;5..QK.\|w..UP.0)..)"..#..#..#..#..#..#..#..#..#..#..)"../(..OI.=6..)"..#..#..)"..)"..#..#..#..#..)"..)"..#..#..)"..:3..,%..#..#..#..72..?;..1+..#..#..1+..?;..73..#..#..#..+$..+$..#..)"..5/..........ut..&...%...rq..........61..)"..#..+$..+$..#..)"..:5..........:4..NJ..PL..94..........<7..)"..#..+$..+$..#..)"..:5......ZW..WS..........ZW..ZW......<7..)"..#..+$..+$..#..)"..:5..................................<7..)"..#..+$..+$..#..)"..:5..............61..EA..............<7..)"..#..+$..+$..#..)"..72........../..vu..................83..)"..#..+$..+$..#..#..#..nk.......}..=9..ZX......fe..IE..+%..#..#..+$..+$..#..#..#..("..om..........\|z......MI..&...#..#..#..+$..,%..#..#..#..#..)"..ro..........rp..$..#..#..#..#..+$..=6..)"..#..#..#..#..#..fc..gd..)#..#..#..#..#..)"..:3..UO.0)..)"..#..#..#..#..(!..(!..#..#

Chrome Cache Entry: 60

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.05766879304851
Encrypted:	false
SSDEEP:	12:X8rYwT3Z+XeAOkXvg+ULMsZtFFF2Xh2zMBdZ3Gy/ZhB7dKuUPnxh4Or:X8Mw8O4Xvg+UQsvFFWhfdZ3Gy/ZfdD
MD5:	864FCE5A44B12F4D61BE5E45BB6BE601
SHA1:	A9351D3E5E05171D5486DC28E37C54AD231A2B95
SHA-256:	1822604DF5E92A7992DAB0359F8787B392874E39E526F6D857FB736355B2D986
SHA-512:	E3DC48190EF67F9EC604CEE6992EB9F514775EFA8D9388B8429D22FAE58A19A45108740F63B3325F0146F0E872FCC5AC135761F738A30FB03A77F555087209CB
Malicious:	false
Reputation:	low
Preview:	............ .h.......(....... ..... .............................UO.:4..,%..+$..+$..+$..+$..+$..+$..+$..+$..,%..;5..QK.\|w..UP.0)..)"..#..#..#..#..#..#..#..#..#..#..)"../(..OI.=6..)"..#..#..)"..)"..#..#..#..#..)"..)"..#..#..)"..:3..,%..#..#..#..72..?;..1+..#..#..1+..?;..73..#..#..#..+$..+$..#..)"..5/..........ut..&...%...rq..........61..)"..#..+$..+$..#..)"..:5..........:4..NJ..PL..94..........<7..)"..#..+$..+$..#..)"..:5......ZW..WS..........ZW..ZW......<7..)"..#..+$..+$..#..)"..:5..................................<7..)"..#..+$..+$..#..)"..:5..............61..EA..............<7..)"..#..+$..+$..#..)"..72........../..vu..................83..)"..#..+$..+$..#..#..#..nk.......}..=9..ZX......fe..IE..+%..#..#..+$..+$..#..#..#..("..om..........\|z......MI..&...#..#..#..+$..,%..#..#..#..#..)"..ro..........rp..$..#..#..#..#..+$..=6..)"..#..#..#..#..#..fc..gd..)#..#..#..#..#..)"..:3..UO.0)..)"..#..#..#..#..(!..(!..#..#

Chrome Cache Entry: 61

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Reputation:	low
URL:	https://firstforcheck-com.fmailroute.net/d8I7pBRrJuxaIwZfRUDtnEmNxnN2RsmY3GcY6bXFDKL_7-PX1jfOWrL4ddomY3LulkDX92pSDxPXqJKzqE7jBkJLMl25z5bKcyonDf4ngPeJyhdSvL4vV_emiziuVfLJ4mpJR5U0JfPs3FnyI3xd6Ynk1_KaVseIQifh-VriH6wajgm_0w8vx7zdlIfyMIoXkaUzMMUn
Preview:	GIF89a.............!.......,...........D..;

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 25, 2024 07:20:17.656029940 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 25, 2024 07:20:17.656037092 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 25, 2024 07:20:17.781251907 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 25, 2024 07:20:27.265317917 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 25, 2024 07:20:27.359033108 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 25, 2024 07:20:27.468414068 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 25, 2024 07:20:28.272711039 CEST	49709	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:28.272802114 CEST	443	49709	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:28.272886992 CEST	49709	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:28.273320913 CEST	49710	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:28.273363113 CEST	443	49710	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:28.273428917 CEST	49710	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:28.273597956 CEST	49709	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:28.273642063 CEST	443	49709	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:28.273804903 CEST	49710	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:28.273823977 CEST	443	49710	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:29.161103964 CEST	443	49710	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:29.178513050 CEST	49710	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:29.178567886 CEST	443	49710	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:29.180138111 CEST	443	49710	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:29.180325985 CEST	49710	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:29.182499886 CEST	49710	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:29.182590961 CEST	443	49710	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:29.182729959 CEST	49710	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:29.182740927 CEST	443	49710	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:29.224041939 CEST	49710	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:29.231808901 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 25, 2024 07:20:29.234333038 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 25, 2024 07:20:29.419608116 CEST	443	49709	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:29.420409918 CEST	49709	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:29.420473099 CEST	443	49709	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:29.421469927 CEST	443	49709	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:29.421541929 CEST	49709	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:29.421988964 CEST	49709	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:29.422060013 CEST	443	49709	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:29.466859102 CEST	49709	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:29.466880083 CEST	443	49709	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:29.507755995 CEST	49709	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:29.718745947 CEST	49713	443	192.168.2.5	142.250.185.228
Oct 25, 2024 07:20:29.718838930 CEST	443	49713	142.250.185.228	192.168.2.5
Oct 25, 2024 07:20:29.718938112 CEST	49713	443	192.168.2.5	142.250.185.228
Oct 25, 2024 07:20:29.719175100 CEST	49713	443	192.168.2.5	142.250.185.228
Oct 25, 2024 07:20:29.719225883 CEST	443	49713	142.250.185.228	192.168.2.5
Oct 25, 2024 07:20:30.074225903 CEST	443	49710	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:30.121855021 CEST	49710	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:30.121891022 CEST	443	49710	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:30.124408960 CEST	49710	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:30.124500036 CEST	443	49710	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:30.124572039 CEST	49710	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:30.153141022 CEST	49709	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:30.199337006 CEST	443	49709	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:30.340081930 CEST	443	49709	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:30.390646935 CEST	49709	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:30.390710115 CEST	443	49709	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:30.391350985 CEST	49709	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:30.391464949 CEST	443	49709	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:30.391535997 CEST	49709	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:30.594151020 CEST	443	49713	142.250.185.228	192.168.2.5
Oct 25, 2024 07:20:30.594844103 CEST	49713	443	192.168.2.5	142.250.185.228
Oct 25, 2024 07:20:30.594866037 CEST	443	49713	142.250.185.228	192.168.2.5
Oct 25, 2024 07:20:30.596514940 CEST	443	49713	142.250.185.228	192.168.2.5
Oct 25, 2024 07:20:30.596581936 CEST	49713	443	192.168.2.5	142.250.185.228
Oct 25, 2024 07:20:30.597682953 CEST	49713	443	192.168.2.5	142.250.185.228
Oct 25, 2024 07:20:30.597767115 CEST	443	49713	142.250.185.228	192.168.2.5
Oct 25, 2024 07:20:30.643593073 CEST	49713	443	192.168.2.5	142.250.185.228
Oct 25, 2024 07:20:30.643601894 CEST	443	49713	142.250.185.228	192.168.2.5
Oct 25, 2024 07:20:30.691270113 CEST	49713	443	192.168.2.5	142.250.185.228
Oct 25, 2024 07:20:30.738790989 CEST	49714	443	192.168.2.5	184.28.90.27
Oct 25, 2024 07:20:30.738883018 CEST	443	49714	184.28.90.27	192.168.2.5
Oct 25, 2024 07:20:30.739166021 CEST	49714	443	192.168.2.5	184.28.90.27
Oct 25, 2024 07:20:30.740943909 CEST	49714	443	192.168.2.5	184.28.90.27
Oct 25, 2024 07:20:30.740992069 CEST	443	49714	184.28.90.27	192.168.2.5
Oct 25, 2024 07:20:30.756392002 CEST	49715	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:30.756438017 CEST	443	49715	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:30.756504059 CEST	49715	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:30.757184029 CEST	49715	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:30.757200003 CEST	443	49715	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:31.481581926 CEST	443	49715	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:31.482302904 CEST	49715	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:31.482336998 CEST	443	49715	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:31.483844042 CEST	443	49715	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:31.483932972 CEST	49715	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:31.484920979 CEST	49715	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:31.485002041 CEST	443	49715	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:31.485631943 CEST	49715	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:31.485641003 CEST	443	49715	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:31.532100916 CEST	49715	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:31.585011005 CEST	443	49714	184.28.90.27	192.168.2.5
Oct 25, 2024 07:20:31.585118055 CEST	49714	443	192.168.2.5	184.28.90.27
Oct 25, 2024 07:20:31.647510052 CEST	49714	443	192.168.2.5	184.28.90.27
Oct 25, 2024 07:20:31.647572041 CEST	443	49714	184.28.90.27	192.168.2.5
Oct 25, 2024 07:20:31.648081064 CEST	443	49714	184.28.90.27	192.168.2.5
Oct 25, 2024 07:20:31.699975967 CEST	443	49715	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:31.703990936 CEST	49714	443	192.168.2.5	184.28.90.27
Oct 25, 2024 07:20:31.750863075 CEST	49715	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:31.750893116 CEST	443	49715	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:31.756088972 CEST	443	49715	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:31.757917881 CEST	49715	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:31.791547060 CEST	49715	443	192.168.2.5	18.237.22.124
Oct 25, 2024 07:20:31.791565895 CEST	443	49715	18.237.22.124	192.168.2.5
Oct 25, 2024 07:20:31.816603899 CEST	49714	443	192.168.2.5	184.28.90.27
Oct 25, 2024 07:20:31.863336086 CEST	443	49714	184.28.90.27	192.168.2.5
Oct 25, 2024 07:20:32.058161974 CEST	443	49714	184.28.90.27	192.168.2.5
Oct 25, 2024 07:20:32.058202028 CEST	443	49714	184.28.90.27	192.168.2.5
Oct 25, 2024 07:20:32.058268070 CEST	49714	443	192.168.2.5	184.28.90.27
Oct 25, 2024 07:20:32.058351040 CEST	49714	443	192.168.2.5	184.28.90.27
Oct 25, 2024 07:20:32.058397055 CEST	443	49714	184.28.90.27	192.168.2.5
Oct 25, 2024 07:20:32.058427095 CEST	49714	443	192.168.2.5	184.28.90.27
Oct 25, 2024 07:20:32.058443069 CEST	443	49714	184.28.90.27	192.168.2.5
Oct 25, 2024 07:20:32.098877907 CEST	49716	443	192.168.2.5	184.28.90.27
Oct 25, 2024 07:20:32.098975897 CEST	443	49716	184.28.90.27	192.168.2.5
Oct 25, 2024 07:20:32.099065065 CEST	49716	443	192.168.2.5	184.28.90.27
Oct 25, 2024 07:20:32.099287033 CEST	49716	443	192.168.2.5	184.28.90.27
Oct 25, 2024 07:20:32.099338055 CEST	443	49716	184.28.90.27	192.168.2.5
Oct 25, 2024 07:20:32.965476036 CEST	443	49716	184.28.90.27	192.168.2.5
Oct 25, 2024 07:20:32.965641022 CEST	49716	443	192.168.2.5	184.28.90.27
Oct 25, 2024 07:20:32.966840982 CEST	49716	443	192.168.2.5	184.28.90.27
Oct 25, 2024 07:20:32.966869116 CEST	443	49716	184.28.90.27	192.168.2.5
Oct 25, 2024 07:20:32.967684031 CEST	443	49716	184.28.90.27	192.168.2.5
Oct 25, 2024 07:20:32.969028950 CEST	49716	443	192.168.2.5	184.28.90.27
Oct 25, 2024 07:20:33.015372992 CEST	443	49716	184.28.90.27	192.168.2.5
Oct 25, 2024 07:20:33.218410969 CEST	443	49716	184.28.90.27	192.168.2.5
Oct 25, 2024 07:20:33.218575001 CEST	443	49716	184.28.90.27	192.168.2.5
Oct 25, 2024 07:20:33.218672991 CEST	49716	443	192.168.2.5	184.28.90.27
Oct 25, 2024 07:20:33.268533945 CEST	49716	443	192.168.2.5	184.28.90.27
Oct 25, 2024 07:20:33.268600941 CEST	443	49716	184.28.90.27	192.168.2.5
Oct 25, 2024 07:20:40.583619118 CEST	443	49713	142.250.185.228	192.168.2.5
Oct 25, 2024 07:20:40.583758116 CEST	443	49713	142.250.185.228	192.168.2.5
Oct 25, 2024 07:20:40.584011078 CEST	49713	443	192.168.2.5	142.250.185.228
Oct 25, 2024 07:20:41.678320885 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:41.678414106 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:41.678554058 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:41.678998947 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:41.679029942 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:42.362046003 CEST	49713	443	192.168.2.5	142.250.185.228
Oct 25, 2024 07:20:42.362137079 CEST	443	49713	142.250.185.228	192.168.2.5
Oct 25, 2024 07:20:42.423063040 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:42.423268080 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:42.426983118 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:42.427012920 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:42.427233934 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:42.434703112 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:42.475337029 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:42.678344965 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:42.678371906 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:42.678451061 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:42.678572893 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:42.678572893 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:42.678642035 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:42.678725004 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:42.803824902 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:42.803843021 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:42.804044008 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:42.804110050 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:42.804183960 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:42.913376093 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:42.913392067 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:42.913496971 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:42.913541079 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:42.913664103 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:43.030909061 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.030924082 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.031023979 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:43.031056881 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.031116009 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:43.148528099 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.148545027 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.148638010 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:43.148679018 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.148736954 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:43.265670061 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.265688896 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.265773058 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:43.265811920 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.265916109 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:43.383169889 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.383187056 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.383268118 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:43.383347988 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.383460045 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:43.469582081 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.469598055 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.469856024 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:43.469918013 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.470038891 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:43.543286085 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.543302059 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.543395996 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:43.543411016 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.543561935 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:43.660258055 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.660276890 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.660381079 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:43.660381079 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:43.660429955 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.660645962 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:43.735943079 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.735958099 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.736112118 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:43.736171007 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.736284018 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:43.853251934 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.853271008 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.853404045 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:43.853446960 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.853574038 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:43.896224022 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.896238089 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.896363020 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:43.896400928 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.896528006 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:43.970715046 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.970781088 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.970819950 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:43.970860958 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:43.970860958 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:43.970906973 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:43.970944881 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:43.970963001 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.024838924 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.024930000 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.024981976 CEST	49725	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.025032043 CEST	443	49725	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.025079966 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.025202990 CEST	49725	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.025712013 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.025748968 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.025789022 CEST	49725	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.025805950 CEST	443	49725	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.027252913 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.027261019 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.027604103 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.027604103 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.027625084 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.028738976 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.028745890 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.029536963 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.029567957 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.029603004 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.029849052 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.029861927 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.029897928 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.030174971 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.030201912 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.755420923 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.756128073 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.756191015 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.756778955 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.756794930 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.758543015 CEST	443	49725	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.758929014 CEST	49725	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.759008884 CEST	443	49725	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.759087086 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.759363890 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.759382010 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.759555101 CEST	49725	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.759568930 CEST	443	49725	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.759870052 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.759881020 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.766985893 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.767380953 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.767398119 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.767927885 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.767940044 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.779299974 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.779638052 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.779654026 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.780172110 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.780183077 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.885533094 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.885680914 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.885745049 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.885859013 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.885895014 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.885948896 CEST	49726	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.885963917 CEST	443	49726	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.888319969 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.888920069 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.888948917 CEST	443	49725	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.888981104 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.888984919 CEST	443	49725	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.889039040 CEST	49725	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.889048100 CEST	443	49725	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.889112949 CEST	49725	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.889272928 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.889291048 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.889313936 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.889324903 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.890830994 CEST	49725	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.890870094 CEST	443	49725	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.890896082 CEST	49725	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.890909910 CEST	443	49725	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.895243883 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.895292997 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.895462990 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.896296024 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.896325111 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.898238897 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.898286104 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.898358107 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.898376942 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.898406029 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.898462057 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.901098013 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.901118040 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.901139975 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.901149988 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.901813030 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.901870966 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.901995897 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.902932882 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.902961016 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.903228998 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.903260946 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.903321981 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.903458118 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.903471947 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.904663086 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.904706001 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.904772043 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.904931068 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.904947996 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.909759998 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.909809113 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.909868002 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.909883976 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.909925938 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.909979105 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.910060883 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.910077095 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.910099030 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.910109043 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.912445068 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.912453890 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:44.912513018 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.912612915 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:44.912621021 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.627012014 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.627373934 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.627769947 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.627815008 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.628248930 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.628256083 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.629174948 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.629216909 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.630186081 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.630192041 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.635689020 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.636076927 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.636111975 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.636962891 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.636970043 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.638993025 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.639348984 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.639367104 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.639930964 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.639936924 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.754313946 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.754627943 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.754683018 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.754801035 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.754821062 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.759884119 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.759918928 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.760063887 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.760540009 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.760556936 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.763134003 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.763413906 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.763487101 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.763644934 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.763679981 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.766060114 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.766132116 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.766217947 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.766805887 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.766814947 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.766829967 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.766834974 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.767741919 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.768179893 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.768265009 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.768454075 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.768469095 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.768481016 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.768486023 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.773005962 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.773050070 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.773111105 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.773308992 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.773328066 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.775691032 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.775727987 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.775782108 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.776860952 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.776874065 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.778743982 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.778753996 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.778842926 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.779094934 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.779105902 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.997138977 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.997209072 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.997221947 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.997255087 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.997292995 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.998327017 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:45.998373032 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:45.998378038 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.006205082 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.006212950 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.130219936 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.133150101 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.133162975 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.133225918 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.133229971 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.133466959 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.133470058 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.256762981 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.297482014 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.297489882 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.300658941 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.300666094 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.425343037 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.428543091 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.428564072 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.490529060 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.490957975 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.490993977 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.491547108 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.491554022 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.499667883 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.500037909 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.500122070 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.500713110 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.500727892 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.508316040 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.508760929 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.508797884 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.509141922 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.509150982 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.523406982 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.523762941 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.523803949 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.524322033 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.524334908 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.554536104 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.557179928 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.557202101 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.621179104 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.621354103 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.621409893 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.621648073 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.621669054 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.621682882 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.621690035 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.623986006 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.623997927 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.626816034 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.627038002 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.627104998 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.627192974 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.627193928 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.627238035 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.627265930 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.633265018 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.633276939 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.639614105 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.639858961 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.640032053 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.640033007 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.640033007 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.642101049 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.642108917 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.655690908 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.656016111 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.656126976 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.656166077 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.656166077 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.656207085 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.656239033 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.659008026 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.659017086 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.681993961 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.689480066 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.735340118 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.748610020 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.753776073 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.753797054 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.757508993 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.762300014 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.766486883 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.769421101 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.783483028 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.787986040 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.814016104 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.818489075 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.859335899 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.860006094 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.860080004 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.879467964 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.884171963 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.884216070 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.886471987 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.888720989 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.907603025 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.912180901 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.938870907 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.965743065 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:46.989680052 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:46.995147943 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.008532047 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.014029980 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.032331944 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.035731077 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.064322948 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.067487001 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.111335039 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.112989902 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.118293047 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.118345022 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.119332075 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.122107029 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.138380051 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.142678022 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.160608053 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.167161942 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.192023039 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.197012901 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.243324995 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.243834972 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.246448040 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.246491909 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.262764931 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.274173975 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.285593987 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.294442892 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.318109035 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.332750082 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.364747047 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.368268967 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.370445967 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.373611927 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.398515940 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.402774096 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.420346975 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.424251080 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.460191011 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.463403940 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.492870092 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.496268988 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.523334980 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.527486086 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.544440985 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.547332048 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.584562063 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.590723038 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.617522955 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.620894909 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.648150921 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.660995007 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.669315100 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.674232006 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.713010073 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.717749119 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.742868900 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.747749090 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.775099039 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.778042078 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.794296980 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.796607971 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.838493109 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.841161966 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.868904114 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.874253035 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.900485992 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.905761003 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.921897888 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.926346064 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.963259935 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:47.967453003 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:47.993457079 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:48.003782988 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:48.024904013 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:48.028301001 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:48.049392939 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:48.052159071 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:48.087523937 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:48.090451956 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:48.118149042 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:48.121704102 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:48.149164915 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:48.151839972 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:48.173933983 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:48.176390886 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:48.212294102 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:48.215033054 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:48.242769957 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:48.245862961 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:48.274956942 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:48.277759075 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:48.298261881 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:48.309657097 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:48.355334997 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:48.702178001 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:48.702251911 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:48.702274084 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:48.713826895 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:48.713849068 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:48.716289997 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:48.716295958 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:48.717449903 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:48.717454910 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:48.718440056 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:48.718444109 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:48.824666977 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:48.829998016 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:48.830015898 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:48.872575998 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:48.873125076 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:48.874602079 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:48.874645948 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:48.874655008 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:48.874876022 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:48.882183075 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:48.882188082 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:48.883359909 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:48.883364916 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:48.886430979 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:48.886435986 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:48.886934996 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:48.886950016 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:48.954724073 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:48.958576918 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:48.958599091 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.009462118 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.013086081 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.013101101 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.016345024 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.017218113 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.017350912 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.017359018 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.052452087 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.054088116 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.054128885 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.055635929 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.085144043 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.089133978 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.131329060 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.137420893 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.142018080 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.142031908 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.179352999 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.184020042 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.184034109 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.184555054 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.190521002 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.190535069 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.193660021 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.214777946 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.219793081 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.263339043 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.431197882 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.431602001 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.431705952 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.431723118 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.440846920 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.440862894 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.441153049 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.441158056 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.442115068 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.442118883 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.444664955 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.444679022 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.556188107 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.559113979 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.559133053 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.564929962 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.567327023 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.576944113 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.577316999 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.577403069 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.577413082 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.580450058 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.581352949 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.581396103 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.581809044 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.623337030 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.811276913 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.815433025 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.815449953 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.818197012 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.859338045 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.929749012 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.935826063 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.935842037 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.977121115 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.977180958 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.977190018 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.978074074 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.978117943 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.978126049 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.991166115 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.991170883 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.995047092 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.995052099 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.995731115 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.995734930 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:49.996073008 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:49.996077061 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.060218096 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.074868917 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.074889898 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.115919113 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.120604992 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.120616913 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.164766073 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.165524006 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.165575027 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.165584087 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.169754982 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.169764042 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.169801950 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.169806957 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.170412064 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.170416117 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.199470043 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.201970100 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.243339062 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.244887114 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.247116089 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.247127056 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.294684887 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.297544956 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.297569036 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.323827028 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.328758001 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.328780890 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.330862999 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.369781017 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.374290943 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.415340900 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.416377068 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.420757055 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.420809031 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.421706915 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.428142071 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.453670979 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.457490921 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.494463921 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.497734070 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.539328098 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.540834904 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.543065071 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.543111086 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.545758009 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.547648907 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.578176975 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.580301046 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.618669987 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.620778084 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.663374901 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.664663076 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.666899920 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.666944981 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.669825077 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.672020912 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.675007105 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.676971912 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.705158949 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.707833052 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.745460987 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.749430895 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.791373968 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.791410923 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.793729067 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.793771982 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.802398920 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.804450035 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.830741882 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.832793951 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.870570898 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.872747898 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.915376902 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.921175957 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.923316002 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.923371077 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.926717043 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.928618908 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.955307961 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.957389116 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:50.994616032 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:50.997524023 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.040680885 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.043935061 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.047976971 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.051135063 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.079658985 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.082770109 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.118983030 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.122531891 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.163341045 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.164808035 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.168258905 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.168297052 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.171828985 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.174170017 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.204296112 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.206737995 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.243331909 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.245572090 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.287334919 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.289432049 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.291419029 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.291451931 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.295687914 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.297631025 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.333230972 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.335213900 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.367501974 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.369611979 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.413849115 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.416100979 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.419532061 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.421257973 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.457628965 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.461041927 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.492147923 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.494366884 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.539319992 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.539861917 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.542243004 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.542260885 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.545408010 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.547332048 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.581759930 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.583811045 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.616648912 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.618765116 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.663321018 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.664022923 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.666347980 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.666389942 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.669382095 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.671448946 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.707921982 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.710062981 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.741381884 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.744137049 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.788079977 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.791045904 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.835321903 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.841444969 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.843832016 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.843847990 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.846036911 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.869973898 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.872250080 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.915132046 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.917227030 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.920779943 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.923547983 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.968259096 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.970494032 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.973711014 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.975780010 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:51.997426033 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:51.999552965 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.043323040 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.043418884 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.045546055 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.045573950 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.092366934 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.094749928 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.094775915 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.097168922 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.099869967 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.121478081 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.124146938 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.167335033 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.167469025 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.169821978 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.169850111 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.216070890 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.218743086 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.218761921 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.221865892 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.224060059 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.226924896 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.228992939 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.248455048 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.250804901 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.294136047 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.297725916 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.339329958 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.343135118 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.347091913 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.347125053 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.348144054 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.351327896 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.373580933 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.375804901 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.418601990 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.421211004 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.463383913 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.467911959 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.472459078 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.472491980 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.498191118 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.547642946 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.547662973 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.551202059 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.551229000 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.551331043 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.551342964 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.553378105 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.553411007 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.592040062 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.594645977 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.623102903 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.625247955 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.667330027 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.675539017 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.677794933 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.677814960 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.681638956 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.718719959 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.718805075 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.718815088 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.721698999 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.722021103 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.722043991 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.722604990 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.749916077 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.752026081 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.799340010 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.802120924 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.809652090 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.809709072 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.845957041 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.848934889 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.874377012 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.877383947 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.877405882 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.879322052 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.921602964 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.923918009 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.933763981 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.935848951 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:52.972975969 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:52.975155115 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.003874063 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.006387949 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.046222925 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.048816919 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.058046103 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.060156107 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.097717047 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.105031967 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.128465891 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.159499884 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.170562983 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.176569939 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.182146072 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.186326981 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.221995115 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.226253033 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.255641937 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.259968996 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.294805050 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.302009106 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.306252003 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.309693098 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.346501112 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.350811005 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.391355038 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.606158018 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.606209040 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.606246948 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.606264114 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.606321096 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.615662098 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.615669012 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.617924929 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.617929935 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.619075060 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.619079113 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.620585918 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.620589972 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.726138115 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.731029987 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.731040955 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.772778034 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.772852898 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.774065018 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.784210920 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.784219980 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.785667896 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.787175894 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.787206888 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.794739962 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.839343071 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.856120110 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.860846996 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.860862970 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.908842087 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.915481091 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.915498972 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.956965923 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.957057953 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.957067013 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.968786001 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.968802929 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.970129967 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.974730968 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:53.974769115 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.985017061 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:53.989721060 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.035341978 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.040050983 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.043813944 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.043826103 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.093473911 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.096550941 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.096566916 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.109266996 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.111468077 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.111479998 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.113440990 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.155339956 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.160536051 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.162637949 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.162698030 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.167817116 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.171025038 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.215342045 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.221132040 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.224391937 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.224481106 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.235601902 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.237953901 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.279344082 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.284751892 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.287930965 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.288005114 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.290401936 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.292634964 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.339334965 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.339543104 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.344480991 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.344546080 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.348707914 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.351454973 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.362067938 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.365144968 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.411338091 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.412879944 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.415759087 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.415812016 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.422677040 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.424835920 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.467339039 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.470304966 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.472424030 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.472477913 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.475990057 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.478256941 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.495886087 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.497786999 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.543346882 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.549487114 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.549563885 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.551032066 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.551124096 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.551132917 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.552906990 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.552953005 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.553647041 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.553688049 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.598148108 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.601802111 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.601852894 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.620912075 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.665599108 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.665611982 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.668555021 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.668616056 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.668623924 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.670217037 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.674686909 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.674731970 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.677242041 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.680411100 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.721960068 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.756778002 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.756798983 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.802277088 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.802362919 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.802376032 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.832340956 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.833638906 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.833657026 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.834820986 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.846616983 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.899959087 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.899972916 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.946836948 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.956630945 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.970714092 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:54.970761061 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:20:54.970768929 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 25, 2024 07:20:55.024962902 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 25, 2024 07:21:29.790776968 CEST	49741	443	192.168.2.5	142.250.185.228
Oct 25, 2024 07:21:29.790816069 CEST	443	49741	142.250.185.228	192.168.2.5
Oct 25, 2024 07:21:29.791127920 CEST	49741	443	192.168.2.5	142.250.185.228
Oct 25, 2024 07:21:29.791526079 CEST	49741	443	192.168.2.5	142.250.185.228
Oct 25, 2024 07:21:29.791542053 CEST	443	49741	142.250.185.228	192.168.2.5
Oct 25, 2024 07:21:30.900353909 CEST	443	49741	142.250.185.228	192.168.2.5
Oct 25, 2024 07:21:30.900659084 CEST	49741	443	192.168.2.5	142.250.185.228
Oct 25, 2024 07:21:30.900675058 CEST	443	49741	142.250.185.228	192.168.2.5
Oct 25, 2024 07:21:30.901761055 CEST	443	49741	142.250.185.228	192.168.2.5
Oct 25, 2024 07:21:30.902096033 CEST	49741	443	192.168.2.5	142.250.185.228
Oct 25, 2024 07:21:30.902267933 CEST	443	49741	142.250.185.228	192.168.2.5
Oct 25, 2024 07:21:30.952799082 CEST	49741	443	192.168.2.5	142.250.185.228
Oct 25, 2024 07:21:40.653064966 CEST	443	49741	142.250.185.228	192.168.2.5
Oct 25, 2024 07:21:40.653213978 CEST	443	49741	142.250.185.228	192.168.2.5
Oct 25, 2024 07:21:40.653458118 CEST	49741	443	192.168.2.5	142.250.185.228
Oct 25, 2024 07:21:42.361536026 CEST	49741	443	192.168.2.5	142.250.185.228
Oct 25, 2024 07:21:42.361562014 CEST	443	49741	142.250.185.228	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 25, 2024 07:20:25.884284019 CEST	53	63220	1.1.1.1	192.168.2.5
Oct 25, 2024 07:20:25.906430006 CEST	53	64195	1.1.1.1	192.168.2.5
Oct 25, 2024 07:20:27.248852968 CEST	53	57123	1.1.1.1	192.168.2.5
Oct 25, 2024 07:20:27.928226948 CEST	50977	53	192.168.2.5	1.1.1.1
Oct 25, 2024 07:20:27.928456068 CEST	61174	53	192.168.2.5	1.1.1.1
Oct 25, 2024 07:20:28.059115887 CEST	53	61174	1.1.1.1	192.168.2.5
Oct 25, 2024 07:20:28.272078991 CEST	53	50977	1.1.1.1	192.168.2.5
Oct 25, 2024 07:20:29.710181952 CEST	63451	53	192.168.2.5	1.1.1.1
Oct 25, 2024 07:20:29.710305929 CEST	50364	53	192.168.2.5	1.1.1.1
Oct 25, 2024 07:20:29.717885017 CEST	53	63451	1.1.1.1	192.168.2.5
Oct 25, 2024 07:20:29.717976093 CEST	53	50364	1.1.1.1	192.168.2.5
Oct 25, 2024 07:20:30.394758940 CEST	63420	53	192.168.2.5	1.1.1.1
Oct 25, 2024 07:20:30.394931078 CEST	62353	53	192.168.2.5	1.1.1.1
Oct 25, 2024 07:20:30.746817112 CEST	53	63420	1.1.1.1	192.168.2.5
Oct 25, 2024 07:20:30.755800009 CEST	53	62353	1.1.1.1	192.168.2.5
Oct 25, 2024 07:20:44.167721033 CEST	53	54005	1.1.1.1	192.168.2.5
Oct 25, 2024 07:21:02.943267107 CEST	53	60856	1.1.1.1	192.168.2.5
Oct 25, 2024 07:21:25.395159960 CEST	53	49826	1.1.1.1	192.168.2.5
Oct 25, 2024 07:21:26.084434986 CEST	53	50678	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 25, 2024 07:20:27.928226948 CEST	192.168.2.5	1.1.1.1	0xb23	Standard query (0)	firstforcheck-com.fmailroute.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 07:20:27.928456068 CEST	192.168.2.5	1.1.1.1	0x2ad8	Standard query (0)	firstforcheck-com.fmailroute.net	65	IN (0x0001)	false
Oct 25, 2024 07:20:29.710181952 CEST	192.168.2.5	1.1.1.1	0x47c4	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 07:20:29.710305929 CEST	192.168.2.5	1.1.1.1	0x76b6	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 25, 2024 07:20:30.394758940 CEST	192.168.2.5	1.1.1.1	0x8242	Standard query (0)	firstforcheck-com.fmailroute.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 07:20:30.394931078 CEST	192.168.2.5	1.1.1.1	0xddd1	Standard query (0)	firstforcheck-com.fmailroute.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 25, 2024 07:20:28.272078991 CEST	1.1.1.1	192.168.2.5	0xb23	No error (0)	firstforcheck-com.fmailroute.net		18.237.22.124	A (IP address)	IN (0x0001)	false
Oct 25, 2024 07:20:29.717885017 CEST	1.1.1.1	192.168.2.5	0x47c4	No error (0)	www.google.com		142.250.185.228	A (IP address)	IN (0x0001)	false
Oct 25, 2024 07:20:29.717976093 CEST	1.1.1.1	192.168.2.5	0x76b6	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 25, 2024 07:20:30.746817112 CEST	1.1.1.1	192.168.2.5	0x8242	No error (0)	firstforcheck-com.fmailroute.net		18.237.22.124	A (IP address)	IN (0x0001)	false
Oct 25, 2024 07:20:38.346230030 CEST	1.1.1.1	192.168.2.5	0x7dcf	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 25, 2024 07:20:38.346230030 CEST	1.1.1.1	192.168.2.5	0x7dcf	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 25, 2024 07:20:39.008475065 CEST	1.1.1.1	192.168.2.5	0xd149	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 07:20:39.008475065 CEST	1.1.1.1	192.168.2.5	0xd149	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 25, 2024 07:20:41.677495956 CEST	1.1.1.1	192.168.2.5	0x276	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 07:20:41.677495956 CEST	1.1.1.1	192.168.2.5	0x276	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 25, 2024 07:20:59.252439976 CEST	1.1.1.1	192.168.2.5	0x4af	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 07:20:59.252439976 CEST	1.1.1.1	192.168.2.5	0x4af	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Oct 25, 2024 07:21:18.024756908 CEST	1.1.1.1	192.168.2.5	0x36fd	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 07:21:18.024756908 CEST	1.1.1.1	192.168.2.5	0x36fd	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Oct 25, 2024 07:21:38.729067087 CEST	1.1.1.1	192.168.2.5	0x44a8	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 07:21:38.729067087 CEST	1.1.1.1	192.168.2.5	0x44a8	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

firstforcheck-com.fmailroute.net

https:

fs.microsoft.com

otelrules.azureedge.net

HTTPS Connections

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Oct 25, 2024 07:20:45.998327017 CEST	13.107.246.45	443	192.168.2.5	49732	CN=*.azureedge.net, O=Microsoft Corporation, L=Redmond, ST=WA, C=US CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 19 17:30:52 CEST 2024 Thu Jun 08 02:00:00 CEST 2023 Thu Aug 01 14:00:00 CEST 2013	Sun Sep 14 17:30:52 CEST 2025 Wed Aug 26 01:59:59 CEST 2026 Fri Jan 15 13:00:00 CET 2038	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-16-23-65281,29-23-24,0	28a2c9bd18a11de089ef85a160da29e4
					CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jun 08 02:00:00 CEST 2023	Wed Aug 26 01:59:59 CEST 2026
					CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Aug 01 14:00:00 CEST 2013	Fri Jan 15 13:00:00 CET 2038

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49710	18.237.22.124	443	3424	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 05:20:29 UTC	875	OUT	GET /d8I7pBRrJuxaIwZfRUDtnEmNxnN2RsmY3GcY6bXFDKL_7-PX1jfOWrL4ddomY3LulkDX92pSDxPXqJKzqE7jBkJLMl25z5bKcyonDf4ngPeJyhdSvL4vV_emiziuVfLJ4mpJR5U0JfPs3FnyI3xd6Ynk1_KaVseIQifh-VriH6wajgm_0w8vx7zdlIfyMIoXkaUzMMUn HTTP/1.1 Host: firstforcheck-com.fmailroute.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 05:20:30 UTC	698	IN	HTTP/1.1 200 OK Cache-Control: private Content-Type: image/gif Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 5.2 Set-Cookie: GMassUniqueID=eac058ac-1920-4e5b-8e46-c23c1df28175; expires=Sun, 21-Sep-2026 03:40:10 GMT; Domain=gmass.co; path=/; SameSite=None; Secure Set-Cookie: GMassAffiliateID=; expires=Sun, 21-Sep-2026 03:40:10 GMT; Domain=gmass.co; path=/; SameSite=None; Secure X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Credentials: true Date: Fri, 25 Oct 2024 05:20:29 GMT Connection: close Content-Length: 43
2024-10-25 05:20:30 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49709	18.237.22.124	443	3424	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 05:20:30 UTC	820	OUT	GET /favicon.ico HTTP/1.1 Host: firstforcheck-com.fmailroute.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://firstforcheck-com.fmailroute.net/d8I7pBRrJuxaIwZfRUDtnEmNxnN2RsmY3GcY6bXFDKL_7-PX1jfOWrL4ddomY3LulkDX92pSDxPXqJKzqE7jBkJLMl25z5bKcyonDf4ngPeJyhdSvL4vV_emiziuVfLJ4mpJR5U0JfPs3FnyI3xd6Ynk1_KaVseIQifh-VriH6wajgm_0w8vx7zdlIfyMIoXkaUzMMUn Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 05:20:30 UTC	448	IN	HTTP/1.1 200 OK Content-Type: image/x-icon Last-Modified: Sun, 05 Nov 2023 05:47:10 GMT Accept-Ranges: bytes ETag: "98b1785abfda1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Credentials: true Date: Fri, 25 Oct 2024 05:20:29 GMT Connection: close Content-Length: 1150
2024-10-25 05:20:30 UTC	1150	IN	Data Raw: 00 00 01 00 01 00 10 10 00 00 01 00 20 00 68 04 00 00 16 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 12 0b 00 00 12 0b 00 00 00 00 00 00 00 00 00 00 88 84 dd 0e 55 4f ce 8a 3a 34 c7 f4 2c 25 c2 ff 2b 24 c2 ff 2b 24 c2 ff 2b 24 c2 ff 2b 24 c2 ff 2b 24 c2 ff 2b 24 c2 ff 2b 24 c2 ff 2b 24 c2 ff 2c 25 c2 ff 3b 35 c7 f7 51 4b cd 8a 7c 77 d9 0e 55 50 ce 8a 30 29 c4 f8 29 22 c2 ff 2a 23 c2 ff 2a 23 c2 ff 2a 23 c2 ff 2a 23 c2 ff 2a 23 c2 ff 2a 23 c2 ff 2a 23 c2 ff 2a 23 c2 ff 2a 23 c2 ff 2a 23 c2 ff 29 22 c2 ff 2f 28 c3 f8 4f 49 cd 8a 3d 36 c7 f5 29 22 c2 ff 2a 23 c2 ff 2a 23 c2 ff 29 22 c2 ff 29 22 c2 ff 2a 23 c2 ff 2a 23 c2 ff 2a 23 c2 ff 2a 23 c2 ff 29 22 c2 ff 29 22 c2 ff 2a 23 c2 ff 2a 23 c2 ff 29 22 c2 ff 3a 33 c6 f5 2c Data Ascii: h( UO:4,%+$+$+$+$+$+$+$+$,%;5QK\|wUP0))"##########)"/(OI=6)"##)")"####)")"##)":3,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49715	18.237.22.124	443	3424	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 05:20:31 UTC	367	OUT	GET /favicon.ico HTTP/1.1 Host: firstforcheck-com.fmailroute.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 05:20:31 UTC	448	IN	HTTP/1.1 200 OK Content-Type: image/x-icon Last-Modified: Sun, 05 Nov 2023 05:47:10 GMT Accept-Ranges: bytes ETag: "98b1785abfda1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Credentials: true Date: Fri, 25 Oct 2024 05:20:31 GMT Connection: close Content-Length: 1150
2024-10-25 05:20:31 UTC	1150	IN	Data Raw: 00 00 01 00 01 00 10 10 00 00 01 00 20 00 68 04 00 00 16 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 12 0b 00 00 12 0b 00 00 00 00 00 00 00 00 00 00 88 84 dd 0e 55 4f ce 8a 3a 34 c7 f4 2c 25 c2 ff 2b 24 c2 ff 2b 24 c2 ff 2b 24 c2 ff 2b 24 c2 ff 2b 24 c2 ff 2b 24 c2 ff 2b 24 c2 ff 2b 24 c2 ff 2c 25 c2 ff 3b 35 c7 f7 51 4b cd 8a 7c 77 d9 0e 55 50 ce 8a 30 29 c4 f8 29 22 c2 ff 2a 23 c2 ff 2a 23 c2 ff 2a 23 c2 ff 2a 23 c2 ff 2a 23 c2 ff 2a 23 c2 ff 2a 23 c2 ff 2a 23 c2 ff 2a 23 c2 ff 2a 23 c2 ff 29 22 c2 ff 2f 28 c3 f8 4f 49 cd 8a 3d 36 c7 f5 29 22 c2 ff 2a 23 c2 ff 2a 23 c2 ff 29 22 c2 ff 29 22 c2 ff 2a 23 c2 ff 2a 23 c2 ff 2a 23 c2 ff 2a 23 c2 ff 29 22 c2 ff 29 22 c2 ff 2a 23 c2 ff 2a 23 c2 ff 29 22 c2 ff 3a 33 c6 f5 2c Data Ascii: h( UO:4,%+$+$+$+$+$+$+$+$,%;5QK\|wUP0))"##########)"/(OI=6)"##)")"####)")"##)":3,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49714	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 05:20:31 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-25 05:20:32 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=213871 Date: Fri, 25 Oct 2024 05:20:31 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49716	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 05:20:32 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-25 05:20:33 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=213869 Date: Fri, 25 Oct 2024 05:20:33 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-25 05:20:33 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	49724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 05:20:42 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-25 05:20:42 UTC	540	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:20:42 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Wed, 23 Oct 2024 06:30:03 GMT ETag: "0x8DCF32C20D7262E" x-ms-request-id: 39f98116-901e-0015-0fb5-25b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241025T052042Z-16849878b78gvgmlcfru6nuc5400000008n000000000mtt4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-25 05:20:42 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-25 05:20:42 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-25 05:20:42 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-25 05:20:43 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-25 05:20:43 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-25 05:20:43 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-25 05:20:43 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-25 05:20:43 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-25 05:20:43 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-25 05:20:43 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 05:20:44 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-25 05:20:44 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:20:44 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 52fc638d-b01e-0070-36c5-201cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241025T052044Z-16849878b78lhh9t0fb3392enw00000008s0000000000hue x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-25 05:20:44 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49725	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 05:20:44 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-25 05:20:44 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:20:44 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 331d1c77-401e-0029-354e-229b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241025T052044Z-16849878b78dsttbr1qw36rxs800000008tg0000000074zb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-25 05:20:44 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 05:20:44 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-25 05:20:44 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:20:44 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 6b50d5b8-301e-005d-5751-26e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241025T052044Z-17c5cb586f6tq56f8fz96wddtg000000029g000000001kbd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-25 05:20:44 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 05:20:44 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-25 05:20:44 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:20:44 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 1a9c8bfd-301e-0000-1fee-25eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241025T052044Z-16849878b78fmrkt2ukpvh9wh400000008qg000000009vx3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-25 05:20:44 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 05:20:44 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-25 05:20:44 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:20:44 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: fdb61705-b01e-0001-2f09-2246e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241025T052044Z-16849878b78k46f8kzwxznephs00000008rg000000002032 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-25 05:20:44 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 05:20:45 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-25 05:20:45 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:20:45 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: b99e46b1-a01e-001e-0499-2549ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241025T052045Z-15b8d89586fvpb597drk06r8fc000000015g000000003h0h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-25 05:20:45 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 05:20:45 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-25 05:20:45 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:20:45 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 734838af-101e-0065-4be5-214088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241025T052045Z-16849878b787psctgubawhx7k800000008q0000000000nqm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-25 05:20:45 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 05:20:45 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-25 05:20:45 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:20:45 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 0a92035d-201e-00aa-57da-213928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241025T052045Z-16849878b78bcpfn2qf7sm6hsn00000001ng00000000ee2b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-25 05:20:45 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 05:20:45 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-25 05:20:45 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:20:45 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: b0d76b6d-d01e-002b-3e84-2525fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241025T052045Z-16849878b785jrf8dn0d2rczaw000000013g00000000r2dy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-25 05:20:45 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 05:20:46 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-25 05:20:46 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:20:46 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 3c9c0adf-d01e-0028-0c96-257896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241025T052046Z-16849878b785jrf8dn0d2rczaw000000017g000000009c22 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-25 05:20:46 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 05:20:46 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-25 05:20:46 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:20:46 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 802631a9-901e-002a-57ad-247a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241025T052046Z-15b8d89586fbt6nf34bm5uw08n00000003zg0000000044wm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-25 05:20:46 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 05:20:46 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-25 05:20:46 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:20:46 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: d7788b78-601e-0084-2f37-266b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241025T052046Z-16849878b788tnsxzb2smucwdc00000008p000000000q1bn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-25 05:20:46 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-25 05:20:46 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-25 05:20:46 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 05:20:46 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: a568b4a7-501e-0035-1a18-26c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241025T052046Z-17c5cb586f65j4snyp1hqk5z2s00000001bg000000008qgt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-25 05:20:46 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 4460, Parent PID: 5600

General

Target ID:	0
Start time:	01:20:19
Start date:	25/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 3424, Parent PID: 4460

General

Target ID:	2
Start time:	01:20:24
Start date:	25/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2536 --field-trial-handle=2508,i,6210796828418128876,436418289677533164,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 4424, Parent PID: 5600

General

Target ID:	3
Start time:	01:20:27
Start date:	25/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://firstforcheck-com.fmailroute.net/d8I7pBRrJuxaIwZfRUDtnEmNxnN2RsmY3GcY6bXFDKL_7-PX1jfOWrL4ddomY3LulkDX92pSDxPXqJKzqE7jBkJLMl25z5bKcyonDf4ngPeJyhdSvL4vV_emiziuVfLJ4mpJR5U0JfPs3FnyI3xd6Ynk1_KaVseIQifh-VriH6wajgm_0w8vx7zdlIfyMIoXkaUzMMUn"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://firstforcheck-com.fmailroute.net/d8I7pBRrJuxaIwZfRUDtnEmNxnN2RsmY3GcY6bXFDKL_7-PX1jfOWrL4ddomY3LulkDX92pSDxPXqJKzqE7jBkJLMl25z5bKcyonDf4ngPeJyhdSvL4vV_emiziuVfLJ4mpJR5U0JfPs3FnyI3xd6Ynk1_KaVseIQifh-VriH6wajgm_0w8vx7zdlIfyMIoXkaUzMMUn

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Connections

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 4460, Parent PID: 5600

General

Chronological Activities

Analysis Process: chrome.exePID: 3424, Parent PID: 4460

General

Windows Analysis Report
https://firstforcheck-com.fmailroute.net/d8I7pBRrJuxaIwZfRUDtnEmNxnN2RsmY3GcY6bXFDKL_7-PX1jfOWrL4ddomY3LulkDX92pSDxPXqJKzqE7jBkJLMl25z5bKcyonDf4ngPeJyhdSvL4vV_emiziuVfLJ4mpJR5U0JfPs3FnyI3xd6Ynk1_KaVseIQifh-VriH6wajgm_0w8vx7zdlIfyMIoXkaUzMMUn